MD-102 Manage applications Practice Test 1 — 15 Questions

Question 1

A company uses Microsoft Intune to manage iOS and Android devices. Users report that some line-of-business (LOB) apps fail to install with error '0x87D1041C'. The apps are signed and deployed as device-required installs. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The app is signed with a different certificate than the one uploaded to Intune.. Error 0x87D1041C in Intune indicates a signature mismatch. When a line-of-business (LOB) app is deployed as a device-required install, the app binary must be signed with a certificate that has been uploaded to the Intune console. If the signing certificate used to sign the app differs from the one uploaded, Intune rejects the installation because it cannot verify the app's integrity and trust chain.

Answer

The user is not assigned to the app deployment.

Answer

The app is not compliant with the device's OS version.

Answer

The device does not have the required app configuration policy.

Question 2

A company uses Microsoft Intune to manage iOS and Android devices. Users report that some line-of-business (LOB) apps fail to install with error '0x87D1041C'. The apps are signed and deployed as device-required installs. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check if the detection rule is incorrectly marking the app as installed.. The most common reason for a 'pending install' status when a detection rule is configured is that the rule is incorrectly detecting the app as already installed. Intune evaluates the detection rule before attempting installation; if the rule finds the registry key (even if the app is not fully functional), Intune skips the installation and reports 'pending' or 'installed' without actually deploying the app. This is a frequent misconfiguration where the detection rule is too broad or references a key that exists from a previous installation or unrelated software.

Answer

Increase the app installation timeout.

Answer

Ensure the device has connectivity to Intune.

Answer

Reassign the app to a different security group.

Question 3

You need to deploy a Microsoft 365 Apps for enterprise suite to Windows 10 devices using Intune. Users are unlicensed. How should you proceed?

Accepted Answer

Create a Win32 app package for Microsoft 365 Apps and deploy it.. When users are unlicensed, the Microsoft 365 Apps for enterprise suite cannot be deployed via the built-in Intune app type (which relies on license activation). Creating a Win32 app package allows you to bundle the Office Deployment Tool (ODT) with a configuration XML that sets the product ID to 'O365ProPlusRetail' and disables automatic licensing checks, enabling deployment to unlicensed devices.

Answer

Deploy the suite as 'available' from Company Portal.

Answer

Use the built-in Microsoft 365 Apps (Office) app type in Intune.

Answer

Assign the Office 365 E3 license to all users.

Question 4

Which TWO methods can you use to deploy a custom Windows app that is not available in the Microsoft Store to multiple devices managed by Intune?

Accepted Answer

Line-of-business app. Line-of-business (LOB) app deployment is correct because it allows you to upload and distribute custom Windows apps in .msi, .appx, or .intunewin format that are not in the Microsoft Store to Intune-managed devices. However, .exe files are not supported as LOB apps; they require Win32 app management. Win32 app management (option B) is also correct because it supports deploying .exe and .msi apps using the .intunewin wrapper, specifically designed for complex Win32 apps that are not in the Store.

Answer

Microsoft Store for Business app

Answer

Web app

Answer

Built-in app

Question 5

Which THREE conditions must be met for an iOS line-of-business app to be successfully installed via Intune?

Accepted Answer

The app must be assigned to a security group.. Option A is correct because in Intune an iOS line-of-business (LOB) app must be targeted through an assignment to an Microsoft Entra ID security group (or user group) so the service knows which users/devices should receive the app. Option B is correct because an iOS LOB app is an in-house app that must be signed with an Apple Developer Enterprise Program distribution certificate (and matching provisioning profile) to install on managed devices without going through the public App Store. Option D is correct because Intune requires the iOS LOB app package to be uploaded as a .ipa file, which is the iOS application archive format Intune processes for LOB deployment. Option C is not required because UDID registration with Apple Business Manager applies to device enrollment/ADE workflows, not to LOB app installation itself. Option E is not required because Intune can deploy LOB apps to supervised/managed devices without the end user signing in with an active Apple ID.

