MD-102 Manage applications Practice Test 12 — 15 Questions

Question 1

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully, but the detection rule incorrectly reports the app as not installed, causing Intune to attempt reinstallation repeatedly. Which detection rule method is most likely causing this issue?

Accepted Answer

MSI product code detection uses a product code that does not match the installed app. Option D is correct because if the MSI product code is used but the product code is wrong or missing, Intune will not detect the app. Option A is wrong because file existence detection is straightforward if path is correct. Option B is wrong because registry detection is reliable if key exists. Option C is wrong because custom script detection can work if script returns correct exit code.

Answer

File existence detection checks for a file that is installed by the app

Answer

Registry detection checks for a registry key that is created by the app

Answer

Custom script detection returns exit code 0 even if app is not present

Question 2

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) to a group of users. Which TWO requirements must be met?

Accepted Answer

The device must be Azure AD joined or hybrid Azure AD joined. Options B and D are correct. The device must be Azure AD joined or hybrid Azure AD joined for Intune management. The user must have a Microsoft account (MSA) or Azure AD account to access the Store. Option A is wrong because domain join alone is insufficient; device must be enrolled in Intune. Option C is wrong because sideloading is not required for Store apps. Option E is wrong because Microsoft Intune Management Extension is for Win32 apps, not Store apps.

Answer

The device must be joined to an on-premises Active Directory domain

Answer

The device must have the Microsoft Intune Management Extension installed

Answer

The device must have sideloading enabled

Question 3

You are troubleshooting an Intune deployment of a line-of-business (LOB) app for iOS. The app fails to install on some devices with error '0x87D13B9F'. Which THREE actions should you take to diagnose the issue?

Accepted Answer

Check if the device is supervised and that the app requires supervised mode. Options A, B, and E are correct. Verify the app is signed with a valid Apple Developer Enterprise certificate; expired certificates cause failures. Check that the device is not supervised if required; some LOB apps require supervised mode. Ensure the device has enough storage; error can be storage-related. Option C is wrong because Intune Service Health is not specific to app deployment. Option D is wrong because app configuration policies are optional.

Answer

Check the Intune Service Health dashboard for service incidents

Answer

Ensure that an app configuration policy is assigned to the device

Question 4

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. Which TWO configurations are required?

Accepted Answer

The device must be enrolled using Android Enterprise work profile. Options A and C are correct. The device must be enrolled in Android Enterprise work profile. The app must be approved in the managed Google Play store. Option B is wrong because the device does not need to be personally owned; it can be corporate-owned with work profile. Option D is wrong because a Google account is not required for managed Play store. Option E is wrong because the app does not need to be in a kiosk mode.

Answer

The user must have a Google account

Answer

The device must be personally owned

Answer

The app must be configured as a kiosk app

Question 5

Refer to the exhibit. You are reviewing an Intune app protection policy (APP) JSON for Windows. A user complains that they cannot copy data from a managed app. Which setting is causing this?

Accepted Answer

cutCopyAllowed and pasteAllowed are set to false. Option C is correct. The 'cutCopyAllowed' and 'pasteAllowed' settings are both set to false, preventing copy/paste from managed apps. Option A is wrong because 'orgRestriction' controls data transfer to other apps, not copy/paste. Option B is wrong because encryptAppData is about encryption, not copy/paste. Option D is wrong because pin requirement does not affect copy/paste.

Answer

encryptAppData is set to true

Answer

orgRestriction is set to true

Answer

requirePin is set to true

Question 6

Refer to the exhibit. You are deploying Microsoft 365 Apps via Intune Win32 app packaging. The detection rule checks for the registry key existence. After installation, Intune reports the app as not detected. What is the most likely reason?

Accepted Answer

The detection runs in 32-bit context and does not see the 64-bit registry key. Option C is correct. The registry path uses 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot' but on a 64-bit system, a 32-bit app (like the detection agent) may be redirected to WOW6432Node. The check32BitOn64System is false, so it does not check the WOW6432Node path. Option A is wrong because the path is correct on 64-bit systems for 64-bit Office. Option B is wrong because Office does install that key. Option D is wrong because the detection type 'exists' is correct.

Answer

The detection type 'exists' is not supported for registry detection

Answer

The registry key path is incorrect for a 64-bit system

Answer

The app did not create the registry key during installation

Question 7

You need to deploy a custom Microsoft Edge extension to managed Windows 10 devices via Intune. Which policy type should you use?

