MD-102 Manage applications Practice Test 2 — 15 Questions

Question 1

A company uses Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) Win32 app to devices that are not assigned to any user. The app requires installation in the system context. Which installation behavior should be configured in the Intune Win32 app deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

System. (System) is correct because the Win32 app must run in the system context to install without a user session, which is required for devices not assigned to any user. In Intune, the 'System' installation behavior runs the installer as the local SYSTEM account, enabling silent, elevated installations regardless of user presence.

Answer

User

Answer

Device

Answer

LoggedOnUser

Question 2

A company uses Microsoft Intune to manage Windows 10 devices. They are deploying a Win32 app using the Intune Management Extension. The app requires a reboot and must ensure that the installation completes successfully before the device is allowed to restart. Which TWO deployment settings should be configured?

Accepted Answer

Set 'Device restart behavior' to 'No specific action'. Setting 'Device restart behavior' to 'No specific action' allows Intune to complete the Win32 app installation without forcing an immediate reboot, which is necessary when the app itself handles the reboot or when you want to control the restart timing. This setting prevents the Intune Management Extension from triggering a restart before the installation is fully complete, ensuring the app's post-installation processes (e.g., file copies, registry writes) finish successfully.

Answer

Enable 'Delivery optimization' for the app

Answer

Set 'Device restart behavior' to 'Require device restart'

Answer

Configure 'Supersedence' to replace the app

Question 3

Match each Windows Update for Business deployment service to its capability.

Accepted Answer

Update Rings: Configures deferral periods and deadlines for updates. The correct matches are: Update Rings configures deferral periods and deadlines; Feature Update Policies specify which feature update version is offered; Quality Update Policies control which quality updates are offered. Common confusions arise from mixing the roles of these policies.

Answer

Update Rings: Controls which feature updates are offered to devices

Answer

Feature Update Policies: Configures deferral periods for quality updates

Question 4

You are deploying a new line-of-business (LOB) app to Windows 10 devices managed by Microsoft Intune. The app requires a specific registry key to be set before installation. What is the best approach to ensure the registry key is applied before the app installs?

Accepted Answer

Define a requirement rule in the Win32 app that checks for the registry key; if missing, use a proactive remediation script to create it.. Win32 app deployment in Intune supports requirement rules that can check for prerequisites like registry keys. When the requirement is not met, you can pair the app with a proactive remediation script that creates the missing registry key before the app installation runs, ensuring the dependency is satisfied without manual intervention.

Answer

Create a compliance policy that requires the registry key and mark the app as required.

Answer

Use a device configuration policy to set the registry key, then assign the app as available.

Answer

Include a PowerShell script in the app's installation command that sets the registry key before the main installer runs.

Question 5

You are troubleshooting a Microsoft 365 Apps for enterprise deployment on Windows 10 devices managed by Intune. Users report that the apps are not installing, but the deployment status in Intune shows 'Success' for some devices and 'Failed' for others. On a failing device, you discover that the Office Deployment Tool (ODT) logs indicate '0x80070005 - Access denied'. What is the most likely cause?

Accepted Answer

The Office Deployment Tool is running in user context instead of system context.. The error code 0x80070005 (Access denied) in Office Deployment Tool (ODT) logs indicates a permissions issue. When Intune deploys Microsoft 365 Apps, it runs the ODT in the system context via the Intune Management Extension. If the ODT is inadvertently executed in the user context (e.g., due to a misconfigured detection script or deployment script that doesn't elevate), it lacks the necessary privileges to write to the Program Files directory or modify system registry keys, causing the access denied error.

Answer

The device has insufficient disk space for the installation.

Answer

The configuration.xml file has an invalid Channel attribute.

Answer

The device does not have internet connectivity to download Office installation files.

Question 6

You are using Microsoft Intune to deploy a custom Windows app that is packaged as an .msi. The app requires a reboot after installation. You want to minimize user disruption. What is the best deployment strategy?

Accepted Answer

Assign the app as available to a device group.. Assigning the app as available to a device group allows users to install the app on demand from the Company Portal, but only when they choose to, minimizing disruption. Since the app requires a reboot, making it available (rather than required) lets users schedule the installation and reboot at a convenient time. This approach balances deployment needs with user autonomy, avoiding forced reboots that would interrupt work.

Answer

Assign the app as available to a user group.

Answer

Assign the app as required to a device group.

Answer

Assign the app as required with a deadline.

Question 7

You need to deploy a Microsoft 365 Apps for enterprise configuration that includes Teams and Visio Pro for Microsoft 365. Users should get the full suite with both apps. What is the recommended method?

Accepted Answer

Create a Win32 app with the Office Deployment Tool and a configuration.xml that includes both products.. The Office Deployment Tool (ODT) is the recommended method for deploying customized Microsoft 365 Apps configurations, including Teams and Visio Pro for Microsoft 365, in enterprise environments. By creating a Win32 app with a configuration.xml that specifies both products, you can control installation settings, language, and update channels, which is not possible with the built-in Intune app type for Microsoft 365 Apps.

Answer

Use the built-in Microsoft 365 Apps for enterprise app type in Intune and select the products.

Answer

Instruct users to install from the Office portal.

Answer

Deploy a PowerShell script that runs Setup.exe /configure.

Question 8

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app that is signed by a developer certificate that is not yet trusted on the devices. What must you do to allow the installation?

Accepted Answer

Use a device configuration policy to trust the developer certificate before deploying the app.. MacOS requires that the developer certificate of a .pkg app be trusted at the system level before installation can proceed. By deploying a device configuration policy in Intune that adds the developer certificate to the trusted root store, you establish the necessary trust chain, allowing the .pkg to install without user intervention. This approach aligns with macOS Gatekeeper and security policies, which block unsigned or untrusted packages by default.

