MD-102 Manage applications Practice Test 12 — 15 Questions

Question 1

Your organization uses Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices for accessing an internal web app. Which profile type should you use?

Accepted Answer

Trusted certificate profile. A Trusted certificate profile is used to deploy a root or intermediate CA certificate that the device must trust for certificate-based authentication, such as accessing an internal web app over HTTPS. This profile type simply installs the certificate into the device's trusted root store without generating a private key, which is exactly what is needed when you only need to establish trust for the server certificate presented by the web app.

Answer

PKCS certificate profile

Answer

SCEP certificate profile

Answer

Custom configuration profile (preferences)

Question 2

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully, but the detection rule incorrectly reports the app as not installed, causing Intune to attempt reinstallation repeatedly. Which detection rule method is most likely causing this issue?

Accepted Answer

MSI product code detection uses a product code that does not match the installed app. When an MSI product code detection rule uses a product code that does not match the GUID of the installed application, Intune will always evaluate the app as 'not installed' regardless of the actual installation state. This mismatch causes Intune to repeatedly attempt reinstallation on every check-in cycle, as the detection logic never finds a matching product code in the Windows Installer database.

Answer

File existence detection checks for a file that is installed by the app

Answer

Registry detection checks for a registry key that is created by the app

Answer

Custom script detection returns exit code 0 even if app is not present

Question 3

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) to a group of users. Which TWO requirements must be met?

Accepted Answer

The device must be Azure AD joined or hybrid Azure AD joined. Microsoft Store apps (new) require the device to be Azure AD joined or hybrid Azure AD joined to support license enforcement and user-based app assignment via Intune. This ensures the device can authenticate with the Microsoft Store for Business and Education to download and install the app under the user's identity.

Answer

The device must be joined to an on-premises Active Directory domain

Answer

The device must have the Microsoft Intune Management Extension installed

Answer

The device must have sideloading enabled

Question 4

You are troubleshooting an Intune deployment of a line-of-business (LOB) app for iOS. The app fails to install on some devices with error '0x87D13B9F'. Which THREE actions should you take to diagnose the issue?

Accepted Answer

Check if the device is supervised and that the app requires supervised mode. Error 0x87D13B9F in Intune for iOS LOB apps typically indicates a deployment restriction related to device supervision. If the app requires supervised mode (e.g., for managed app configuration or advanced MDM controls) and the target device is not supervised, Intune will fail to install the app with this error. Verifying supervision status is a primary diagnostic step.

Answer

Check the Intune Service Health dashboard for service incidents

Answer

Ensure that an app configuration policy is assigned to the device

Question 5

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. Which TWO configurations are required?

Accepted Answer

The device must be enrolled using Android Enterprise work profile. Android Enterprise work profile enrollment is the specific enrollment mode that creates a separate, managed profile on the device, isolating work apps and data from personal apps. This is the only Android Enterprise enrollment type that supports managed Google Play app deployment to work profile devices, as it binds the device to the managed Google Play store without requiring a personal Google account on the device.

Answer

The user must have a Google account

Answer

The device must be personally owned

Answer

The app must be configured as a kiosk app

Question 6

Refer to the exhibit. You are reviewing an Intune app protection policy (APP) JSON for Windows. A user complains that they cannot copy data from a managed app. Which setting is causing this?

Accepted Answer

cutCopyAllowed and pasteAllowed are set to false. The `cutCopyAllowed` and `pasteAllowed` settings directly control the ability to transfer data out of managed apps. When both are set to `false`, the Intune App Protection Policy (APP) for Windows explicitly blocks cut, copy, and paste operations from the managed app, which matches the user's complaint. Other settings like encryption, organizational restrictions, or PIN requirements do not prevent clipboard operations.

Answer

encryptAppData is set to true

Answer

orgRestriction is set to true

Answer

requirePin is set to true

Question 7

Refer to the exhibit. You are deploying Microsoft 365 Apps via Intune Win32 app packaging. The detection rule checks for the registry key existence. After installation, Intune reports the app as not detected. What is the most likely reason?

Accepted Answer

The detection runs in 32-bit context and does not see the 64-bit registry key. Intune Win32 app detection rules run in a 32-bit context by default on 64-bit systems. This means the detection script or rule checks the 32-bit registry view (Wow6432Node) rather than the 64-bit registry view. If the app created the registry key in the 64-bit path (e.g., HKLM\Software\Microsoft\Office), the 32-bit detection will not see it, causing a false 'not detected' state.

