Courseiva
← Back to Microsoft 365 Endpoint Administrator MD-102 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Microsoft 365 Endpoint Administrator MD-102 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
MD-102
exam code
Microsoft
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related MD-102 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Prepare infrastructure for devices practice questions

Sharpen your MD-102 knowledge of Prepare infrastructure for devices.

Manage and maintain devices practice questions

Sharpen your MD-102 knowledge of Manage and maintain devices.

Manage applications practice questions

Work through MD-102 questions on Manage applications.

Protect devices practice questions

Targeted MD-102 practice covering Protect devices.

MD-102 fundamentals practice questions

MD-102 fundamentals practice questions for MD-102.

MD-102 scenario practice questions

Work through MD-102 questions on MD-102 scenario.

MD-102 troubleshooting practice questions

Practise MD-102 questions linked to MD-102 troubleshooting.

Practice set

Practice scenarios

Question 1mediummultiple choice
Full question →

Refer to the exhibit. You run a PowerShell command to retrieve a managed device's details. The ComplianceState is 'compliant' but the device has not synced in 7 days. What is the most likely reason?

Exhibit

Get-MgDeviceManagementManagedDevice -ManagedDeviceId "12345678-1234-1234-1234-123456789012" | Select-Object -Property DeviceName, OperatingSystem, ComplianceState, LastSyncDateTime
Question 2mediummultiple choice
Full question →

Refer to the exhibit. You have configured the above Windows Autopilot profile. A device with this profile is being set up. However, the device does not appear to be provisioning correctly. What is the most likely issue?

Exhibit

{
  "displayName": "Windows Autopilot Profile",
  "description": "Self-deploying for kiosks",
  "deploymentProfile": {
    "deploymentMode": "selfDeploying",
    "languageLocale": "en-US",
    "keyboardLocale": "en-US",
    "applicationGroupAssignments": []
  },
  "deviceNameTemplate": "KIOSK-%RAND:5%"
}
Question 3easymultiple choice
Full question →

You run the PowerShell command shown in the exhibit for a managed device. The device shows as noncompliant. Which action should you take first to resolve the noncompliance?

Exhibit

Refer to the exhibit.

Get-MgDeviceManagementManagedDevice -DeviceId "12345" | Select-Object -Property DeviceName, OperatingSystem, ComplianceState, LastSyncDateTime

DeviceName   : DESKTOP-ABC
OperatingSystem : Windows
ComplianceState  : noncompliant
LastSyncDateTime : 2026-01-15T10:30:00Z
Question 4easymultiple choice
Full question →

Refer to the exhibit. You are reviewing an Intune management intent configuration. What does this setting configure on Windows devices?

Exhibit

{
  "managementIntent": {
    "displayName": "Baseline Security",
    "settingsDelta": [
      {
        "settingDefinitionId": "device_vendor_msft_policy_config_windowsfirewall_publicprofile_enablefirewall",
        "settingInstance": {
          "@odata.type": "#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance",
          "choiceSettingValue": {
            "value": "device_vendor_msft_policy_config_windowsfirewall_publicprofile_enablefirewall_1"
          }
        }
      }
    ]
  }
}
Question 5hardmultiple choice
Full question →

Refer to the exhibit. You deploy this compliance policy to a Windows 11 device running OS version 10.0.22621.100. The device has a password set, firewall active, and Defender enabled. However, the device is marked as non-compliant. What is the most likely reason?

Exhibit

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "description": "Device compliance policy for Windows 10 devices",
  "displayName": "Windows 10 Compliance Policy v2",
  "passwordRequired": true,
  "passwordMinimumLength": 8,
  "passwordRequiredType": "deviceDefault",
  "passwordMinutesOfInactivityBeforeLock": 15,
  "storageRequireEncryption": true,
  "activeFirewallRequired": true,
  "defenderEnabled": true,
  "defenderVersion": "4.18.2207.7",
  "osMinimumVersion": "10.0.19042.0",
  "osMaximumVersion": "10.0.22621.0"
}
Question 6hardmultiple choice
Full question →

You have assigned the compliance policy shown in the exhibit to all Windows devices. A Windows 11 device running build 10.0.22621.1500 reports as noncompliant. Which setting is causing the noncompliance?

Exhibit

Refer to the exhibit.

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "description": "Windows 11 compliance policy",
  "displayName": "Win11 Compliance Policy",
  "passwordRequired": true,
  "passwordMinimumLength": 8,
  "passwordMinutesOfInactivityBeforeLock": 15,
  "osMinimumVersion": "10.0.22621.0",
  "osMaximumVersion": "10.0.22621.1000",
  "tpmRequired": true,
  "deviceThreatProtectionEnabled": true,
  "deviceThreatProtectionRequiredSecurityLevel": "medium"
}
Question 7mediummultiple choice
Full question →

Refer to the exhibit. You run the PowerShell command above to get a list of noncompliant devices. The output shows that some devices have a complianceGracePeriodExpirationDateTime in the past. What does this indicate?

