MD-102 Manage applications Practice Test 14 — 15 Questions

Question 1

You are deploying a Win32 app that requires .NET Framework 4.8. You create a dependency in Intune for the .NET Framework app. However, some devices fail to install the parent app even though .NET Framework is present. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The dependency detection rule does not match the actual .NET installation.. Intune uses detection rules to verify whether a dependency is installed. If the detection rule for the .NET Framework dependency does not match the actual installation state (e.g., it checks for a registry key or file version that differs from what .NET 4.8 actually creates), Intune will incorrectly report the dependency as missing, blocking the parent app installation even though .NET is present.

Answer

The dependency version is set to 'Greater than' instead of 'Greater than or equal to'.

Answer

The parent app is set to install before the dependency.

Answer

The dependency is set to 'Do not install automatically'.

Question 2

Which TWO of the following are valid app types in Microsoft Intune for iOS/iPadOS devices?

Accepted Answer

iOS line-of-business app. In Microsoft Intune, the iOS/iPadOS app types include 'iOS line-of-business app' (B), which lets you upload and deploy an in-house .ipa package signed with your enterprise provisioning profile, and 'iOS store app' (E), which deploys apps by searching and selecting them from the Apple App Store. Both are legitimate iOS/iPadOS app categories available when adding an app in the Intune console. By contrast, 'Windows 10 Universal app' (A) targets Windows 10/11 devices, 'Android Enterprise system app' (C) targets Android Enterprise devices, and 'Managed Google Play iframe' (D) is an Android app type used to browse and approve Managed Google Play apps, so none of these apply to iOS/iPadOS.

Answer

Windows 10 Universal app

Answer

Android Enterprise system app

Answer

Managed Google Play iframe

Question 3

Which THREE of the following are required to deploy a Win32 app using Microsoft Intune?

Accepted Answer

Detection rule. To deploy a Win32 app in Microsoft Intune, a detection rule (B) is mandatory because Intune must determine whether the app is already installed on the device, using methods such as MSI product code, file/folder existence, or a custom script. Return codes for success (C) are also required so Intune can interpret the exit code returned by the installer and correctly report the installation as succeeded, failed, or requiring a restart (e.g., 0 for success, 3010 for soft reboot). The installation command (E) is essential because Intune needs the exact command line (for example, msiexec /i "app.msi" /qn or setup.exe /silent) to actually install the Win32 app on the target device. Product code (A) is not universally required, since it is only one possible detection method and can be replaced by file, folder, or script-based detection. Dependencies (D) are optional, as they are only needed when the app requires other apps to be installed first, and are not mandatory for every Win32 app deployment.

Answer

Product code

Answer

Dependencies

Question 4

A user reports that a Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune management extension logs show error code 0x80070005. The device is Azure AD joined and compliant. What is the most likely cause?

Accepted Answer

The user does not have local administrator privileges on the device. Error code 0x80070005 translates to 'Access Denied' (E_ACCESSDENIED). Microsoft 365 Apps for enterprise installation requires local administrator privileges to write to protected system paths (e.g., Program Files, registry). Since the device is Microsoft Entra ID joined and compliant, the most likely cause is that the user lacks local admin rights, which is a common Intune deployment prerequisite.

Answer

The device has insufficient disk space

Answer

The device does not have internet connectivity to the Microsoft CDN

Answer

The device is not compliant with the conditional access policy

Question 5

You are configuring a Windows 10 kiosk device using Intune. The device should run a single-store app in full-screen mode. Which Intune policy type should you use?

Accepted Answer

A device configuration profile using the 'Kiosk' settings for single-app mode. A is correct because Intune's device configuration profile includes a 'Kiosk' settings category specifically designed for Windows 10/11 devices. When you select 'Single-app mode' under kiosk settings, you can specify a single Store app (e.g., a UWP or Win32 app) that will run in full-screen, locked-down mode, preventing users from accessing any other system functions or apps.

Answer

A device restrictions profile blocking access to other apps

Answer

A compliance policy requiring the app to be installed

Answer

A configuration profile for Microsoft Edge in kiosk mode

Question 6

Your organization uses Intune to manage iOS/iPadOS devices. You need to deploy a custom SSL certificate to all devices for accessing an internal web app. Which profile type should you use?