Answer

The detection type 'exists' is not supported for registry detection

Answer

The registry key path is incorrect for a 64-bit system

Answer

The app did not create the registry key during installation

Question 8

You need to deploy a custom Microsoft Edge extension to managed Windows 10 devices via Intune. Which policy type should you use?

Accepted Answer

Administrative Templates profile (ADMX-backed policies). Deploying a custom Microsoft Edge extension via Intune requires configuring the 'Install Extensions Silently' policy, which is an ADMX-backed policy available through the Administrative Templates profile. This policy type allows you to manage Edge-specific settings using the built-in ADMX files that Intune imports from the Edge administrative templates, enabling silent installation of extensions by specifying their update URL or extension ID.

Answer

Device restrictions profile

Answer

Compliance policy

Answer

PowerShell script deployment

Question 9

Your organization has 500 Windows 11 devices managed by Microsoft Intune. You need to deploy a third-party Win32 application (AppDeploy.exe) that requires the user to accept an end-user license agreement (EULA) during installation. The app must be installed silently without user interaction. You have created a custom script that accepts the EULA automatically. The app is packaged as an .intunewin file. You need to configure the deployment in Intune.

The installation command must run the script that accepts the EULA and then launches the installer. The detection rule must check for the presence of a specific file (C:\Program Files\AppDeploy\app.exe). You want to ensure that if the installation fails, Intune retries automatically.

Which of the following configurations should you choose?

Accepted Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1 && AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: 3 attempts every 60 minutes. The install command uses a PowerShell script to first accept the EULA (AcceptEULA.ps1), then runs the installer silently with AppDeploy.exe /S. The detection rule checks for the file at C:\Program Files\AppDeploy\app.exe, which verifies installation. The retry settings (3 attempts every 60 minutes) ensure automatic retry on failure. Option B is wrong because it does not include the EULA acceptance. Option C is wrong because it only runs the script without launching the installer, so the app never installs. Option D is wrong because it has no retry settings.

Answer

Install command: 'AppDeploy.exe /S', Detection rule: Registry 'HKLM\Software\AppDeploy\Installed' exists, Retry: 3 attempts every 60 minutes

Answer

Install command: 'powershell.exe -ExecutionPolicy Bypass -File AcceptEULA.ps1', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Answer

Install command: 'AppDeploy.exe /S', Detection rule: File 'C:\Program Files\AppDeploy\app.exe' exists, Retry: None

Question 10

You are the Intune administrator for a company that uses Microsoft Entra ID (Azure AD) for identity. You have a line-of-business (LOB) iOS app that is distributed via Intune using volume purchase program (VPP) tokens. The app requires a configuration policy to set the server URL. You have assigned the app as 'Required' to all users in the 'Sales' group. Some users report that the app does not show the configured server URL.

You verify that the app configuration policy is assigned to the same 'Sales' group. The app installs successfully. You check the Intune console and see that the app configuration policy has a status of 'Pending' for some devices. The devices are company-owned iPhones running iOS 16.

What is the most likely cause of the configuration not applying?

Accepted Answer

The devices are not supervised. App configuration policies for iOS devices require the device to be supervised, especially when using VPP tokens. The 'Pending' status indicates the policy has not been applied because the devices are not supervised. Option A is wrong because the app installs successfully, indicating iOS version compatibility. Option B is wrong because the policy is assigned to the same group, but supervision is still required. Option D is wrong because the app is deployed via VPP correctly; the issue is with configuration policy enforcement, not VPP deployment.

Answer

The iOS version does not support app configuration

Answer

The app configuration policy is not assigned to the correct group

Answer

The app is not deployed via VPP correctly

Question 11

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) named 'Company Portal' to all devices. The app is already added to Intune. You assign the app to a static device group that includes all current devices with the intent 'Required'. However, you notice that devices that enroll after the assignment do not receive the app automatically.

What should you do to ensure that the app installs on newly enrolled devices?

Accepted Answer

Ensure the device group is a dynamic group that includes all devices (e.g., use the built-in 'All devices' group). Static groups in Intune do not automatically include devices that are enrolled after the group is created. To ensure the app installs on newly enrolled devices, the device group must be dynamic. Dynamic groups automatically include devices based on rules, such as all devices. The built-in 'All devices' group is dynamic, but if you are using a custom static group, you should change it to a dynamic group or assign the app to a dynamic group like 'All devices'.