Answer

The device UDID must be registered with Apple Business Manager.

Answer

The user must have an active Apple ID.

Question 6

A Win32 app 'AdobeReader' is configured as 'required' but users report the app is not installed. The above log excerpt is from a device that shows 'Installed' in Intune. What is the most likely cause?

Accepted Answer

The detection script incorrectly reports the app as installed.. The log excerpt indicates that Intune reports the app as 'Installed' on the device, yet users confirm it is not present. This discrepancy most likely occurs because the detection script used to verify installation is flawed—it may be checking for a registry key, file, or version string that exists even when the app is not fully installed, or it may be returning a false positive. Since Intune relies entirely on the detection method to determine installation status, an incorrect script would cause Intune to mark the app as installed without the actual binaries being present.

Answer

The app is assigned to a different device group.

Answer

The app was installed but later removed by the user.

Answer

The device is not syncing with Intune.

Question 7

You configured the above app protection policy for a Microsoft 365 app. Users report that they cannot paste text from the managed app into another app. What is the most likely reason?

Accepted Answer

The 'dataTransferPolicy' is set to 'allowNone', which prevents data from leaving the managed app.. The 'dataTransferPolicy' setting controls how data can be transferred between managed and unmanaged apps. When set to 'allowNone', it prevents any data from leaving the managed app, including paste operations from the managed app into another app. This is the most direct cause of the reported issue.

Answer

The 'pinLength' requirement is not met.

Answer

The 'requireBiometric' setting is blocking actions.

Answer

The 'allowCutCopy' setting is set to false, which blocks copy, but paste is unaffected.

Question 8

A company wants to deploy Microsoft 365 Apps for enterprise to Windows 10 devices using Intune. They need to ensure that the apps are updated automatically from the Office Content Delivery Network (CDN). Which update channel should they select in the Office app deployment configuration?

Accepted Answer

Monthly Enterprise Channel. The Monthly Enterprise Channel is the correct choice because it provides a predictable, once-per-month update cadence with security and quality updates, and it is designed for enterprise environments that require automatic updates from the Office Content Delivery Network (CDN) via Intune. This channel balances receiving new features sooner than the Semi-Annual Enterprise Channel while still offering managed deployment through configuration profiles.

Answer

Semi-Annual Enterprise Channel

Answer

Current Channel

Answer

Insider Channel

Question 9

An administrator deploys an iOS app as 'Required' to a group of devices using Intune. The app fails to install on some devices with error '0x87D13B9F'. What is the most likely cause?

Accepted Answer

The devices are not supervised. Error 0x87D13B9F in Intune indicates that the device is not supervised. For iOS/iPadOS, Intune requires devices to be in Supervised mode to install 'Required' apps silently without user interaction. Without supervision, the device cannot accept managed app installations pushed by MDM, causing the deployment to fail.

Answer

The devices have insufficient storage space

Answer

The app is not compatible with the iOS version on those devices

Answer

The app is not signed with an Apple Enterprise Developer certificate

Question 10

A company is planning to deploy a custom Win32 app to Windows 10 devices using Intune. The app requires a .NET Framework 4.8 prerequisite. Which TWO methods can the administrator use to ensure the prerequisite is installed?

Accepted Answer

Add the prerequisite as a dependency in the app deployment. Intune Win32 app deployment supports dependencies, allowing an administrator to specify .NET Framework 4.8 as a required dependency. When configured, Intune automatically installs the dependency before the main app, ensuring the prerequisite is present without manual intervention or additional scripting.

Answer

Require users to manually install the prerequisite

Answer

Use Group Policy to deploy the prerequisite

Answer

Package the prerequisite into the same Win32 app

Question 11

An administrator uses Intune to deploy a line-of-business (LOB) app for Android. The app is failing to install on some devices. The administrator reviews the Intune management extension logs and sees error 'Device not compliant with app configuration policy'. Which THREE conditions could cause this error?