Answer

Deploy the app as a line-of-business app with the 'Allow user to bypass' option enabled.

Answer

Instruct users to manually approve the installation in System Preferences.

Answer

Convert the .pkg to a .dmg and deploy via Microsoft Store for Business.

Question 9

You are deploying a Win32 app via Intune that requires .NET Framework 4.8 as a dependency. Which THREE steps must you perform to ensure the dependency is installed before the app?

Accepted Answer

In the main app's properties, add a dependency and select the .NET Framework app.. To make Intune install .NET Framework 4.8 before the Win32 app, you must first add .NET Framework 4.8 as its own separate app in Intune (D), because dependencies can only reference another app object in the tenant. Then, in the main app's properties, you add a dependency and select that .NET Framework app (B), which creates the parent-child relationship Intune uses to order installation. Finally, you set the dependency to 'Auto-install' (C) so Intune installs the .NET Framework app automatically before the main app without requiring user or admin action. Option A is incorrect because a detection rule only determines whether the main app is already installed; it does not install or order a dependency. Option E is incorrect because supersedence replaces an older app with a newer one and does not control pre-install ordering the way a dependency does.

Answer

Configure a detection rule for .NET Framework in the main app.

Answer

Create a supersedence relationship where the .NET Framework app supersedes the main app.

Question 10

You are configuring a Microsoft Intune app configuration policy for a managed iOS app. Which THREE types of settings can you include in the policy?

Accepted Answer

Permissions such as location or camera. In an Intune app configuration policy for a managed iOS app, you can include permissions such as location or camera access (A), because iOS app configuration policies support declaring app permission settings that the managed app honors on first run. You can also include configuration settings as key-value pairs (B), which is the core mechanism of app configuration policies—each key and value is passed to the app through the managed app configuration channel (for iOS, via the NSUserDefaults/AppConfig dictionary). A connection string for a backend service (E) is likewise valid because it is simply a key-value pair (for example, a key like ServerUrl or ConnectionString with the corresponding value) delivered to the app. Compliance rules for the app (C) are not part of app configuration policies; app compliance is handled through device compliance policies and app protection (MAM) conditional launch settings. Network requirements like VPN (D) are not app configuration settings either; VPN is configured through VPN profiles (or per-app VPN) in Intune, not through an app configuration policy.

Answer

Compliance rules for the app

Answer

Network requirements like VPN

Question 11

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. What should you do to ensure the app installs successfully?

Accepted Answer

Enable the Sideloading policy for the device group.. Enabling the Sideloading policy for the device group allows installation of line-of-business (LOB) apps signed with a certificate not trusted by the devices. In Microsoft Intune, sideloading bypasses the requirement for the app's signing certificate to be trusted by the device's trusted root store, enabling successful installation of internally developed or signed LOB apps on Windows 11 devices managed via Intune.

Answer

Create a device configuration profile to allow sideloading.

Answer

Add the app to the Microsoft Store for Business.

Answer

Disable automatic app updates for the device group.

Question 12

You manage iOS devices with Microsoft Intune. A user reports that a required app is missing from their device. You verify the app is assigned as 'Required' to a user group containing the user, and the device is compliant. What is the most likely reason the app is not installing?

Accepted Answer

The app is configured to require user enrollment, but the device uses device enrollment.. When an iOS app is configured with a 'Require user enrollment' assignment filter, it will only install on devices that use User Enrollment (which creates a per-user management identity). If the device uses Device Enrollment (e.g., via Apple Business Manager or manual device enrollment), the app will not install even if assigned as 'Required' to a user group. This is a common configuration mismatch that prevents app delivery.

Answer

The app is set to 'Available for enrolled devices' instead of 'Required'.

Answer

The device is not enrolled using Apple Device Enrollment Program (DEP).

Answer

The Apple Volume Purchase Program (VPP) token has expired.

Question 13

You are troubleshooting an Android Enterprise device that fails to install a required app from the Managed Google Play store. The device is compliant and has a valid work profile. What should you check first?

Accepted Answer

Ensure the Managed Google Play app is enabled and active on the device.. The Managed Google Play app is the client-side component that processes app installation requests on Android Enterprise devices. Even if the device is compliant and has a valid work profile, if the Managed Google Play app is disabled, frozen, or not active, it cannot receive or execute the installation command from the EMM console. This is the first thing to verify because it is a prerequisite for any app deployment via Managed Google Play.

Answer

Check that the device is enrolled in Android Enterprise and has a work profile.

Answer

Confirm the user has approved the app installation in the Managed Google Play store.

Answer

Verify the device compliance policy allows app installation from unknown sources.

Question 14

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom .pkg app that requires specific installation parameters. Which app type should you select?

Accepted Answer

macOS app (PKG). The macOS app (PKG) type is correct for deploying a custom .pkg app that requires specific installation parameters. Intune's native PKG app type allows you to define a custom installation command (e.g., installer -pkg MyApp.pkg -target /) with the required flags, providing full control over the installation. In contrast, the DMG app type is designed for .dmg disk images, not standalone .pkg files.

Answer

Line-of-business app

Answer

macOS app (DMG)

Answer

Windows app (Win32)

Question 15

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved Microsoft Store apps can be installed on company devices. The solution must not require users to be local administrators. What should you configure?

Accepted Answer

Deploy a local AppLocker policy using Intune.. AppLocker, when deployed via Intune as a local policy, allows you to create rules that restrict application execution to only approved Microsoft Store apps. This policy is enforced at the kernel level and does not require users to have local administrator privileges, as the rules are applied system-wide and cannot be overridden by standard users.

Answer

Enable Conditional Access to block non-approved apps.

Answer

Configure Windows Defender Application Control (WDAC) policy.

Answer

Assign an Intune App Protection Policy (APP) for Windows.