MD-102 Practice Test 30 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. What should you do to ensure the app installs successfully?

Accepted Answer

Enable the Sideloading policy for the device group.. To install an LOB app that is not signed by a trusted certificate, you must disable the Sideloading policy for the device group. Option A is correct because enabling sideloading allows installation of apps signed with untrusted certificates. Option B is wrong because allowing sideloading does not require the app to be in the Microsoft Store. Option C is wrong because the Sideloading policy is not a device configuration profile but an app deployment policy. Option D is wrong because disabling automatic updates does not affect sideloading.

Answer

Create a device configuration profile to allow sideloading.

Answer

Add the app to the Microsoft Store for Business.

Answer

Disable automatic app updates for the device group.

Question 2

A company wants to prevent corporate data from being copied from managed apps to personal apps on iOS devices. Which Intune policy should the administrator configure?

Accepted Answer

App protection policy. The correct answer is App protection policy (MAM). Option A is incorrect because compliance policies apply to devices, not apps. Option B is incorrect because configuration profiles set device settings. Option D is incorrect because enrollment restrictions control device enrollment.

Answer

Device configuration profile

Answer

Device compliance policy

Answer

Enrollment restrictions

Question 3

You need to deploy a web link as an app to Android Enterprise work profile devices. Users should see the link in the Company Portal app. What type of app should you add in Microsoft Intune?

Accepted Answer

Managed Google Play web link. Option A is correct because a web link is added as a 'Managed Google Play web link' for Android Enterprise. Option B is wrong because iOS web clips are for iOS. Option C is wrong because Windows app packages are for Windows. Option D is wrong because Android store app is for store apps, not web links.

Answer

iOS/iPadOS web clip

Answer

Android store app

Answer

Windows app package (MSI)

Question 4

You manage iOS devices with Microsoft Intune. A user reports that a required app is missing from their device. You verify the app is assigned as 'Required' to a user group containing the user, and the device is compliant. What is the most likely reason the app is not installing?

Accepted Answer

The app is configured to require user enrollment, but the device uses device enrollment.. If the app is configured to require the device to be enrolled in user enrollment, the app will not install on devices enrolled via device enrollment. Option C is correct. Option A is wrong because the VPP token expiration would affect all apps, not just this one. Option B is wrong because if DEP is used, the app should still install. Option D is wrong because the app is assigned as required, so user installs should be allowed.

Answer

The app is set to 'Available for enrolled devices' instead of 'Required'.

Answer

The device is not enrolled using Apple Device Enrollment Program (DEP).

Answer

The Apple Volume Purchase Program (VPP) token has expired.

Question 5

Which TWO app types are available for deploying apps to iOS/iPadOS devices in Microsoft Intune? (Choose two.)

Accepted Answer

iOS/iPadOS app store app. Intune supports iOS/iPadOS Line-of-business apps (custom apps) and iOS/iPadOS app store apps (from the Apple App Store). Options A and D are correct. Option B is wrong because Win32 is for Windows. Option C is wrong because Android Line-of-business is for Android. Option E is wrong because Web link is not an app type specific to iOS; it is a generic type.

Answer

Web link

Answer

Windows app (Win32)

Answer

Android Line-of-business app

Question 6

Which TWO of the following are prerequisites for deploying a Win32 app via Microsoft Intune?

Accepted Answer

The app must be packaged using the Microsoft Win32 Content Prep Tool.. Win32 app requires the Intune Management Extension and the app must be packaged in .intunewin format. Option C is incorrect because Company Portal is optional. Option D is incorrect because Windows 10 version 1607+ is required. Option E is incorrect because Azure AD join is not required.

Answer

The device must be running Windows 10 version 1803 or later.

Answer

The device must be Azure AD joined.

Answer

The device must have the Company Portal app installed.

Question 7

Your organization manages Windows devices with Intune and uses Azure Information Protection (AIP) to classify documents. You are deploying the AIP client as a Win32 app. After deployment, some users report that the AIP add-in is not visible in Office applications. What should you check first?

Accepted Answer

Ensure that the required .NET Framework and Visual Studio Tools for Office runtime are installed.. Option C is correct because the AIP client requires the .NET Framework and Visual Studio Tools for Office runtime. Missing prerequisites cause the add-in to not load. Option A is wrong because user permissions affect installation but not add-in visibility after install. Option B is wrong because network connectivity is not the primary issue. Option D is wrong because Office updates don't remove the add-in.

Answer

Confirm that Office is updated to the latest version.

Answer

Verify that the user has local administrator rights.

Answer

Check if the device has internet access to activate the client.

Question 8

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft 365 Apps for enterprise suite to all devices. Which app type should you use in Intune?

Accepted Answer

Microsoft 365 Apps for Windows 10 and later. Microsoft 365 Apps for enterprise is deployed using the 'Microsoft 365 Apps for Windows 10 and later' app type in Intune. Option A is correct. Option B is wrong because line-of-business apps are for custom apps. Option C is wrong because the Windows app (Win32) type is for .exe or .msi installers. Option D is wrong because the Web link type is for shortcuts to web apps.