Accepted Answer

Administrative Templates profile (ADMX-backed policies). Option A is correct. An Administrative Templates profile can configure Edge policies including extension installation. Option B is wrong because a device restrictions profile does not manage extensions. Option C is wrong because a compliance policy is not for configuration. Option D is wrong because a PowerShell script is not the recommended method for extension deployment.

Answer

Device restrictions profile

Answer

Compliance policy

Answer

PowerShell script deployment

Question 8

Your organization has 500 Windows 11 devices managed by Microsoft Intune. You need to deploy a third-party Win32 application (AppDeploy.exe) that requires the user to accept an end-user license agreement (EULA) during installation. The app must be installed silently without user interaction. You have created a custom script that accepts the EULA automatically. The app is packaged as an .intunewin file. You need to configure the deployment in Intune.

The installation command must run the script that accepts the EULA and then launches the installer. The detection rule must check for the presence of a specific file (C:\Program Files\AppDeploy\app.exe). You want to ensure that if the installation fails, Intune retries automatically.

Which of the following configurations should you choose?

Accepted Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1 && AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: 3 attempts every 60 minutes. Option B is correct. Using a PowerShell script as the install command allows you to chain commands: first accept EULA, then run setup. The detection rule uses file existence. Setting 'Retry count' to 3 and 'Retry interval' to 60 minutes provides automatic retry. Option A is wrong because it does not include the EULA acceptance. Option C is wrong because the detection rule checks registry instead of file, which may not be reliable. Option D is wrong because it does not include retry settings.

Answer

Install command: 'AppDeploy.exe /S', Detection rule: Registry 'HKLM\Software\AppDeploy\Installed' exists, Retry: 3 attempts every 60 minutes

Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Answer

Install command: 'AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Question 9

You are the Intune administrator for a company that uses Microsoft Entra ID (Azure AD) for identity. You have a line-of-business (LOB) iOS app that is distributed via Intune using volume purchase program (VPP) tokens. The app requires a configuration policy to set the server URL. You have assigned the app as 'Required' to all users in the 'Sales' group. Some users report that the app does not show the configured server URL.

You verify that the app configuration policy is assigned to the same 'Sales' group. The app installs successfully. You check the Intune console and see that the app configuration policy has a status of 'Pending' for some devices. The devices are company-owned iPhones running iOS 16.

What is the most likely cause of the configuration not applying?

Accepted Answer

The devices are not supervised. Option D is correct. For VPP apps, app configuration policies must be assigned to the same group as the app assignment. Additionally, the configuration policy must be targeted to devices, not users, for iOS. However, the status 'Pending' suggests the policy is not yet applied; the likely cause is that the devices are not supervised. App configuration policies for iOS require supervised devices when using VPP. Option A is wrong because the app is required and installs successfully. Option B is wrong because the policy is assigned, but status is pending. Option C is wrong because iOS version is compatible.

Answer

The iOS version does not support app configuration

Answer

The app configuration policy is not assigned to the correct group

Answer

The app is not deployed via VPP correctly

Question 10

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) named 'Company Portal' to all devices. The app is already added to Intune. You want to ensure that the app is automatically installed on devices that are not yet enrolled in Intune.

You assign the app to the 'All devices' group with the intent 'Required'. However, you notice that devices that enroll after the assignment do not receive the app automatically.

What should you do to ensure that the app installs on newly enrolled devices?

Accepted Answer

Ensure the 'All devices' group is a dynamic group that includes all devices. Option C is correct. The 'Required' assignment with 'All devices' group will apply to devices that enroll later because the assignment is dynamic. However, if the group includes 'All devices', new devices should get the app. The issue might be that the group is a static device group. The best practice is to use a dynamic device group that includes all devices. Option A is wrong because the assignment is already required. Option B is wrong because 'Available' requires user initiation. Option D is wrong because the app is already added.

Answer

Create a new assignment with 'Available' intent for the 'All devices' group

Answer

Re-add the app to Intune

Answer

Change the assignment intent to 'Available'

Question 11

Your organization uses Intune to manage Windows 10 devices. You have deployed a Win32 app named 'FinanceApp' with a detection rule that checks for the existence of a registry key. After deployment, you find that the app is not being detected on some devices, causing Intune to attempt reinstallation. You suspect the detection rule is incorrect.

You need to update the detection rule for the app without redeploying the entire app. You edit the app properties in Intune and modify the detection rule. However, after saving, the existing assignments still use the old detection rule.

What should you do to apply the updated detection rule to existing devices?

