MD-102 Manage applications Practice Test 11 — 15 Questions

Question 1

An organization uses Microsoft Intune to manage Windows 11 devices. They want to deploy a custom script that runs during device provisioning (ESP – Enrollment Status Page). Which app type should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PowerShell script (Device configuration). PowerShell scripts (Device configuration) are the correct choice because they can be assigned to run during the Enrollment Status Page (ESP) phase of Windows 11 provisioning. Unlike Win32 or LOB apps, PowerShell scripts are executed by the Intune Management Extension before the ESP completes, allowing custom actions like registry modifications or file creation to occur during the critical 'Device setup' stage. This ensures the script runs synchronously with ESP, blocking the provisioning process until completion.

Answer

Line-of-business app

Answer

Win32 app

Answer

Proactive remediations

Question 2

You are planning to deploy a Win32 app to Windows 10 devices using Microsoft Intune. The app requires a specific registry key to be present before installation. How should you ensure the prerequisite is met?

Accepted Answer

Set a requirement rule for the registry key.. Requirement rules are used to evaluate conditions that must be met before the app installation begins. By setting a requirement rule to check for the existence of the specific registry key, Intune will verify the prerequisite and only install the app if the key is present. Detection rules, on the other hand, are intended to verify the app's installation status after deployment, not to check prerequisites before installation. Therefore, option D is incorrect.

Answer

Configure the installation behavior as 'System' to bypass user context.

Answer

Add the registry key as a dependency.

Answer

Configure a detection rule to verify the registry key exists.

Question 3

Your organization deploys Microsoft Defender for Endpoint (now Microsoft Defender XDR) on Windows 10 devices using Intune. After deployment, some devices show 'Defender service is not running' in the security console. The devices are online and compliant. What is the most likely cause?

Accepted Answer

A third-party antivirus is installed and active.. When a third-party antivirus is installed and active on a Windows 10 device, Windows Defender (now Microsoft Defender Antivirus) automatically disables itself to avoid conflicts. This is by design: the Windows Security Center detects the active third-party AV and sets Defender's service state to stopped or disabled. In the Microsoft Defender for Endpoint console, this appears as 'Defender service is not running' even though the device is online and compliant with Intune policies.

Answer

Tamper protection is enabled and blocking the service.

Answer

The devices are not compliant with the Defender policy.

Answer

Windows Firewall is blocking Defender updates.

Question 4

You need to deploy a Microsoft Store app (e.g., Microsoft Whiteboard) to Windows 10 devices managed by Intune. Which app type should you use?

Accepted Answer

Microsoft Store app (Windows). To deploy a Microsoft Store app like Microsoft Whiteboard to Windows 10 devices managed by Intune, you must use the 'Microsoft Store app (Windows)' app type. This type directly integrates with the Microsoft Store catalog, allowing you to select and deploy store apps without needing offline licensing or manual packaging. It supports both online and offline licensing models, but for a standard store app deployment, this is the correct and simplest choice.

Answer

Windows app (Win32)

Answer

Web link

Answer

Microsoft Store for Business (offline licensed)

Question 5

A user reports that a Microsoft 365 Apps for enterprise installation on a Windows 10 device fails with error code 30088-1028. The device is managed by Intune. What is the most likely cause?

Accepted Answer

The device does not have enough free disk space.. Error code 30088-1028 during Microsoft 365 Apps for enterprise installation specifically indicates insufficient disk space on the system drive. The Office deployment process requires a minimum of 4-8 GB of free space for download, extraction, and installation. Intune-managed devices will fail with this exact error when the Click-to-Run service cannot allocate the required temporary and permanent storage.

Answer

Windows Update is disabled on the device.

Answer

The user does not have an appropriate license assigned.

Answer

The device is behind a proxy that blocks the Microsoft CDN.

Question 6

You are deploying a Win32 app that requires .NET Framework 4.8. You create a dependency in Intune for the .NET Framework app. However, some devices fail to install the parent app even though .NET Framework is present. What is the most likely issue?