Accepted Answer

Trusted certificate profile. A Trusted certificate profile is used to deploy a root or intermediate CA certificate that the device must trust for certificate-based authentication, such as accessing an internal web app over HTTPS. This profile type simply installs the certificate into the device's trusted root store without generating a private key, which is exactly what is needed when you only need to establish trust for the server certificate presented by the web app.

Answer

PKCS certificate profile

Answer

SCEP certificate profile

Answer

Custom configuration profile (preferences)

Question 7

You deploy a Win32 app via Intune to Windows 10 devices. The app installs successfully, but the detection rule incorrectly reports the app as not installed, causing Intune to attempt reinstallation repeatedly. Which detection rule method is most likely causing this issue?

Accepted Answer

MSI product code detection uses a product code that does not match the installed app. When an MSI product code detection rule uses a product code that does not match the GUID of the installed application, Intune will always evaluate the app as 'not installed' regardless of the actual installation state. This mismatch causes Intune to repeatedly attempt reinstallation on every check-in cycle, as the detection logic never finds a matching product code in the Windows Installer database.

Answer

File existence detection checks for a file that is installed by the app

Answer

Registry detection checks for a registry key that is created by the app

Answer

Custom script detection returns exit code 0 even if app is not present

Question 8

Your organization uses Microsoft Intune to manage Android Enterprise devices. You need to deploy a managed Google Play app to work profile devices. Which TWO configurations are required?

Accepted Answer

The device must be enrolled using Android Enterprise work profile. Option C is correct because deploying a managed Google Play app to work profile devices requires the device to be enrolled with the Android Enterprise work profile enrollment type, which creates the separate work profile container where managed apps are installed. Option D is correct because managed Google Play apps must first be approved (and optionally configured) in the managed Google Play store within Intune before they can be assigned and deployed to devices. Option A is not required because the work profile enrollment handles the Google account binding through the managed Google Play connection, and end users do not need a separate personal Google account for app deployment. Option B is not required because work profile enrollment supports both personally owned and corporate-owned devices. Option E is not required because kiosk mode is a separate dedicated-device configuration and is not needed to deploy a standard managed Google Play app.

Answer

The user must have a Google account

Answer

The device must be personally owned

Answer

The app must be configured as a kiosk app

Question 9

You are the Endpoint Administrator for a company that uses Microsoft Intune to manage Windows 11 devices. The security team requires that Microsoft Edge be configured with a specific set of security settings, including blocking outdated plugins and enforcing SmartScreen. You need to deploy these settings to all Windows 11 devices with minimal administrative effort. What should you do?

Accepted Answer

Create a device configuration profile with the 'Administrative Templates' profile type and configure the Microsoft Edge settings.. Administrative Templates in Intune provide a streamlined way to configure Microsoft Edge policies using the same ADMX-backed settings that Group Policy uses. They are built into Intune, require no custom scripting, and can be assigned to device groups. This meets the requirement to deploy security settings with minimal administrative effort.

Answer

Deploy a PowerShell script that modifies the registry to set the required Edge policies.

Answer

Create a custom configuration profile using the Open Mobile Alliance Uniform Resource Identifier (OMA-URI) settings.

Answer

Use the Microsoft 365 Apps for enterprise deployment to include Edge settings in the Office Configuration Service.

Question 10

You manage a set of Windows 10 devices with Microsoft Intune. You need to deploy a Win32 app that requires a specific registry key to exist before installation. The app installer does not check for this key. You must ensure the app installs only on devices that have the registry key. What should you do?

Accepted Answer

Add a requirement rule to the Win32 app that checks for the registry key.. Requirement rules in Intune are evaluated before app installation. By adding a rule that checks for the presence of a specific registry key, you ensure the app is only installed on devices that already have that key. This enforces the prerequisite automatically and reliably.

Answer

Use a PowerShell script in the app package to create the registry key before installation.

Answer

Deploy the app as available and instruct users to verify the registry key before installing.

Answer

Create a detection rule that checks for the registry key.

