MD-102 Practice Exam 53 — 20 Questions

Question 1

A company uses Microsoft Intune to manage Android Enterprise devices. They have a requirement to deploy a set of apps that are critical for business operations. Which TWO app deployment policies should the administrator configure to ensure the apps are always available and up-to-date?

Accepted Answer

Enable 'Auto-update' for the apps in the managed Play Store.. Option A is correct because enabling 'Auto-update' for apps in the managed Play Store ensures that critical business apps are automatically updated to the latest version without user intervention, maintaining security and functionality. Option B is correct because assigning apps as 'Required' to a device group forces installation on all targeted devices, guaranteeing that the apps are always present for business operations.

Answer

Configure the app to allow users to update manually.

Answer

Assign the apps as 'Available for enrolled devices' to the device group.

Answer

Set the app assignment type to 'Uninstall' for the device group.

Question 2

A company uses Microsoft Intune to manage iOS and Android devices. Users report that some line-of-business (LOB) apps fail to install with error '0x87D1041C'. The apps are signed and deployed as device-required installs. What is the most likely cause?

Accepted Answer

The app is signed with a different certificate than the one uploaded to Intune.. Error 0x87D1041C in Intune indicates a signature mismatch. When a line-of-business (LOB) app is deployed as a device-required install, the app binary must be signed with a certificate that has been uploaded to the Intune console. If the signing certificate used to sign the app differs from the one uploaded, Intune rejects the installation because it cannot verify the app's integrity and trust chain.

Answer

The user is not assigned to the app deployment.

Answer

The app is not compliant with the device's OS version.

Answer

The device does not have the required app configuration policy.

Question 3

A company wants to deploy Microsoft 365 Apps for enterprise to Windows 10 devices using Intune. They need to ensure that the apps are updated automatically from the Office Content Delivery Network (CDN). Which update channel should they select in the Office app deployment configuration?

Accepted Answer

Monthly Enterprise Channel. The Monthly Enterprise Channel is the correct choice because it provides a predictable, once-per-month update cadence with security and quality updates, and it is designed for enterprise environments that require automatic updates from the Office Content Delivery Network (CDN) via Intune. This channel balances receiving new features sooner than the Semi-Annual Enterprise Channel while still offering managed deployment through configuration profiles.

Answer

Semi-Annual Enterprise Channel

Answer

Current Channel

Answer

Insider Channel

Question 4

You need to deploy a Microsoft 365 Apps for enterprise suite to Windows 10 devices using Intune. Users are unlicensed. How should you proceed?

Accepted Answer

Create a Win32 app package for Microsoft 365 Apps and deploy it.. Option D is correct because when users are unlicensed, the Microsoft 365 Apps for enterprise suite cannot be deployed via the built-in Intune app type (which relies on license activation). Creating a Win32 app package allows you to bundle the Office Deployment Tool (ODT) with a configuration XML that sets the product ID to 'O365ProPlusRetail' and disables automatic licensing checks, enabling deployment to unlicensed devices.

Answer

Deploy the suite as 'available' from Company Portal.

Answer

Use the built-in Microsoft 365 Apps (Office) app type in Intune.

Answer

Assign the Office 365 E3 license to all users.

Question 5

An administrator deploys an iOS app as 'Required' to a group of devices using Intune. The app fails to install on some devices with error '0x87D13B9F'. What is the most likely cause?

Accepted Answer

The devices are not supervised. Error 0x87D13B9F in Intune indicates that the device is not supervised. For iOS/iPadOS, Intune requires devices to be in Supervised mode to install 'Required' apps silently without user interaction. Without supervision, the device cannot accept managed app installations pushed by MDM, causing the deployment to fail.

Answer

The devices have insufficient storage space

Answer

The app is not compatible with the iOS version on those devices

Answer

The app is not signed with an Apple Enterprise Developer certificate

Question 6

Which TWO methods can you use to deploy a custom Windows app that is not available in the Microsoft Store to multiple devices managed by Intune?

Accepted Answer

Line-of-business app. Line-of-business (LOB) app deployment is correct because it allows you to upload and distribute custom Windows apps (e.g., .msi, .appx, or .exe) that are not in the Microsoft Store to Intune-managed devices. This method is specifically designed for internal or third-party apps that are not publicly available, using Intune's app packaging and assignment capabilities.

Answer

Microsoft Store for Business app

Answer

Web app

Answer

Built-in app

Question 7

Order the steps to configure a Windows 10 device for Microsoft 365 Apps deployment via Intune.

