MD-102 Manage applications Practice Test 3 — 15 Questions

Question 1

Your organization is migrating from on-premises SCCM to Microsoft Intune. You have a Win32 app that requires a custom script to run after installation. The app must be available to users in a remote office with limited internet connectivity. What should you use to deploy the app?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the Win32 app via Intune with Delivery Optimization and peer caching enabled.. Delivery Optimization combined with peer caching allows devices in a remote office with limited internet connectivity to download the Win32 app from other peers on the same local network, reducing WAN bandwidth usage. Intune natively supports Win32 app deployment with this feature, and the custom script can be included as a post-installation detection or requirement script. This approach aligns with the migration from SCCM to Intune while addressing connectivity constraints.

Answer

Configure a cloud management gateway (CMG) to distribute the app.

Answer

Store the app in Azure Files and mount it on devices.

Answer

Use a PowerShell script deployed via Intune to download the app from a local file share.

Question 2

You use Microsoft Intune to manage Android Enterprise fully managed devices. You need to ensure that only work apps can access corporate data. Personal apps should not be able to read work data. What should you configure?

Accepted Answer

Configure an Intune App Protection Policy (APP) targeting the work apps.. Intune App Protection Policies (APP) can be configured to restrict data transfer between managed and unmanaged apps, ensuring that only approved work apps can access corporate data. This policy applies at the app layer, blocking personal apps from reading or copying work data even on fully managed devices, which aligns with the requirement to prevent personal app access to corporate data.

Answer

Configure Conditional Access to block personal apps.

Answer

Enable Android Enterprise work profile on the devices.

Answer

Deploy Windows Information Protection (WIP) policy.

Question 3

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom PKG file that requires administrative privileges to install. The deployment must be silent without user interaction. What should you do?

Accepted Answer

Deploy the PKG as a line-of-business app in Intune and assign it as required.. Intune supports deploying PKG files as line-of-business (LOB) apps on macOS. When you upload the PKG and assign it as 'Required', Intune silently installs it using the macOS Installer framework with administrative privileges, without requiring user interaction. The Intune management agent on the device handles the installation in the system context, ensuring a silent deployment.

Answer

Use a shell script to run the PKG installer with sudo privileges via a launch daemon.

Answer

Add the PKG to Apple Business Manager and distribute via VPP.

Answer

Place the PKG in a network share and instruct users to install via Company Portal.

Question 4

You deploy a Microsoft 365 Apps for enterprise suite via Intune to Windows devices. Users report that updates are not being applied automatically. You need to ensure that updates are installed from the Office Content Delivery Network (CDN) without user intervention. What should you configure?

Accepted Answer

Configure the Office update channel via an Intune administrative template (ADMX).. Configuring the Office update channel via an Intune administrative template (ADMX) directly sets the registry policy that controls which update channel (e.g., Monthly Enterprise) Office 365 Apps use, and by default, those updates are delivered from the Office Content Delivery Network (CDN) without user intervention. This policy ensures updates are applied automatically in the background, meeting the requirement for no user interaction.

Answer

Configure Delivery Optimization to download from peers.

Answer

Enable Windows Update for Business to manage Office updates.

Answer

Use the Office Deployment Tool to set update settings.

Question 5

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a Microsoft Copilot app that requires users to sign in with their work account. The app must be automatically installed without user interaction. What should you do?

Accepted Answer

Purchase the app through Apple Business Manager and assign it as a required app in Intune.. Purchasing the app through Apple Business Manager (ABM) and assigning it as a required app in Intune enables silent, automatic installation on supervised iOS/iPadOS devices without user interaction. This is the standard method for deploying App Store apps as required.

Answer

Configure a web clip that links to the app in the App Store.

Answer

Create an Intune App Protection Policy for the app.

Answer

Add the app as a line-of-business app and deploy via Company Portal.

Question 6

Your organization has devices enrolled in Microsoft Intune that are not domain-joined. You need to deploy a LOB app that requires a license key stored in a file. The app must be installed automatically when devices are enrolled. What should you do?

