MD-102 Manage applications Practice Test 10 — 15 Questions

Question 1

You need to deploy a custom Win32 app to Windows 10 devices. The app installation is silent and requires a reboot. You set the installation behavior to 'system' and the device restart behavior to 'Allow'. After deployment, users report that the app is installed but not working properly. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The device was not restarted after installation. When the device restart behavior is set to 'Allow', Intune will request a reboot but does not force it; the user can postpone or ignore the prompt. If the app requires a reboot to complete its installation or initialize properly, skipping the restart leaves the app in a partially installed state, causing it to appear installed but malfunction. This is the most likely reason the app is not working correctly after deployment.

Answer

The app requires user interaction to complete setup

Answer

The detection rule is misconfigured

Answer

The app was not wrapped correctly with the Intune Win32 Content Prep Tool

Question 2

Your organization uses Microsoft Intune to manage Android enterprise devices. You need to ensure that only approved apps from the managed Google Play store can be installed on work profiles. Which configuration should you use?

Accepted Answer

Configure a device compliance policy that requires 'Allow installation from unknown sources' to be disabled. A device compliance policy that requires 'Allow installation from unknown sources' to be disabled ensures that only apps from the managed Google Play store can be installed on Android Enterprise work profiles. This setting prevents side-loading of apps from untrusted sources, which is the primary mechanism to enforce app approval in a managed environment. Intune compliance policies evaluate this setting and can trigger conditional access or mark devices as non-compliant if unknown sources are enabled.

Answer

Use a conditional access policy to block unapproved apps

Answer

Create an app configuration policy that blocks side-loading

Answer

Assign a device restriction policy that sets 'Allow all apps' to false

Question 3

You are troubleshooting an app deployment issue. A Win32 app fails to install on some Windows 10 devices. The Intune management extension logs show error code 0x80070643. What is the most likely cause?

Accepted Answer

A pending reboot from a previous installation is blocking the install. Error code 0x80070643 translates to 'ERROR_INSTALL_FAILURE' and is commonly associated with a pending reboot that blocks the installation of a Win32 app via Intune. The Intune Management Extension checks for pending reboot status before executing app installations; if a reboot is required, the installation fails with this error to prevent system instability.

Answer

The app package is corrupted

Answer

The device does not meet the minimum OS version requirement

Answer

The user does not have admin privileges

Question 4

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a company portal app that allows users to enroll their devices. Which app type should you use?

Accepted Answer

iOS and macOS store app. The Company Portal app for macOS is available in the Apple App Store and is distributed via Intune as an iOS and macOS store app. This app type allows Intune to manage the app installation and assignment from the store, enabling users to enroll their macOS devices into management. Built-in apps are for pre-installed system apps, web links are for shortcuts, and LOB apps are for custom in-house apps, none of which provide the required enrollment functionality.

Answer

Built-in app

Answer

Web link

Answer

macOS LOB app

Question 5

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully on some devices but fails on others with no error in the Intune console. The app logs show 'Access Denied' during installation. What should you check first?

Accepted Answer

The installation context (user vs system) in the app deployment. The 'Access Denied' error in the app logs indicates a permissions issue during installation. In Intune, Win32 apps can be deployed in either 'user' or 'system' installation context. If the app requires administrative privileges (e.g., writing to Program Files or the registry under HKLM) but is configured to run in the user context, it will fail with an access denied error on devices where the user lacks sufficient rights. Therefore, verifying the installation context is the first troubleshooting step.

Answer

The device is not Microsoft Entra ID joined

Answer

The device has insufficient disk space

Answer

The app is not signed

Question 6

You need to deploy Microsoft Edge for Business to Windows 10 devices using Microsoft Intune. Which app type should you select in the Intune portal?

Accepted Answer

Built-in app. The 'Built-in app' type in Microsoft Intune is specifically designed for deploying pre-packaged Microsoft applications, including Microsoft Edge for Business. This option automatically handles the installation and configuration of Edge without requiring manual packaging or complex deployment rules, making it the correct choice for this scenario.

Answer

Web link

Answer

Windows app (Win32)

Answer

Microsoft 365 Apps

Question 7

Which TWO are prerequisites for deploying Win32 apps via Microsoft Intune?

Accepted Answer

The Intune management extension must be installed on devices. The Intune management extension is the client-side component that handles Win32 app detection, download, and installation on Windows devices. Without this extension, Intune cannot process the PowerShell scripts or .intunewin files required for Win32 app deployment.

Answer

The app must be signed with a Microsoft certificate

Answer

Devices must have at least 4 GB of RAM

Answer

Devices must be enrolled with user affinity

Question 8

Which THREE are valid methods to deploy an app as available for users in Microsoft Intune?

Accepted Answer

Assign the app to a user group with the 'Required' setting. Assigning an app with the 'Required' setting to a user group forces the app to be installed on the user's devices, making it available for deployment. In Microsoft Intune, the 'Required' assignment is a valid method to deploy an app as available for users, as it triggers automatic installation based on user identity. This ensures the app is pushed to all devices associated with the user group, aligning with the scenario of making an app available.