Question 11

You manage Windows 10 devices with Microsoft Intune. You deploy a Win32 app that must run a custom installation script. The script requires a specific environment variable to be set during installation. The app installer does not set this variable. You need to ensure the variable is set only for the installation process and not permanently on the device. What should you do?

Accepted Answer

Include the environment variable in the install command using the 'cmd /c set VAR=value && installer.exe' syntax.. Using the 'set' command within the install command line sets the environment variable only for that command's process. The variable is not written to the registry or user profile, so it does not persist after the installation completes. This satisfies the requirement of a temporary variable.

Answer

Create a PowerShell script that sets the environment variable at the machine level, then run the installer.

Answer

Use a requirement rule to set the environment variable before installation.

Answer

Configure the app to run in user context and set the variable in the user's profile.

Question 12

You are the endpoint administrator for a company that uses Microsoft Intune. The company has a line-of-business iOS app that is not available in the App Store. You need to deploy this app to a group of iOS users. The app must be installed automatically without user interaction. What should you do first?

Accepted Answer

Upload the app package (.ipa file) to Intune as a line-of-business app.. To deploy a custom iOS app, you must first upload the app package (.ipa file) to Intune as a line-of-business app. This makes the app available for assignment. After uploading, you can assign it to groups and set the installation intent to required for automatic installation. The other options do not provide a deployment method for custom apps.

Answer

Add the app to Microsoft Store for Business and sync it with Intune.

Answer

Configure a device configuration profile to install the app.

Answer

Create an app protection policy for the app.

Question 13

A company uses Microsoft Intune to manage Windows 10 devices. You need to deploy Microsoft 365 Apps to all Windows devices. The deployment must use the Microsoft 365 Apps wizard in Intune. What should you do?

Accepted Answer

Create a new app of type 'Microsoft 365 Apps' and configure the required settings.. In Intune, you can deploy Microsoft 365 Apps by creating an app of type 'Microsoft 365 Apps'. This opens a wizard where you configure settings such as update channel, architecture, and which Office apps to install. This is the dedicated method for deploying Microsoft 365 Apps and is simpler than using the Office Deployment Tool.

Answer

Upload the Office Deployment Tool (ODT) and create a Win32 app.

Answer

Deploy the Microsoft Store version of Office as a required app.

Answer

Create a PowerShell script that downloads and installs Office, and assign it to devices.

Question 14

You manage Windows devices with Microsoft Intune. A line-of-business MSI installer must be deployed to 400 devices. The installer requires a custom transform (.mst) file and must run with administrative privileges. You need to deploy the app using the least administrative effort while ensuring the transform is applied. What should you do?

Accepted Answer

Package the MSI and .mst into a Win32 app (.intunewin) and deploy it as required.. Win32 apps in Intune support the inclusion of additional files and custom installation commands, which is necessary to apply an MSI transform. By packaging the MSI and .mst together and specifying the correct command line, the transform is applied during installation. This ensures the customizations are correctly deployed to all targeted devices.

Answer

Convert the MSI to an .intunewin file and deploy it as a Win32 app without the .mst, then use a separate script to modify the registry.

Answer

Deploy the MSI as a line-of-business app and use a PowerShell script to apply the .mst after installation.

Answer

Upload the MSI as a line-of-business app and specify the .mst file in the app configuration.

Question 15

You manage a fleet of Windows 10 devices with Microsoft Intune. A line-of-business (LOB) app named App1 is deployed as required to a group of users. Users report that App1 installs successfully on some devices but fails on others with error code 0x87D1041C. You need to resolve the installation failures. What should you do?

Accepted Answer

Modify the detection rule to match the actual installation state on the failing devices.. Error 0x87D1041C occurs when the app installation succeeds but the detection rule fails to confirm it. This often happens if the detection rule checks for a file or registry key that is not present on all devices due to variations in installation paths or versions. Correcting the detection rule to match the actual state on the failing devices resolves the error and allows Intune to mark the app as installed.

Answer

Add a dependency to the app to ensure required frameworks are installed first.

Answer

Re-deploy the app with the 'Require a restart' option set to 'No'.

Answer

Change the app assignment from 'Required' to 'Available' for the affected users.