MD-102 Manage applications Practice Test 3 — 15 Questions

Question 1

Match each Windows Update for Business deployment service to its capability.

Question 2

You are deploying a new line-of-business (LOB) app to Windows 10 devices managed by Microsoft Intune. The app requires a specific registry key to be set before installation. What is the best approach to ensure the registry key is applied before the app installs?

Accepted Answer

Define a requirement rule in the Win32 app that checks for the registry key; if missing, use a proactive remediation script to create it.. Option C is correct because Win32 app detection rules can include registry checks, and using a requirement rule (e.g., registry key exists) ensures the app installs only after the key is present. Option A is wrong because app configuration policies don't apply before installation. Option B is wrong because PowerShell scripts can run during installation but not as a prerequisite. Option D is wrong because compliance policies are for device state, not pre-installation steps.

Answer

Create a compliance policy that requires the registry key and mark the app as required.

Answer

Use a device configuration policy to set the registry key, then assign the app as available.

Answer

Include a PowerShell script in the app's installation command that sets the registry key before the main installer runs.

Question 3

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a VPP (Volume Purchase Program) app that is already purchased and assigned to your tenant. What is the minimum configuration required to make the app available to users?

Accepted Answer

Sync the VPP token, then add the app from the store and assign it.. Option B is correct because VPP apps require a token to be synced with Intune, and then the app can be assigned as required or available. Option A is wrong because app configuration policies are optional. Option C is wrong because device enrollment restrictions don't affect app assignment. Option D is wrong because company portal is used for available apps but not strictly required for required installs.

Answer

Configure a device enrollment restriction to allow the app.

Answer

Distribute the app via the Company Portal without any additional configuration.

Answer

Upload the app IPA file to Intune, then create an app configuration policy.

Question 4

You are troubleshooting a Microsoft 365 Apps for enterprise deployment on Windows 10 devices managed by Intune. Users report that the apps are not installing, but the deployment status in Intune shows 'Success' for some devices and 'Failed' for others. On a failing device, you discover that the Office Deployment Tool (ODT) logs indicate '0x80070005 - Access denied'. What is the most likely cause?

Accepted Answer

The Office Deployment Tool is running in user context instead of system context.. Option D is correct because the ODT requires administrative privileges to install Office. If the installation context is user-level, access denied occurs. Option A is wrong because network issues typically give different error codes. Option B is wrong because configuration.xml syntax errors cause different errors. Option C is wrong because disk space errors are different.

Answer

The device has insufficient disk space for the installation.

Answer

The configuration.xml file has an invalid Channel attribute.

Answer

The device does not have internet connectivity to download Office installation files.

Question 5

You need to deploy a web link as an app to Android Enterprise work profile devices. Users should see the link in the Company Portal app. What type of app should you add in Microsoft Intune?

Accepted Answer

Managed Google Play web link. Option A is correct because a web link is added as a 'Managed Google Play web link' for Android Enterprise. Option B is wrong because iOS web clips are for iOS. Option C is wrong because Windows app packages are for Windows. Option D is wrong because Android store app is for store apps, not web links.

Answer

iOS/iPadOS web clip

Answer

Android store app

Answer

Windows app package (MSI)

Question 6

Your organization manages Windows devices with Intune and uses Azure Information Protection (AIP) to classify documents. You are deploying the AIP client as a Win32 app. After deployment, some users report that the AIP add-in is not visible in Office applications. What should you check first?

Accepted Answer

Ensure that the required .NET Framework and Visual Studio Tools for Office runtime are installed.. Option C is correct because the AIP client requires the .NET Framework and Visual Studio Tools for Office runtime. Missing prerequisites cause the add-in to not load. Option A is wrong because user permissions affect installation but not add-in visibility after install. Option B is wrong because network connectivity is not the primary issue. Option D is wrong because Office updates don't remove the add-in.

Answer

Confirm that Office is updated to the latest version.

Answer

Verify that the user has local administrator rights.

Answer

Check if the device has internet access to activate the client.

Question 7

You are designing an app protection policy (APP) for Microsoft 365 mobile apps accessing corporate data on iOS devices. The security team requires that when a user opens a work document in the Microsoft Word app, the user must authenticate with Face ID or a passcode. Which setting should you configure?

Accepted Answer

Require PIN or Face ID for access (iOS). Option A is correct because 'Require PIN or Face ID for access' controls access to the app itself, including when opening documents. Option B is wrong because jailbreak/root detection is a device condition. Option C is wrong because encryption is for data at rest. Option D is wrong because 'Block managed apps from running on jailbroken devices' is a device-level check.

Answer

Block managed apps from running on jailbroken devices

Answer

Encrypt app data

Answer

Require app PIN when device PIN is not set

Question 8

You are using Microsoft Intune to deploy a custom Windows app that is packaged as an .msi. The app requires a reboot after installation. You want to minimize user disruption. What is the best deployment strategy?

Accepted Answer

Assign the app as available to a device group.. Option B is correct because assigning to device as available lets users choose when to install, and they can schedule the reboot. Option A is wrong because required install may force reboot at inconvenient times. Option C is wrong because available to user still reboots immediately after install via Company Portal. Option D is wrong because deadline settings are for required installs.

Answer

Assign the app as available to a user group.