Accepted Answer

Package the app as a Win32 app and include a script to copy the license file.. To deploy a LOB app that requires a license key stored in a file and install automatically on enrolled devices, you should package the app as a Win32 app in Intune and include a script to copy the license file. Win32 apps support custom installation scripts and can be assigned to device groups for automatic installation.

Answer

Use a Microsoft Store for Business app and include the license as a dependency.

Answer

Join devices to Azure AD and use Group Policy to install.

Answer

Create an Intune App Protection Policy to deploy the license.

Question 7

Which TWO of the following are prerequisites for deploying a Win32 app via Microsoft Intune?

Accepted Answer

The app must be packaged using the Microsoft Win32 Content Prep Tool.. Option A is correct because Win32 apps in Intune must be wrapped into the .intunewin format using the Microsoft Win32 Content Prep Tool (IntuneWinAppUtil.exe) before they can be uploaded and deployed. Option C is correct because the Intune Management Extension (IME) is the agent on the Windows device that actually downloads, installs, and reports on Win32 apps; it is installed automatically when a Win32 app or PowerShell script is assigned to the device. Option B is not required as a stated prerequisite in this context, since Win32 app support depends on the IME and supported Windows builds rather than a specific 1803 minimum being the defining prerequisite. Option D is not required because devices can be enrolled via co-management, group policy, or other methods and still receive Win32 apps, not strictly Microsoft Entra ID joined only. Option E is not required because the Company Portal app is used for user-initiated installs and is not a prerequisite for Win32 app deployment via the IME.

Answer

The device must be running Windows 10 version 1803 or later.

Answer

The device must be Azure AD joined.

Answer

The device must have the Company Portal app installed.

Question 8

Which TWO of the following are benefits of using Microsoft Intune to manage applications on mobile devices?

Accepted Answer

Ability to deploy apps to devices without requiring sideloading.. Option A is correct because Intune delivers apps through managed distribution channels such as the Apple App Store, Google Play, and Microsoft Store for Business, or via the Company Portal, so users install apps through supported mechanisms rather than manually sideloading packages. Option D is correct because Intune app protection policies (MAM) support selective wipe, which removes only corporate data from managed apps (for example, via the 'Selective wipe' action) while leaving personal data intact when a user leaves or the device is retired. Option B is not a general benefit of Intune app management, since compliance policies are separate from app deployment and do not universally gate every app installation. Option C is incorrect because Intune supports both user-based and device-based licensing, not user-based licensing only. Option E is incorrect because Intune does not automatically back up app data to the cloud; it manages app deployment and protection, not backup.

Answer

Enforcement of device compliance before app installation.

Answer

Support for user-based licensing only.

Answer

Automatic backup of app data to the cloud.

Question 9

Refer to the exhibit. You deploy this AppLocker policy via Microsoft Intune to Windows 10 devices. The policy is in AuditOnly mode. Users are now able to run unsigned executables. You need to block unsigned executables without affecting signed ones. What should you do?

Accepted Answer

Change the EnforcementMode to 'Enabled' and add a deny rule for unsigned executables.. AppLocker's AuditOnly mode logs events but does not enforce rules. To block unsigned executables, you must change the EnforcementMode to 'Enabled' so that rules are enforced. Adding a deny rule for unsigned executables specifically blocks them while allowing signed executables to run, provided no conflicting allow rules exist. This approach ensures that only unsigned executables are blocked, leaving signed ones unaffected.

Answer

Add a deny rule for all Microsoft signed executables.

Answer

Keep the policy in AuditOnly and rely on Windows Defender to block unsigned apps.

Answer

Delete the existing rule and create a new rule that explicitly allows only specific signed apps.

Question 10

Refer to the exhibit. You deploy this ARM template to create an Intune configuration policy for macOS devices. The policy sets the 'com.apple.ManagedClient.appstore' setting to true. What is the expected behavior on the target macOS devices?

Accepted Answer

Users will be allowed to install apps from the App Store.. Setting 'com.apple.ManagedClient.appstore' to true in an Intune macOS configuration policy explicitly allows users to install apps from the App Store. This key controls the 'allow app store app installation' restriction; when true, the restriction is disabled, meaning users can install apps from the App Store. The policy does not affect automatic updates or restrict installation to only Apple Business Manager purchases.