Question 8

A Win32 app 'AdobeReader' is configured as 'required' but users report the app is not installed. The above log excerpt is from a device that shows 'Installed' in Intune. What is the most likely cause?

Accepted Answer

The detection script incorrectly reports the app as installed.. The log excerpt indicates that Intune reports the app as 'Installed' on the device, yet users confirm it is not present. This discrepancy most likely occurs because the detection script used to verify installation is flawed—it may be checking for a registry key, file, or version string that exists even when the app is not fully installed, or it may be returning a false positive. Since Intune relies entirely on the detection method to determine installation status, an incorrect script would cause Intune to mark the app as installed without the actual binaries being present.

Answer

The app is assigned to a different device group.

Answer

The app was installed but later removed by the user.

Answer

The device is not syncing with Intune.

Question 9

Match each Intune configuration profile type to its purpose.

Question 10

Match each Windows Update for Business deployment service to its capability.

Question 11

A company uses Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) Win32 app to devices that are not assigned to any user. The app requires installation in the system context. Which installation behavior should be configured in the Intune Win32 app deployment?

Accepted Answer

System. Option C (System) is correct because the Win32 app must run in the system context to install without a user session, which is required for devices not assigned to any user. In Intune, the 'System' installation behavior runs the installer as the local SYSTEM account, enabling silent, elevated installations regardless of user presence.

Answer

User

Answer

Device

Answer

LoggedOnUser

Question 12

An organization uses Microsoft Intune for Windows 10 device management. They need to deploy a custom Windows app (.exe) to kiosk devices. The app requires admin privileges to install, and the devices are shared. Which deployment method should be used?

Accepted Answer

Use a Win32 app with install context set to 'system'.. Option A is correct because Win32 apps in Microsoft Intune can be configured with the install context set to 'system', which grants the necessary admin privileges for installation and ensures the app is installed for all users on shared kiosk devices. This method uses the Intune Management Extension to run the installer with SYSTEM account privileges, bypassing user-level restrictions and supporting per-machine installations.

Answer

Assign the app as 'available' for user-install.

Answer

Deploy as a line-of-business app with device context.

Answer

Package as a Microsoft Store for Business app.

Question 13

A company uses Microsoft Intune to manage Windows 10 devices. They need to deploy Microsoft 365 Apps for enterprise to 500 devices. The devices are in a hybrid Azure AD joined configuration. The administrator wants to use Intune to deploy the apps. Which deployment method should the administrator use?

Accepted Answer

Add a 'Microsoft 365 Apps for Windows 10 and later' app in Intune and assign it to the devices.. Option C is correct because Intune provides a built-in 'Microsoft 365 Apps for Windows 10 and later' app type that is specifically designed to deploy and manage Microsoft 365 Apps for enterprise. This method uses Intune's native integration with the Office Content Delivery Network (CDN) to download and install the latest version of Office, and it supports hybrid Azure AD joined devices without requiring additional tools or configuration files.

Answer

Use the Office Deployment Tool (ODT) to create a configuration file and deploy via Intune as a Win32 app.

Answer

Use Group Policy to deploy the Office 2019 suite.

Answer

Upload the Office installation files as a line-of-business (LOB) app.

Question 14

A company uses Microsoft Intune to manage Windows 10 devices. Users report that some required line-of-business (LOB) apps are not being installed on their devices. The apps are assigned as 'Required' to a device group that includes the affected devices. Which two actions should the administrator take to troubleshoot the issue? (Choose two.)

Accepted Answer

Review the Intune Management Extension logs on a device for installation errors.. The Intune Management Extension (IME) is the component responsible for deploying Win32 and line-of-business (LOB) apps on Windows 10 devices. Reviewing its logs (located in %ProgramData%\Microsoft\IntuneManagementExtension\Logs) provides detailed error messages, such as download failures, dependency issues, or script execution errors, which directly indicate why a required app failed to install.

Answer

Uninstall the app from the affected devices and reassign it as Required.

Answer

Reassign the app to the device group with a different assignment type.

Answer

Run gpresult /r on a device to confirm the app assignment policy is applied.

Question 15

An organization is moving from on-premises SCCM to Microsoft Intune for Windows app management. They need to ensure that users can self-install company portal apps without administrator intervention. Which configuration is required?

Accepted Answer

Assign the app to users as 'Available' in the Company Portal. Option D is correct because the 'Available' assignment type in Microsoft Intune allows users to install apps on demand from the Company Portal without requiring administrator intervention. This configuration meets the requirement for self-service installation while respecting user intent, as opposed to forced installations.