Answer

Assign the app as required to a device group.

Answer

Assign the app as required with a deadline.

Question 9

You need to deploy a Microsoft 365 Apps for enterprise configuration that includes Teams and Visio Pro for Microsoft 365. Users should get the full suite with both apps. What is the recommended method?

Accepted Answer

Create a Win32 app with the Office Deployment Tool and a configuration.xml that includes both products.. Option C is correct because the Office Deployment Tool and a custom configuration.xml allow you to specify products, languages, and update channels. Option A is wrong because Intune built-in Microsoft 365 Apps app allows selecting products but may not include Visio easily. Option B is wrong because manually installing is not scalable. Option D is wrong because PowerShell scripts are less reliable.

Answer

Use the built-in Microsoft 365 Apps for enterprise app type in Intune and select the products.

Answer

Instruct users to install from the Office portal.

Answer

Deploy a PowerShell script that runs Setup.exe /configure.

Question 10

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a .pkg app that is signed by a developer certificate that is not yet trusted on the devices. What must you do to allow the installation?

Accepted Answer

Use a device configuration policy to trust the developer certificate before deploying the app.. Option B is correct because you can use a kernel extension profile to allow the developer ID, or use a custom attribute. Alternatively, you can deploy the app as a line-of-business app and use the 'Allow user to bypass' option. But the best approach is to trust the developer certificate via a configuration profile. Option A is wrong because MDM can deploy unsigned apps only if the device is supervised. Option C is wrong because user approval is not enough. Option D is wrong because the app store is not used.

Answer

Deploy the app as a line-of-business app with the 'Allow user to bypass' option enabled.

Answer

Instruct users to manually approve the installation in System Preferences.

Answer

Convert the .pkg to a .dmg and deploy via Microsoft Store for Business.

Question 11

You are configuring an app protection policy for iOS devices to protect corporate data in Microsoft Outlook. Which TWO settings prevent users from copying corporate data to personal apps?

Accepted Answer

Allow app to transfer data to other apps. Option B and Option D are correct. 'Restrict cut, copy, and paste between apps' with policy-managed apps only prevents copying to unmanaged apps. 'Allow app to transfer data to other apps' set to 'Policy managed apps' restricts data transfer to managed apps only. Option A is wrong because encryption is for data at rest. Option C is wrong because it restricts saving to cloud but not copying. Option E is wrong because it blocks screenshots but not copy/paste.

Answer

Save copies of work data

Answer

Block screen capture and screen recording

Answer

Encrypt app data

Question 12

You are deploying a Win32 app via Intune that requires .NET Framework 4.8 as a dependency. Which THREE steps must you perform to ensure the dependency is installed before the app?

Accepted Answer

In the main app's properties, add a dependency and select the .NET Framework app.. Option A, Option C, and Option D are correct. You need to add the dependency app in Intune, set the dependency for the main app, and configure auto-install for the dependency. Option B is wrong because detection rules are for the main app, not dependency order. Option E is wrong because supercedence is for replacement, not dependencies.

Answer

Configure a detection rule for .NET Framework in the main app.

Answer

Create a supersedence relationship where the .NET Framework app supersedes the main app.

Question 13

You are configuring a Microsoft Intune app configuration policy for a managed iOS app. Which THREE types of settings can you include in the policy?

Accepted Answer

Permissions such as location or camera. Option A, Option B, and Option D are correct. App configuration policies can include configuration settings (key-value pairs), connection strings, and permissions. Option C is wrong because compliance rules are in compliance policies. Option E is wrong because network requirements are in device configuration.

Answer

Compliance rules for the app

Answer

Network requirements like VPN

Question 14

Your organization uses Microsoft Intune to manage Windows 11 devices. You need to deploy a line-of-business (LOB) app that is signed with a certificate not trusted by the devices. What should you do to ensure the app installs successfully?

Accepted Answer

Enable the Sideloading policy for the device group.. To install an LOB app that is not signed by a trusted certificate, you must disable the Sideloading policy for the device group. Option A is correct because enabling sideloading allows installation of apps signed with untrusted certificates. Option B is wrong because allowing sideloading does not require the app to be in the Microsoft Store. Option C is wrong because the Sideloading policy is not a device configuration profile but an app deployment policy. Option D is wrong because disabling automatic updates does not affect sideloading.

Answer

Create a device configuration profile to allow sideloading.

Answer

Add the app to the Microsoft Store for Business.

Answer

Disable automatic app updates for the device group.

Question 15

You manage iOS devices with Microsoft Intune. A user reports that a required app is missing from their device. You verify the app is assigned as 'Required' to a user group containing the user, and the device is compliant. What is the most likely reason the app is not installing?

Accepted Answer

The app is configured to require user enrollment, but the device uses device enrollment.. If the app is configured to require the device to be enrolled in user enrollment, the app will not install on devices enrolled via device enrollment. Option C is correct. Option A is wrong because the VPP token expiration would affect all apps, not just this one. Option B is wrong because if DEP is used, the app should still install. Option D is wrong because the app is assigned as required, so user installs should be allowed.

Answer

The app is set to 'Available for enrolled devices' instead of 'Required'.

Answer

The device is not enrolled using Apple Device Enrollment Program (DEP).

Answer

The Apple Volume Purchase Program (VPP) token has expired.