Answer

App Store updates will be automatically installed.

Answer

Only apps purchased through Apple Business Manager will be installable.

Answer

Users will be blocked from installing apps from the App Store.

Question 11

You need to deploy a line-of-business app to 100 Windows 10 devices that are managed by Microsoft Intune. The app installer is a .msi file. Which app type should you select when adding the app in Microsoft Intune?

Accepted Answer

Windows app (Win32). D is correct because Win32 app management in Intune supports deploying traditional desktop applications, including .msi files, to Windows 10 devices. Win32 apps can be assigned to devices managed by Intune and allow for complex installation commands, detection rules, and dependencies, making them suitable for line-of-business apps that require full control over the installation process.

Answer

Microsoft Store app (Windows)

Answer

Windows app (Line-of-business)

Answer

Web link

Question 12

Contoso uses Intune to manage iOS/iPadOS devices. You need to ensure that only approved apps from the Microsoft Store can be installed on corporate devices. What should you configure?

Accepted Answer

iOS/iPadOS App Configuration policies. To ensure only approved apps from the Microsoft Store can be installed on corporate iOS/iPadOS devices, configure a Device restrictions policy (Device configuration profile) with settings such as blocking the App Store or allowing only managed apps. App Configuration policies cannot restrict app installation; they only supply app-specific settings.

Answer

App Protection Policies (APP)

Answer

Device Compliance policies

Answer

Managed App Policies (MAM)

Question 13

A user reports that a required app is not installed on their Windows 11 device managed by Intune. The app appears in the Microsoft Intune admin center with a status of 'Pending - Install Pending'. You verify that the device is online and has network connectivity. What is the most likely cause?

Accepted Answer

The Intune Management Extension has not synced with the service yet.. The 'Pending - Install Pending' status indicates that Intune has successfully delivered the app assignment policy to the device, but the Intune Management Extension (IME) has not yet executed the installation. Since the device is online and has network connectivity, the most likely cause is that the IME has not synced with the Intune service to receive the actual installation instructions. The IME syncs periodically (every 24 hours by default, or on reboot/logon), and until it completes a sync, the app remains in this pending state. Options B, C, and D are incorrect: if the user were not targeted (B), the app would not appear with 'Pending' status; if the app were assigned as 'Available' (C), the status would show 'Available' rather than 'Pending - Install Pending'; and conditional access (D) does not affect app installation status.

Answer

The user is not targeted with the app assignment.

Answer

The app is assigned as 'Available' instead of 'Required'.

Answer

The device is not compliant with conditional access policies.

Question 14

You have an Intune-managed Windows 10 device that is not receiving app updates. The app was deployed as a Win32 app with a detection rule. You verify that the device is online and the Intune Management Extension is running. What should you check first?

Accepted Answer

The app assignment schedule is configured to update.. For a Win32 app deployed via Intune, the app's update behavior is governed by the assignment and the app's detection/requirement rules combined with the assignment schedule. If the app is not receiving updates, the first thing to verify is whether the assignment schedule is configured to allow updates — for example, whether the app is assigned as Required with a schedule that triggers re-evaluation, or whether the assignment is set to 'Uninstall' or lacks a re-evaluation trigger. The question states the device is online and IME is running, so the next logical check is the assignment schedule configuration.

Answer

The detection rule is set to 'File exists'.

Answer

The app is assigned as 'Required' in the assignment.

Answer

The Intune Management Extension is up to date.

Question 15

You need to enable users to install company apps from a private store on their iOS devices. Which Microsoft Intune feature should you use?

Accepted Answer

Volume Purchase Program (VPP). The Volume Purchase Program (VPP) is the correct feature because it allows organizations to purchase app licenses in bulk from Apple and distribute them to users' iOS devices through a private store. By integrating VPP with Microsoft Intune, you can assign licensed apps to users or devices, enabling them to install company-approved apps from a private store without requiring an Apple ID or personal payment.

Answer

Mobile Application Management (MAM) policies

Answer

Certificate profiles

Answer

Company Portal app