Exhibit

Get-DeviceManagement_ManagedDevices | Where-Object {$_.complianceState -eq 'noncompliant'} | Select-Object deviceName, lastSyncDateTime, complianceGracePeriodExpirationDateTime
Question 8mediummultiple choice
Full question →

Refer to the exhibit. You run the PowerShell command shown and get the output. You need to force an immediate sync for PC-001. Which cmdlet should you use?

Exhibit

Refer to the exhibit.
PS C:\> Get-IntuneManagedDevice -DeviceName "PC-001" | Select-Object -Property DeviceName, OSVersion, LastSyncDateTime, ComplianceState, EnrollmentType

DeviceName   OSVersion      LastSyncDateTime        ComplianceState EnrollmentType
----------   ---------      ----------------        --------------- --------------
PC-001       10.0.19044.0   2025-03-15T10:30:00Z   compliant       MDM
Question 9easymultiple choice
Full question →

Refer to the exhibit. You are deploying Microsoft Edge via Intune as a required app for Windows devices. Which setting ensures that any previous version of Microsoft Edge is removed before installing the new version?

Exhibit

{
  "appName": "Microsoft Edge",
  "appVersion": "96.0.1054.62",
  "channel": "Stable",
  "assignment": {
    "intent": "required",
    "installationPurpose": "system",
    "settings": {
      "uninstallPrevious": true
    }
  }
}
Question 10mediummultiple choice
Full question →

Refer to the exhibit. You are reviewing an Intune compliance policy JSON for Windows 10. A device reports as non-compliant, and the compliance status details indicate that the setting 'Secure Boot' is not compliant. The device is a virtual machine. What is the most likely reason?

Exhibit

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "passwordRequired": true,
  "passwordMinimumLength": 6,
  "passwordRequiredType": "deviceDefault",
  "passwordMinutesOfInactivityBeforeLock": 5,
  "passwordExpirationDays": 90,
  "passwordPreviousPasswordCountToBlock": 5,
  "secureBootEnabled": true,
  "codeIntegrityEnabled": true,
  "earlyLaunchAntimalwareDriverProtectionEnabled": true,
  "bitLockerEnabled": true,
  "bitLockerRecoveryPasswordRotation": "disabled"
}
Question 11hardmultiple choice
Full question →

Refer to the exhibit. You run the PowerShell command on a Windows 10 device to troubleshoot why a Win32 app did not install. What information does this command provide?

Exhibit

Get-WinEvent -LogName Microsoft-Windows-IntuneManagementExtension/Admin | Where-Object { $_.Id -eq 1001 }
Question 12mediummultiple choice
Full question →

Refer to the exhibit. An administrator runs this PowerShell command using the Microsoft Graph PowerShell SDK. The output returns no devices. However, the administrator knows that there are non-compliant Windows devices in Intune. What is the most likely reason?

Exhibit

Refer to the exhibit.

```powershell
Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'" |
  Where-Object {$_.complianceState -eq 'noncompliant'} |
  Select-Object id, deviceName, complianceState
```
Question 13mediummultiple choice
Full question →

Refer to the exhibit. You have applied this compliance policy to a Windows 10 device running build 10.0.19044. The device meets all requirements except that the firewall is disabled. What will be the compliance status of the device?

Exhibit

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "passwordRequired": true,
  "passwordMinimumLength": 6,
  "passwordRequiredType": "deviceDefault",
  "osMinimumVersion": "10.0.19041.0",
  "osMaximumVersion": "10.0.22621.0",
  "storageRequireEncryption": true,
  "activeFirewallRequired": true,
  "defenderEnabled": true
}
Question 14easymultiple choice
Full question →

Refer to the exhibit. A compliance policy is defined for Windows 10 devices. What is the minimum OS version required?

Exhibit

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "passwordRequired": true,
  "passwordMinimumLength": 8,
  "passwordRequiredType": "deviceDefault",
  "osMinimumVersion": "10.0.19041.0"
}
Question 15hardmultiple choice
Full question →

Refer to the exhibit. A PowerShell script is used to check the encryption compliance state of Windows devices managed by Intune. Some devices return a State of 'notApplicable' for the Encryption setting. What does this indicate?

Exhibit

Refer to the exhibit.

```
$devices = Get-MgDeviceManagementManagedDevice -Filter "operatingSystem eq 'Windows'"
foreach ($device in $devices) {
    $compliance = Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummary -ManagedDeviceId $device.Id
    Write-Output $device.DeviceName
    $compliance.SettingStates | Where-Object {$_.SettingName -eq "Encryption"} | Select-Object State
}
```

These MD-102 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style MD-102 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.