MD 101 EXAM FINAL PAPER 2025/2026 QUESTIONS WITH
ANSWERS GRADED A+
✔✔**Your network contains an ad domain named xy.com that is synched to azure ad
and enrolled in intune.
-computer 1 -> w8.1
-computer2 -> w10 ent without the latest feature update
-computer3 -> W10 ent with the latest feature update
You are evaluating which intune actions you can use to reset the pcs to run w10 ent
with the latest update. Which pcs can you reset by using each action?
Fresh Start Action
-computer1
-computer2
-computer3
-computer2,3
-computer1,2,3
Wipe action
-computer1
-computer2
-computer3
-computer2,3
-computer1,2,3 - ✔✔fresh start: computer2,3
wipe: computer1,2,3
✔✔**You install a feature update on a w10 pc. How many days do you have to roll it
back?
a. 5
b. 10
c. 14
d. 30 - ✔✔b
✔✔**Your network contains an on-site ad domain. The domain contains 2,000 w10 pcs.
You implement hybrid azure ad and intune. You need to automatically register all the
existing pcs to azure ad and enroll the pcs in intune. What should you use?
a. an autodiscover address record
b. an autopilot deployment profile
c. an autodiscover service connection point (scp)
d. a group policy object (gpo) - ✔✔b
✔✔**You are creating a device configuration profile in intune. You need to implement
an admx-backed policy. Which profile type should you use?
a. identity protection
b. custom
,c. device restrictions
d. device restrictions (w10 team) - ✔✔b
✔✔**Your network contains an ad forest. The forest contains a single domain and three
sites named site1, site2, and site3. Each site is associated to two subnets. Site1
contains subneta and subnetb. All client computers in the forest run w10. Delivery
optimization is enabled. You have a pc named pc1 that is in subneta. From which hosts
will pc1 download updates?
a. pcs in site1
b. any computer in the domain
c. pcs in subneta
d. any computer on the network - ✔✔c
✔✔You have an azure ad tenant and 100 w10 pcs that are managed by intune. You
need to configure defender firewall and antivirus on the pcs. What two actions should
you perform?
a. antivirus: create a device configuration profile -> configurate endpoint protection
settings
b. firewall: create a device configuration profile -> configurate endpoint protection
settings
c. firewall: create gpo -> firewall w/ advanced security
d. antivirus: create gpo -> antivirus
e. antivirus: device configuration profile -> device restrictions
f. firewall: device configuration profile -> endpoint protection - ✔✔a
f
✔✔**You have an azure ad tenant named xy.com. All w10 pcs are joined to azure ad
and managed by intune. You need to ensure that you can centrally monitor the pcs by
using windows analytics. What should you create in intune?
a. device configuration profile
b. conditional access policy
c. device compliance policy
d. update policy - ✔✔a
✔✔Your network contains an ad domain named xy.com that synchs to azure ad. The ad
domain contains 200 w8.1 pcs. The pcs are managed by using sccm (current branch).
You need to pilot co-management for only five of the pcs. What should you create first?
a. a domain local distribution group in ad
b. an intune connector for ad
c. a device collection in sccm
d. a dynamic device group in azure ad - ✔✔c
✔✔You have an azure ad tenant. You plan to use autopilot to configure w10 pcs:
device1, 16gb ram, no tpm
device2, 8gb ram, tpm v1.2
, device3, 4gb ram, tpm v2.0
Which devices can be configured by using autopilot self-deploying mode?
a. device2,3
b. device3
c. device2
d. device1,2,3 - ✔✔b
✔✔**You need to enable credential guard on w10 pcs. What should you install on the
pcs?
a. hyper-v
b. application guard
c. guarded host
d. containers - ✔✔a
✔✔**You have a shared w10 pc. The pc is infected with a virus. You discover that a
malicious ttf font was used to compromise the computer. You need to prevent this type
of threat from happening again? What should you use?
a. exploit guard
b. application guard
c. credential guard
d. system guard
e. smartscreen - ✔✔a
✔✔You have an ad domain that contains 2,000 w10 pcs. You implement hybrid azure
ad and intune. You need to automatically register all the existing pcs to azure ad and
enroll in intune. What should you use?
a. autodiscover address record
b. windows autopilot deployment profile
c. autdiscover service connection point (scp)
d. gpo - ✔✔b
✔✔Your company has several w10 pcs enrolled in intune. You deploy computer1 that
runs w10 and is in a workgroup. You need to enroll it in intune. Which option meets the
goal?
a. settings -> connect to work or school account settings
b. sign into portal.manage.microsoft.com -> devices
c. mdm enrollment
d. company portal app -> devices - ✔✔c
✔✔Your network contains on-site ad that syncs to azure ad. You have the following w10
pcs:
-d1, ad joined, ep config mgr not installed, intune enrolled, registered in azure ad
-d2, ad not joined, ep config mgr installed, intune enrolled, registered in azure ad
-d3, ad not joined, ep config mgr not installed, intune enrolled, azure ad joined
-d4, ad joined, ep config mgr installed, intune not enrolled, registered in azure ad
ANSWERS GRADED A+
✔✔**Your network contains an ad domain named xy.com that is synched to azure ad
and enrolled in intune.