Answer

Create a new assignment with 'Available' intent for the 'All devices' group

Answer

Re-add the app to Intune

Answer

Change the assignment intent to 'Available'

Question 12

Your organization uses Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices for accessing an internal web app. Which profile type should you use?

Choose an answer to begin — your selection is scored in the full session.

You need to update the detection rule for the app without redeploying the entire app. You edit the app properties in Intune and modify the detection rule. However, after saving, the existing assignments still use the old detection rule.

What should you do to apply the updated detection rule to existing devices?

Accepted Answer

Increment the app version in the app properties. After modifying the detection rule, you must increment the app version number in the app properties. This forces the Intune management extension on existing devices to re-evaluate the detection rule and apply the updated logic. Options B, C, and D are unnecessary and overly disruptive.

Answer

Remove and re-add the assignment

Answer

Delete the app and recreate it with the new detection rule

Answer

Uninstall the app from all devices and redeploy

Question 13

Contoso Ltd. uses Microsoft Intune to manage Windows 11 devices. They need to deploy a Line-of-Business (LOB) app (ContosoApp.msi) to 500 devices in a pilot group. The app requires admin privileges and must be installed in the system context. The deployment must be silent with no user interaction, and the installation status must be reported to Intune. They have created a Win32 app wrapper and uploaded the .intunewin file. Which configuration should they choose in the Intune Win32 app properties to meet the requirements?

Accepted Answer

Install behavior: System, Device restart behavior: No specific action. Setting Install behavior to System ensures the app runs with admin privileges and installs in the system context, while Device restart behavior set to No specific action allows any necessary restarts to occur without blocking installation. This meets the requirements of silent deployment with no user interaction and status reporting to Intune. Option A is incorrect because User install behavior does not provide system-level privileges. Option C is incorrect because Suppress restarts may prevent necessary restarts, potentially causing the installation to fail or not complete properly. Option D is incorrect because User install context with the app requiring admin rights will fail to install correctly.

Answer

Install behavior: User, Device restart behavior: No specific action

Answer

Install behavior: System, Device restart behavior: Suppress restarts

Answer

Install behavior: User, Device restart behavior: Block restarts until installation completes

Question 14

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a custom vertical market app that is not available in the Apple App Store. The app is distributed as an .ipa file signed with an enterprise certificate. You have uploaded the .ipa file to Intune. However, when you assign the app to a user group, the installation fails on devices with the error 'Unable to download app'. The devices are enrolled as user-affinity devices with Device Enrollment Program (DEP). You have verified that the enterprise certificate is trusted on the devices. What is the most likely cause of the failure?

Accepted Answer

The devices are not in Supervised mode.. Enterprise-signed apps require the device to be in Supervised mode for silent installation without user prompts. Without supervision, the user must manually trust the enterprise certificate or the installation may fail. Option A is incorrect because the icon file is not critical for installation. Option B is incorrect because a VPN configuration profile is not required for downloading enterprise apps. Option C is incorrect because VPP is for store apps, not enterprise-signed line-of-business apps.

Answer

The app package does not include an icon file.

Answer

The devices do not have a VPN configuration profile installed.

Answer

The app is not purchased through the Volume Purchase Program (VPP).

Question 15

Your organization manages Android Enterprise personally-owned work profile devices with Microsoft Intune. You need to deploy a managed Google Play app to these devices. The app is already approved in managed Google Play and added to Intune. When you assign the app as 'Required' to a user group, some users report that the app is not installed on their devices, and they do not see it in the work profile. You verify that the devices are enrolled and checked in with Intune. The app is listed as 'Pending' in the Intune console for those devices. What is the most likely cause?

Accepted Answer

The managed Google Play Store app is disabled on the devices.. In a work profile, the managed Google Play Store app must be present and active; if it is disabled, apps cannot be installed. Option A is wrong because the app is already approved. Option B is wrong because VPN is not required. Option C is wrong because there is no app protection policy requirement for installation.

Answer

The app is not approved in managed Google Play for the organization.

Answer

The devices do not have a VPN profile configured.

Answer

The users do not have an app protection policy assigned.