Accepted Answer

Increment the app version in the app properties. Option B is correct. After modifying the detection rule, you must increase the app version number to force Intune to reevaluate the detection on existing devices. Option A is wrong because deleting and recreating the app is unnecessary. Option C is wrong because the app is already assigned. Option D is wrong because there is no need to uninstall and reinstall.

Answer

Remove and re-add the assignment

Answer

Delete the app and recreate it with the new detection rule

Answer

Uninstall the app from all devices and redeploy

Question 12

Contoso Ltd. uses Microsoft Intune to manage Windows 11 devices. They need to deploy a Line-of-Business (LOB) app (ContosoApp.msi) to 500 devices in a pilot group. The app requires admin privileges and must be installed in the system context. The deployment must be silent with no user interaction, and the installation status must be reported to Intune. They have created a Win32 app wrapper and uploaded the .intunewin file. Which configuration should they choose in the Intune Win32 app properties to meet the requirements?

Accepted Answer

Install behavior: System, Device restart behavior: No specific action. Option D is correct because setting Install behavior to System and Device restart behavior to No specific action allows the app to install silently with admin privileges and no user interaction. Option A is wrong because User install context does not provide system-level privileges. Option B is wrong because Suppress restarts only suppresses restart prompts but does not prevent restarts caused by the installer; No specific action is safer. Option C is wrong because using User install context with app requiring admin rights will fail.

Answer

Install behavior: User, Device restart behavior: No specific action

Answer

Install behavior: System, Device restart behavior: Suppress restarts

Answer

Install behavior: User, Device restart behavior: Block restarts until installation completes

Question 13

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom vertical market app that is not available in the Apple App Store. The app is distributed as an .ipa file signed with an enterprise certificate. You have uploaded the .ipa file to Intune. However, when you assign the app to a user group, the installation fails on devices with the error 'Unable to download app'. The devices are enrolled as user-affinity devices with Device Enrollment Program (DEP). You have verified that the enterprise certificate is trusted on the devices. What is the most likely cause of the failure?

Accepted Answer

The devices are not in Supervised mode.. Option B is correct because enterprise-signed apps require the device to be in Supervised mode for silent installation without user prompts. Without supervision, the user must manually trust the certificate or the app may fail. Option A is wrong because VPN configuration is not required for app download. Option C is wrong because VPP is for store apps, not enterprise-signed. Option D is wrong because the icon file is not critical for installation.

Answer

The app package does not include an icon file.

Answer

The devices do not have a VPN configuration profile installed.

Answer

The app is not purchased through the Volume Purchase Program (VPP).

Question 14

Your company uses Microsoft Intune to manage Windows 10 and 11 devices. You have been asked to deploy a Microsoft 365 Apps for enterprise (formerly Office 365 ProPlus) configuration that includes Word, Excel, PowerPoint, and Outlook. The deployment must be assigned to a group of 200 devices that are not connected to the internet during initial setup; they will get updates from a local Distribution Point (DP) on the network. You have created a Win32 app using the Office Deployment Tool (ODT) with a configuration XML that specifies the products and updates source. Which additional step is necessary to ensure the installation succeeds without internet?

Accepted Answer

Include the SourcePath attribute in the configuration XML pointing to the local DP.. Option A is correct because the ODT configuration XML must include the SourcePath attribute pointing to the local DP for installation files. Option B is wrong because the local DP already hosts the files; no additional download required. Option C is wrong because network discovery is not needed if the path is specified. Option D is wrong because the channel is specified in the XML, not in Intune app properties.

Answer

Enable the 'Allow devices to discover network content' setting in Intune.

Answer

Download the Office installation files to each device before deployment.

Answer

Set the Office channel to 'Current' in the Intune app properties.

Question 15

Your organization manages Android Enterprise personally-owned work profile devices with Microsoft Intune. You need to deploy a managed Google Play app to these devices. The app is already approved in managed Google Play and added to Intune. When you assign the app as 'Required' to a user group, some users report that the app is not installed on their devices, and they do not see it in the work profile. You verify that the devices are enrolled and checked in with Intune. The app is listed as 'Pending' in the Intune console for those devices. What is the most likely cause?

Accepted Answer

The managed Google Play Store app is disabled on the devices.. Option D is correct because in a work profile, the managed Google Play Store app must be present and active; if it is disabled, apps cannot be installed. Option A is wrong because the app is already approved. Option B is wrong because VPN is not required. Option C is wrong because there is no app protection policy requirement for installation.

Answer

The app is not approved in managed Google Play for the organization.

Answer

The devices do not have a VPN profile configured.

Answer

The users do not have an app protection policy assigned.