Accepted Answer

The dependency detection rule does not match the actual .NET installation.. Intune uses detection rules to verify whether a dependency is installed. If the detection rule for the .NET Framework dependency does not match the actual installation state (e.g., it checks for a registry key or file version that differs from what .NET 4.8 actually creates), Intune will incorrectly report the dependency as missing, blocking the parent app installation even though .NET is present.

Answer

The dependency version is set to 'Greater than' instead of 'Greater than or equal to'.

Answer

The parent app is set to install before the dependency.

Answer

The dependency is set to 'Do not install automatically'.

Question 7

Which TWO of the following are valid app types in Microsoft Intune for iOS/iPadOS devices?

Accepted Answer

iOS line-of-business app. Microsoft Intune supports deploying iOS line-of-business (LOB) apps, which are custom-built applications that are not available in the public App Store. Administrators upload the .ipa package directly to Intune, and the app is sideloaded onto managed iOS/iPadOS devices using the Intune Company Portal or Apple's Volume Purchase Program (VPP) for distribution.

Answer

Windows 10 Universal app

Answer

Android Enterprise system app

Answer

Managed Google Play iframe

Question 8

Which THREE of the following are required to deploy a Win32 app using Microsoft Intune?

Accepted Answer

Detection rule. A detection rule is mandatory for Win32 app deployment in Intune. It defines how Intune determines whether the app is already installed on the device (e.g., by checking a file, registry key, or MSI product code). Without a detection rule, Intune cannot verify installation success or prevent reinstallation.

Answer

Product code

Answer

Dependencies

Question 9

Which TWO of the following are valid reasons to use a Windows PowerShell script deployment instead of a Win32 app in Intune?

Accepted Answer

Applying a temporary security configuration change quickly. Scripts in Intune are best suited for quick, temporary changes that do not require a full application lifecycle, such as applying a temporary security configuration change (option B) or modifying registry settings on a schedule (option C). Win32 apps are better for deploying complex applications (option E) or installing MSIs (option D), and configuring Windows Update policies (option A) is done via configuration profiles.

Answer

Configuring Windows Update for Business policies

Answer

Installing an MSI with silent switches

Answer

Deploying a complex application with multiple files

Question 10

Refer to the exhibit. You are reviewing a Win32 app deployment configuration in Microsoft Intune. The detection rule checks for a registry key under HKLM. The app is set to install in user context. A user reports that the app appears as 'Installed' for some users but not others on the same device. What is the most likely cause?

Accepted Answer

The detection rule uses HKLM but the app installs per user, so the key may not exist for all users.. The detection rule is configured to check for a registry key under HKLM (HKEY_LOCAL_MACHINE), but the app is set to install in user context. When a Win32 app is deployed per user, the installation runs in the user's context and writes to HKCU (HKEY_CURRENT_USER) or user-specific locations, not HKLM. Therefore, the HKLM key may exist only for the user who installed the app (or for system-level installations), causing the detection rule to fail for other users on the same device, making the app appear as 'Installed' for some but not others.

Answer

The detection type 'exists' should be 'value' to check the DisplayName.

Answer

The install experience should be 'system' to write to HKLM.

Answer

The 'check32BitOn64System' flag is set to false, causing detection to fail on 64-bit systems.

Question 11

Your organization uses Microsoft Intune to manage 1,500 Windows 10 and 500 macOS devices. You need to deploy Microsoft Edge (Stable channel) to all Windows devices. The deployment must ensure that Edge is set as the default browser, and that the 'SmartScreen' feature is enabled. You also want to ensure that users cannot change the default browser setting. You have created a configuration profile with the required settings. The Edge app is available in the Microsoft Store for Business. Which deployment method should you use to meet all requirements with the least administrative effort?