Accepted Answer

The device is not enrolled in Android Enterprise work profile. The 'Device not compliant with app configuration policy' error occurs when an Android Enterprise work profile is required for the app's deployment but the device lacks this enrollment. Intune uses app configuration policies to enforce settings like work profile enrollment; if the device is not enrolled in a work profile, the policy cannot be applied, causing the installation to fail.

Answer

The app was previously installed and then uninstalled

Answer

The Company Portal app is not installed on the device

Question 12

An organization uses Microsoft Intune to manage iOS/iPadOS devices. They have a custom line-of-business (LOB) iOS app that must be deployed to 50 devices. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the 50 devices. After 24 hours, only 30 devices have the app installed. The remaining 20 devices show 'pending install' status. What is the most likely cause?

Accepted Answer

The devices do not have a trusted certificate profile that trusts the enterprise signing certificate.. The most likely cause is that the 20 devices lack a trusted certificate profile that trusts the enterprise signing certificate. For an enterprise-signed LOB app to install on iOS/iPadOS, the device must trust the root certificate used to sign the app. Without a trusted certificate profile deployed via Intune, the installation will remain in 'pending install' status because the device cannot validate the app's signature.

Answer

The .ipa file exceeds the maximum file size allowed for LOB apps.

Answer

The users on the 20 devices have not opened the Company Portal app to trigger the installation.

Answer

The MDM push certificate has expired, preventing app installation.

Question 13

A company uses Microsoft Intune to manage iOS and Android devices. Users report that some line-of-business (LOB) apps fail to install with error '0x87D1041C'. The apps are signed and deployed as device-required installs. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable 'Auto-update' for the apps in the managed Play Store.. Enabling 'Auto-update' for apps in the managed Play Store ensures that critical business apps are automatically updated to the latest version without user intervention, maintaining security and functionality. Option B is correct because assigning apps as 'Required' to a device group forces installation on all targeted devices, guaranteeing that the apps are always present for business operations.

Answer

Configure the app to allow users to update manually.

Answer

Assign the apps as 'Available for enrolled devices' to the device group.

Answer

Set the app assignment type to 'Uninstall' for the device group.

Question 14

An administrator applies the app protection policy shown in the exhibit to a group of users. A user reports that they are unable to copy data from a managed app and paste it into an unmanaged app. Which setting in the policy causes this behavior?

Accepted Answer

dataTransferToUnmanagedApps is set to false.. The setting `dataTransferToUnmanagedApps` controls whether data can be transferred from a managed app to unmanaged apps via copy/paste, share, or other data-sharing mechanisms. When set to `false`, it blocks all such transfers, including pasting into unmanaged apps. This is the specific policy that prevents the user from copying data from a managed app and pasting it into an unmanaged app.

Answer

requirePin is set to true.

Answer

appSharingFromLevel is set to 'policyManagedApps'.

Answer

disableAppEncryptionIfDeviceEncryptionIsEnabled is set to false.

Question 15

Northwind Traders is a retail company with 500 employees. They use Microsoft Intune to manage iOS devices. The company has a custom iOS app for inventory management that they need to deploy to all store managers. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the store managers' devices. After 48 hours, several managers report that the app is not installed on their devices. The administrator checks the Intune console and sees that the app status for those devices is 'Pending install'. What should the administrator do first to resolve the issue?

Accepted Answer

Deploy a certificate profile that installs the enterprise root certificate to the affected devices.. The 'Pending install' status for an enterprise-signed iOS app typically indicates that the device does not trust the enterprise certificate used to sign the app. Deploying a certificate profile that installs the enterprise root certificate on the affected devices establishes trust, allowing the app to install successfully. Without this trust, iOS blocks the installation of any enterprise-signed app, even when assigned as 'Required' via Intune.

Answer

Create an app protection policy and assign it to the devices.

Answer

Instruct the users to install the app manually from the Company Portal app.

Answer

Re-upload the .ipa file to Intune with a different version number.