Answer

Configure the app as 'Required' for all users

Answer

Add the app to the Windows Autopilot deployment profile

Answer

Grant users local administrator rights on their devices

Question 16

You manage a fleet of Android Enterprise devices. You need to ensure that only approved apps from the managed Play Store can be installed. What configuration should you enable?

Accepted Answer

Configure a device restriction policy to allow only managed Google Play apps.. Option C is correct because a device restriction policy in Microsoft Intune allows you to restrict app installation to only the managed Google Play store. By configuring the 'Allow only managed Google Play apps' setting, you ensure that users cannot install apps from unapproved sources, effectively controlling the app ecosystem on Android Enterprise devices.

Answer

Set the device to 'Fully managed' and disable unknown sources.

Answer

Deploy an app configuration policy that blocks sideloading.

Answer

Use a compliance policy to block non-compliant apps.

Question 17

An administrator uses Intune to deploy a line-of-business (LOB) app for Android. The app is failing to install on some devices. The administrator reviews the Intune management extension logs and sees error 'Device not compliant with app configuration policy'. Which THREE conditions could cause this error?

Accepted Answer

The device is not enrolled in Android Enterprise work profile. Option A is correct because the 'Device not compliant with app configuration policy' error occurs when an Android Enterprise work profile is required for the app's deployment but the device lacks this enrollment. Intune uses app configuration policies to enforce settings like work profile enrollment; if the device is not enrolled in a work profile, the policy cannot be applied, causing the installation to fail.

Answer

The app was previously installed and then uninstalled

Answer

The Company Portal app is not installed on the device

Question 18

An Android device running OS version 9.0 with app version 1.5.0 is targeted by the app protection policy in the exhibit. What is the expected behavior when the user tries to access work data?

Accepted Answer

Access is allowed with a warning to update the app and OS. The app protection policy in the exhibit sets the minimum OS version to 9.0 and the minimum app version to 1.5.0, with the warning level set to OS version 8.0 and app version 1.4.0. Since the device runs OS 9.0 (meeting the minimum) and app version 1.5.0 (meeting the minimum), but the OS version is below the warning level (9.0 is not below 8.0) and the app version is below the warning level (1.5.0 is not below 1.4.0), the device actually meets both minimum requirements. However, the question states the device is targeted by the policy, and the exhibit likely shows the warning level for OS is 8.0 and for app is 1.4.0, meaning the device's OS 9.0 is above the warning level, but the app version 1.5.0 is above the warning level as well. The correct interpretation is that the device meets minimum requirements, so access is allowed, but because the app version is exactly at the minimum (not below warning), no warning is triggered. Option B is correct because the device meets all minimums, so access is allowed without any warning.

Answer

Access is blocked because the OS version is below the warning level

Answer

Access is allowed without any warning because minimum requirements are met

Answer

Access is blocked because the app version is below the warning level

Question 19

A company uses Microsoft Intune to manage Windows 10 devices. Users report that a LOB app deployed as a required install fails to install on some devices. The app is configured with a dependency on another app. What should the administrator verify first?

Accepted Answer

Check if the dependency app is assigned and installed successfully. Option D is correct because when a required LOB app fails to install, the most common cause is that its dependency app is not present or not successfully installed on the target device. Intune enforces dependency apps to be installed before the parent app, and if the dependency is missing or failed, the parent app installation will not proceed. The administrator should first verify that the dependency app is assigned to the same device groups and has a successful installation status.

Answer

Ensure the devices have internet connectivity

Answer

Verify that the app is signed with a trusted certificate

Answer

Recreate the deployment policy

Question 20

An organization uses Microsoft Intune to manage iOS/iPadOS devices. They have a custom line-of-business (LOB) iOS app that must be deployed to 50 devices. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the 50 devices. After 24 hours, only 30 devices have the app installed. The remaining 20 devices show 'pending install' status. What is the most likely cause?

Accepted Answer

The devices do not have a trusted certificate profile that trusts the enterprise signing certificate.. The most likely cause is that the 20 devices lack a trusted certificate profile that trusts the enterprise signing certificate. For an enterprise-signed LOB app to install on iOS/iPadOS, the device must trust the root certificate used to sign the app. Without a trusted certificate profile deployed via Intune, the installation will remain in 'pending install' status because the device cannot validate the app's signature.

Answer

The .ipa file exceeds the maximum file size allowed for LOB apps.

Answer

The users on the 20 devices have not opened the Company Portal app to trigger the installation.

Answer

The MDM push certificate has expired, preventing app installation.