Accepted Answer

Use the 'Microsoft Edge for Windows 10 and later' built-in app type in Intune, assign it as 'Required' to a device group, and apply the configuration profile.. The built-in 'Microsoft Edge for Windows 10 and later' app type in Intune provides a streamlined deployment for Edge. It allows specifying the channel (Stable), and configuration profiles can enforce the default browser and enable SmartScreen. This requires the least administrative effort as it's fully integrated. Option A (PowerShell script) requires custom scripting and registry manipulation, which is more effort and less manageable. Option B (Win32 app) works but requires downloading the offline installer and applying the configuration profile separately, whereas the built-in type is simpler. Option D (Store for Business app) requires OMA-URI for settings, but the built-in app type already supports configuration profiles, making it unnecessary.

Answer

Use a PowerShell script to install Edge and apply settings via registry.

Answer

Deploy Edge as a Win32 app using the offline installer, and apply the configuration profile separately.

Answer

Deploy Edge as a Microsoft Store for Business app and use OMA-URI to set default browser.

Question 12

You are a Microsoft 365 administrator for a school district. You have 2,000 Windows 10 devices used by students. All devices are enrolled in Microsoft Intune. You need to deploy a set of educational apps from the Microsoft Store for Education (now part of Microsoft Store for Business). The apps should be automatically installed on all student devices, and students should not be able to remove them. You have already added the apps to your Microsoft Store for Business inventory and acquired offline licenses. You have also configured Intune to sync the Microsoft Store for Business. Which action should you take in Intune to deploy the apps with the least administrative effort?

Accepted Answer

Create a 'Microsoft Store for Business' app in Intune, select the offline-licensed apps, and assign as 'Required' to a device group containing all student devices.. Using the 'Microsoft Store for Business' app type with offline licenses allows automatic sync and silent installation. Option B is for user-targeted. Option C is for online licenses. Option D is for Win32 apps.

Answer

Use the 'Microsoft Store app (Windows)' type and assign as 'Required' to the device group.

Answer

Create a 'Microsoft Store for Business' app in Intune, select the online-licensed apps, and assign as 'Available' to a user group.

Answer

Download the app packages and deploy as Win32 apps with silent switches.

Question 13

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a line-of-business (LOB) app that requires a reboot after installation. Which deployment configuration should you use to ensure the app installs and the device reboots outside of business hours?

Accepted Answer

Required assignment with a reboot behavior of 'Immediate'. A Required assignment ensures the app is forcibly installed on devices. Although the reboot behavior is set to 'Immediate', you can use device configuration policies (such as Active Hours or Windows Update restart policies) to defer the reboot until outside business hours. Option A does not guarantee installation because it is only available. Option B is invalid because Available assignments do not support deadlines or grace periods. Option C is for uninstalling, not deploying.

Answer

Available assignment without deadline

Answer

Available assignment with a deadline and a grace period for reboot

Answer

Uninstall assignment for all devices

Question 14

A user reports that a Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune management extension logs show error code 0x80070005. The device is Azure AD joined and compliant. What is the most likely cause?

Accepted Answer

The user does not have local administrator privileges on the device. Error code 0x80070005 translates to 'Access Denied' (E_ACCESSDENIED). Microsoft 365 Apps for enterprise installation requires local administrator privileges to write to protected system paths (e.g., Program Files, registry). Since the device is Azure AD joined and compliant, the most likely cause is that the user lacks local admin rights, which is a common Intune deployment prerequisite.

Answer

The device has insufficient disk space

Answer

The device does not have internet connectivity to the Microsoft CDN

Answer

The device is not compliant with the conditional access policy

Question 15

You are configuring a Windows 10 kiosk device using Intune. The device should run a single-store app in full-screen mode. Which Intune policy type should you use?

Accepted Answer

A device configuration profile using the 'Kiosk' settings for single-app mode. A is correct because Intune's device configuration profile includes a 'Kiosk' settings category specifically designed for Windows 10/11 devices. When you select 'Single-app mode' under kiosk settings, you can specify a single Store app (e.g., a UWP or Win32 app) that will run in full-screen, locked-down mode, preventing users from accessing any other system functions or apps.

Answer

A device restrictions profile blocking access to other apps

Answer

A compliance policy requiring the app to be installed

Answer

A configuration profile for Microsoft Edge in kiosk mode