Microsoft MD-102 Practice Test

MD-102 practice test: what's covered

• Intune
• Autopilot
• Entra
• Windows
• App protection

Free MD-102 sample questions

1. Contoso ships new laptops directly from the OEM to remote employees who power them on at home, sign in with their work account, and the device automatically joins Entra ID and enrolls in Intune. Which Windows Autopilot deployment mode supports this experience?

   • A. User-driven mode, where the employee authenticates during OOBE and the device joins Entra ID and auto-enrolls in Intune
   • B. Self-deploying mode, which completes enrollment with no user credentials using only the device TPM attestation
   • C. Pre-provisioning mode, which requires a technician to seal the device before the employee ever receives it
   • D. Autopilot reset mode, which wipes an existing managed device and returns it to a ready-to-use enrolled state
   Show answer

   Correct: A. User-driven mode is designed for the ship-direct-to-user scenario: the employee signs in during OOBE, which triggers Entra ID join and automatic Intune enrollment. Self-deploying is incorrect because it uses no user credentials and targets kiosks. Pre-provisioning requires a technician stage first, and Autopilot reset only applies to an already-enrolled device, so neither matches this brand-new shipment flow.

2. A retail company is deploying shared kiosk tablets in store lobbies that must provision with zero user interaction and authenticate using the device's hardware. Which Autopilot mode and hardware requirement applies?

   • A. Self-deploying mode, which requires TPM 2.0 so the device can authenticate to Entra ID without any user credentials
   • B. User-driven mode, which requires the kiosk attendant to enter Entra ID credentials to finish provisioning
   • C. Hybrid Entra join mode, which requires line-of-sight to an on-premises domain controller at first boot
   • D. Pre-provisioning mode, which requires a USB provisioning package staged manually by a technician onsite
   Show answer

   Correct: A. Self-deploying mode provisions kiosks and shared devices with no user interaction, relying on a TPM 2.0 chip for device attestation to Entra ID. User-driven is incorrect because it demands user sign-in. Hybrid join needs domain controller connectivity, not a kiosk fit, and pre-provisioning is a technician staging step rather than a hands-free mode, so neither satisfies the zero-touch kiosk requirement.

3. An administrator must register existing corporate devices for Windows Autopilot before re-deploying them. Which methods can be used to collect and import the hardware hash into Intune? (Choose TWO)

   • A. Run the Get-WindowsAutopilotInfo PowerShell script to export the hardware hash to a CSV and upload it under Windows enrollment
   • B. Have the OEM upload the device hardware identity directly to your tenant through the Autopilot registration process
   • C. Manually type each device serial number into a Conditional Access named location list
   • D. Reinstall Windows from an ISO image so the hash is generated automatically during setup
   • E. Enable BitLocker on the device so the recovery key doubles as the Autopilot hardware identifier
   Show answer

   Correct: A and B. The hardware hash is collected with the Get-WindowsAutopilotInfo script (exported to CSV and imported in Intune) or registered directly by the OEM/reseller against your tenant. Conditional Access named locations are unrelated to device registration. Reinstalling from an ISO does not register a device in Autopilot, and BitLocker recovery keys protect disks and are not hardware identifiers, so those options are incorrect.

4. Your organization still runs several legacy applications that depend on on-premises Active Directory Kerberos authentication, but you also want the workstations managed from the cloud. Which device identity model meets both needs?

   • A. Microsoft Entra hybrid join, which joins devices to both on-premises AD and Entra ID for cloud management with legacy app support
   • B. Microsoft Entra registered, which only adds a personal device for app access without full management or domain trust
   • C. Microsoft Entra join, which is cloud-only and removes any on-premises Active Directory relationship from the device
   • D. Workgroup join, which keeps the device standalone with no directory membership of any kind
   Show answer

   Correct: A. Microsoft Entra hybrid join registers a device in both on-premises AD and Entra ID, preserving Kerberos for legacy apps while enabling cloud management. Entra registered only adds the device for limited app access, not full management. Pure Entra join is cloud-only and drops the AD relationship, and workgroup join has no directory at all, so none of those satisfy the legacy-app plus cloud-management requirement.

5. A security lead wants devices marked non-compliant automatically when they fall below Windows 10 22H2 or have BitLocker disabled, so access can be restricted. Which Intune feature evaluates these criteria?

   • A. A device compliance policy, which defines rules such as minimum OS version and encryption that the device state is evaluated against
   • B. A device configuration profile, which only applies settings to the device but never reports a compliant state
   • C. An app protection policy, which governs data inside managed apps but does not assess device health
   • D. An enrollment status page, which controls the OOBE provisioning experience and shows nothing about ongoing health
   Show answer

   Correct: A. A compliance policy defines the health criteria (minimum OS, BitLocker, antivirus, jailbreak status) and reports a compliant or non-compliant state that Conditional Access can consume. A configuration profile changes settings but does not produce a compliance verdict. App protection policies guard app data, and the enrollment status page controls provisioning, so neither evaluates ongoing device health.

Last updated: 2026-10-19

MD-102 practice test FAQ

Related practice tests

• Microsoft SC-300 practice test
• Microsoft MS-700 practice test
• Microsoft SC-401 practice test
• Microsoft SC-900 practice test
• Microsoft Defender XDR practice test
• Entra Conditional Access troubleshooting practice test