-computer 1 -> w8.1
-computer2 -> w10 ent without the latest feature update
-computer3 -> W10 ent with the latest feature update
You are evaluating which intune actions you can use to reset the pcs to run w10 ent
with the latest update. Which pcs can you reset by using each action?
Fresh Start Action
-computer1
-computer2
-computer3
-computer2,3
-computer1,2,3
Wipe action
-computer1
-computer2
-computer3
-computer2,3
-computer1,2,3 - ✔✔fresh start: computer2,3
wipe: computer1,2,3
✔✔**You install a feature update on a w10 pc. How many days do you have to roll it
back?
a. 5
b. 10
c. 14
d. 30 - ✔✔b
✔✔**Your network contains an on-site ad domain. The domain contains 2,000 w10 pcs.
You implement hybrid azure ad and intune. You need to automatically register all the
existing pcs to azure ad and enroll the pcs in intune. What should you use?
a. an autodiscover address record
b. an autopilot deployment profile
c. an autodiscover service connection point (scp)
d. a group policy object (gpo) - ✔✔b
✔✔**You are creating a device configuration profile in intune. You need to implement
an admx-backed policy. Which profile type should you use?
a. identity protection
b. custom
,c. device restrictions
d. device restrictions (w10 team) - ✔✔b
✔✔**Your network contains an ad forest. The forest contains a single domain and three
sites named site1, site2, and site3. Each site is associated to two subnets. Site1
contains subneta and subnetb. All client computers in the forest run w10. Delivery
optimization is enabled. You have a pc named pc1 that is in subneta. From which hosts
will pc1 download updates?
a. pcs in site1
b. any computer in the domain
c. pcs in subneta
d. any computer on the network - ✔✔c
✔✔You have an azure ad tenant and 100 w10 pcs that are managed by intune. You
need to configure defender firewall and antivirus on the pcs. What two actions should
you perform?
a. antivirus: create a device configuration profile -> configurate endpoint protection
settings
b. firewall: create a device configuration profile -> configurate endpoint protection
settings
c. firewall: create gpo -> firewall w/ advanced security
d. antivirus: create gpo -> antivirus
e. antivirus: device configuration profile -> device restrictions
f. firewall: device configuration profile -> endpoint protection - ✔✔a
f
✔✔**You have an azure ad tenant named xy.com. All w10 pcs are joined to azure ad
and managed by intune. You need to ensure that you can centrally monitor the pcs by
using windows analytics. What should you create in intune?
a. device configuration profile
b. conditional access policy
c. device compliance policy
d. update policy - ✔✔a
✔✔Your network contains an ad domain named xy.com that synchs to azure ad. The ad
domain contains 200 w8.1 pcs. The pcs are managed by using sccm (current branch).
You need to pilot co-management for only five of the pcs. What should you create first?
a. a domain local distribution group in ad
b. an intune connector for ad
c. a device collection in sccm
d. a dynamic device group in azure ad - ✔✔c
✔✔You have an azure ad tenant. You plan to use autopilot to configure w10 pcs:
device1, 16gb ram, no tpm
device2, 8gb ram, tpm v1.2
, device3, 4gb ram, tpm v2.0
Which devices can be configured by using autopilot self-deploying mode?
a. device2,3
b. device3
c. device2
d. device1,2,3 - ✔✔b
✔✔**You need to enable credential guard on w10 pcs. What should you install on the
pcs?
a. hyper-v
b. application guard
c. guarded host
d. containers - ✔✔a
✔✔**You have a shared w10 pc. The pc is infected with a virus. You discover that a
malicious ttf font was used to compromise the computer. You need to prevent this type
of threat from happening again? What should you use?
a. exploit guard
b. application guard
c. credential guard
d. system guard
e. smartscreen - ✔✔a
✔✔You have an ad domain that contains 2,000 w10 pcs. You implement hybrid azure
ad and intune. You need to automatically register all the existing pcs to azure ad and
enroll in intune. What should you use?
a. autodiscover address record
b. windows autopilot deployment profile
c. autdiscover service connection point (scp)
d. gpo - ✔✔b
✔✔Your company has several w10 pcs enrolled in intune. You deploy computer1 that
runs w10 and is in a workgroup. You need to enroll it in intune. Which option meets the
goal?
a. settings -> connect to work or school account settings
b. sign into portal.manage.microsoft.com -> devices
c. mdm enrollment
d. company portal app -> devices - ✔✔c
✔✔Your network contains on-site ad that syncs to azure ad. You have the following w10
pcs:
-d1, ad joined, ep config mgr not installed, intune enrolled, registered in azure ad
-d2, ad not joined, ep config mgr installed, intune enrolled, registered in azure ad
-d3, ad not joined, ep config mgr not installed, intune enrolled, azure ad joined
-d4, ad joined, ep config mgr installed, intune not enrolled, registered in azure ad