Answer

Web link

Answer

Windows app (Win32)

Answer

Line-of-business app

Question 9

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved Microsoft Store apps can be installed on company devices. The solution must not require users to be local administrators. What should you configure?

Accepted Answer

Deploy a local AppLocker policy using Intune.. A local AppLocker policy can be deployed via Intune to control app installations without requiring admin rights. Option B is incorrect because Windows Defender Application Control is more complex and not solely for Store apps. Option C is incorrect because Intune App Protection Policies apply to mobile devices, not Windows. Option D is incorrect because Conditional Access controls access, not app installation.

Answer

Enable Conditional Access to block non-approved apps.

Answer

Configure Windows Defender Application Control (WDAC) policy.

Answer

Assign an Intune App Protection Policy (APP) for Windows.

Question 10

Which THREE of the following are valid methods to deploy Microsoft 365 Apps for enterprise using Microsoft Intune?

Accepted Answer

Use the built-in Microsoft 365 Apps app type in Intune.. Intune supports deploying via built-in Microsoft 365 Apps app type, Win32 app packaging, and using the Office Deployment Tool. Option D is incorrect because Azure AD is identity, not deployment method. Option E is incorrect because Intune does not use MSI for M365 Apps.

Answer

Assign the apps via Azure AD application registration.

Answer

Deploy the MSI version of Office via Intune.

Question 11

You have an Intune-managed Windows 10 device that is not receiving app updates. The app was deployed as a Win32 app with a detection rule. You verify that the device is online and the Intune Management Extension is running. What should you check first?

Accepted Answer

The app assignment schedule is configured to update.. The app update frequency is controlled by the app assignment schedule. Option A is correct because if the assignment is set to 'Available' or 'Required' but not 'Update', the app will not update automatically. Option B is wrong because the extension runs regardless. Option C is wrong because logs would not show update policy. Option D is wrong because detection rules are for installation, not updates.

Answer

The detection rule is set to 'File exists'.

Answer

The app is assigned as 'Required' in the assignment.

Answer

The Intune Management Extension is up to date.

Question 12

A company uses Microsoft Intune to manage Windows devices. They want to ensure that only approved Microsoft Store apps can be installed on corporate devices. Which configuration policy should they use?

Accepted Answer

Windows app control policy. A Windows app inventory policy collects installed apps but does not restrict installation. A Microsoft Store for Business app policy is used to deploy and manage store apps. A Windows app sideloading policy controls sideloading, not store app installation. Therefore, a Windows app control policy is correct because it can enforce app control rules, including allowing only approved store apps.

Answer

Windows app sideloading policy

Answer

Microsoft Store for Business app policy

Answer

Windows app inventory policy

Question 13

You are configuring a Windows 10 device compliance policy in Microsoft Intune. The policy requires that devices have BitLocker enabled and a minimum OS build version. However, some devices are showing as 'Not compliant' even though they meet the requirements. What is the most likely cause?

Accepted Answer

The devices have not checked in with Intune recently.. Option B is correct because compliance policies in Intune are evaluated based on the last check-in time; if a device hasn't checked in recently, its status may be outdated. Option A is wrong because a reboot is not required for compliance evaluation. Option C is wrong because BitLocker status is reported correctly if enabled. Option D is wrong because OS build version reporting is accurate.

Answer

The OS build version is not reported correctly.

Answer

BitLocker is not enabled on the system drive.

Answer

The devices need to be rebooted for the policy to apply.

Question 14

You are designing an app protection policy (APP) for Microsoft 365 mobile apps accessing corporate data on iOS devices. The security team requires that when a user opens a work document in the Microsoft Word app, the user must authenticate with Face ID or a passcode. Which setting should you configure?

Accepted Answer

Require PIN or Face ID for access (iOS). Option A is correct because 'Require PIN or Face ID for access' controls access to the app itself, including when opening documents. Option B is wrong because jailbreak/root detection is a device condition. Option C is wrong because encryption is for data at rest. Option D is wrong because 'Block managed apps from running on jailbroken devices' is a device-level check.

Answer

Block managed apps from running on jailbroken devices

Answer

Encrypt app data

Answer

Require app PIN when device PIN is not set

Question 15

You are troubleshooting an Android Enterprise device that fails to install a required app from the Managed Google Play store. The device is compliant and has a valid work profile. What should you check first?

Accepted Answer

Ensure the Managed Google Play app is enabled and active on the device.. If an Android Enterprise device fails to install a required app, the Managed Google Play app is responsible for downloading and installing apps. If it is disabled or not active, apps will not install. Option A is correct. Option B is wrong because compliance policies do not block app installation. Option C is wrong because the app is required, so user approval is not needed. Option D is wrong because device enrollment is already established.

Answer

Check that the device is enrolled in Android Enterprise and has a work profile.

Answer

Confirm the user has approved the app installation in the Managed Google Play store.

Answer

Verify the device compliance policy allows app installation from unknown sources.