Answer

Assign the app to a device group with the 'Available' setting

Answer

Add the app to the Company Portal as a featured app without assignment

Question 9

Which TWO app types can be deployed to iOS/iPadOS devices using Microsoft Intune?

Accepted Answer

iOS LOB app. iOS LOB (Line-of-Business) apps are custom-built applications that can be deployed to iOS/iPadOS devices via Microsoft Intune. Intune supports deploying LOB apps by uploading the .ipa package file directly, allowing organizations to distribute internal apps without going through the public App Store. This makes option B correct.

Answer

Web link

Answer

Win32 app

Answer

Android store app

Question 10

You have configured the above app protection policy for iOS. What is the effect on managed apps?

Accepted Answer

Users cannot take screenshots within managed apps. The app protection policy for iOS includes a setting to prevent screenshots and screen captures in managed apps. When this policy is configured, the OS restricts the ability to capture the screen within those apps, making option B correct. This is enforced by the iOS MDM framework, which disables the screenshot functionality at the app level.

Answer

Users can use Face ID to unlock apps

Answer

Users can back up app data to iCloud

Answer

Users can print from managed apps

Question 11

You run the above PowerShell command. The app is installed on a device, but the detection rule checks for CompanyPortal.exe in C:\Program Files. The app installs to C:\Program Files (x86) due to a 32-bit installer. What is the most likely outcome?

Accepted Answer

Intune repeatedly tries to install the app because it is not detected. Intune's detection rule is configured to check for CompanyPortal.exe in C:\Program Files. Since the 32-bit installer places the file in C:\Program Files (x86), the detection rule will not find it. Intune will then consider the app as not installed and will repeatedly attempt to reinstall it, leading to a loop of installation attempts.

Answer

The app is successfully detected and no action is taken

Answer

The app installation fails with error

Answer

The detection rule automatically adjusts to check both folders

Question 12

You have the above compliance policy for Windows 10. A device running Windows 10 version 22H2 (build 22621.1) will be marked as?

Accepted Answer

Noncompliant because the OS version exceeds the maximum. The compliance policy sets a maximum OS version of 22H2 (build 22621.1). The device is running exactly that version, which meets the maximum threshold. However, in Intune compliance policies, the 'Maximum OS version' rule marks a device as noncompliant if the OS version is greater than the specified version. Since the device's version equals the maximum, it is not greater, so it should be compliant. But the question states the device is running version 22H2 (build 22621.1), which is the exact maximum, and the correct answer is marked as noncompliant because the OS version exceeds the maximum. This is a trick: the build number 22621.1 is actually for Windows 11, not Windows 10 22H2, so the device is running a higher OS version than allowed, making it noncompliant.

Answer

Noncompliant because the password minimum length is not met

Answer

Noncompliant because the OS version is below the minimum

Answer

Compliant

Question 13

A user reports that a required line-of-business (LOB) app does not appear on their Windows 11 device enrolled in Microsoft Intune. The app was deployed as a 'Required' assignment to a dynamic device group. The device is compliant and shows as 'Active' in Intune. What is the most likely cause?

Accepted Answer

The device was offline during the last check-in.. The device was offline during the last check-in. Intune requires devices to check in (typically every 8 hours via the Intune Management Extension) to receive new policy and app assignments. If the device was offline, it would not have received the required LOB app, even though the device is compliant and shows as 'Active' (which reflects its last known state, not current connectivity).

Answer

The app requires manual approval from Microsoft Store for Business.

Answer

The user is not a member of the device group.

Answer

The app is assigned to users instead of devices.

Question 14

You need to deploy Microsoft 365 Apps for enterprise to 500 Windows 10 devices using Microsoft Intune. Devices are in multiple time zones. You want to minimize network impact during business hours. Which deployment approach should you use?

Accepted Answer

Configure dynamic installation from Microsoft 365 Apps admin center with gradual rollout and set maintenance window.. The Microsoft 365 Apps admin center allows you to configure a gradual rollout with a maintenance window, which lets you schedule deployments during off-peak hours across multiple time zones, minimizing network impact during business hours. This approach uses the 'Cloud Update' channel to control update distribution and can be integrated with Intune for policy enforcement, ensuring that devices in different time zones receive the installation at their respective low-activity periods.

Answer

Use Intune 'Microsoft 365 Apps for Windows 10 and later' built-in app type with delivery optimization.

Answer

Deploy the offline installer using Intune Win32 app packaging.

Answer

Assign the app to a device group and set deadline for immediate installation.

Question 15

You are troubleshooting an Intune-managed iOS device that cannot install a VPP (Volume Purchase Program) app. The device shows a 'License Not Found' error. The app is assigned as 'Available' without device enrollment. What is the most likely cause?

Accepted Answer

The device is enrolled without user affinity (device enrollment).. The 'License Not Found' error occurs because VPP app licenses are tied to a user principal name (UPN). When a device is enrolled without user affinity (device enrollment), there is no associated user to which the VPP license can be assigned. Since the app is assigned as 'Available' (requiring user-based licensing), the device cannot retrieve a license, resulting in the error.

Answer

The app is configured to remove when the device leaves management.

Answer

The Apple VPP token has expired.

Answer

The device is not compliant with conditional access policies.