MD-102 Manage applications Practice Test 3 — 15 Questions

Question 1

An administrator applies the app protection policy shown in the exhibit to a group of users. A user reports that they are unable to copy data from a managed app and paste it into an unmanaged app. Which setting in the policy causes this behavior?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

dataTransferToUnmanagedApps is set to false.. The setting `dataTransferToUnmanagedApps` controls whether data can be transferred from a managed app to unmanaged apps via copy/paste, share, or other data-sharing mechanisms. When set to `false`, it blocks all such transfers, including pasting into unmanaged apps. This is the specific policy that prevents the user from copying data from a managed app and pasting it into an unmanaged app.

Answer

requirePin is set to true.

Answer

appSharingFromLevel is set to 'policyManagedApps'.

Answer

disableAppEncryptionIfDeviceEncryptionIsEnabled is set to false.

Question 2

Contoso Ltd. is a financial services company with 2,000 users. They use Microsoft Intune to manage Windows 10 devices. The company has a strict security policy that requires all devices to have a specific set of security applications installed: an antivirus (AV) app, a disk encryption app, and a VPN client. These apps are all line-of-business (LOB) Win32 apps packaged as .intunewin files. The administrator created a Win32 app for each and assigned them as 'Required' to all devices. After the deployment, the administrator notices that the apps are not installing on approximately 10% of devices. The devices are online and have connectivity. The Intune Management Extension is running. When the administrator checks the Intune Management Extension logs on a failing device, they see the following error: 'Failed to download content. Error: 0x80070002 - The system cannot find the file specified.' What is the most likely cause?

Accepted Answer

The content for the Win32 app was not uploaded correctly or is missing from Intune.. The error 0x80070002 ('The system cannot find the file specified') in the Intune Management Extension logs indicates that the client is attempting to download the Win32 app content from Intune, but the content blob is missing or inaccessible. This typically occurs when the .intunewin file was not uploaded correctly, the upload was interrupted, or the content was deleted from Intune after assignment. Since the extension is running and connectivity is confirmed, the issue is server-side content availability, not client-side permissions or detection logic.

Answer

The Intune Management Extension does not have permission to install apps on those devices.

Answer

The user is not logged in, so the app cannot be installed.

Answer

The app detection rules do not match the installed version.

Question 3

Northwind Traders is a retail company with 500 employees. They use Microsoft Intune to manage iOS devices. The company has a custom iOS app for inventory management that they need to deploy to all store managers. The app is signed with an enterprise certificate. The administrator uploads the .ipa file to Intune and assigns it as 'Required' to a device group containing the store managers' devices. After 48 hours, several managers report that the app is not installed on their devices. The administrator checks the Intune console and sees that the app status for those devices is 'Pending install'. What should the administrator do first to resolve the issue?

Accepted Answer

Deploy a certificate profile that installs the enterprise root certificate to the affected devices.. The 'Pending install' status for an enterprise-signed iOS app typically indicates that the device does not trust the enterprise certificate used to sign the app. Deploying a certificate profile that installs the enterprise root certificate on the affected devices establishes trust, allowing the app to install successfully. Without this trust, iOS blocks the installation of any enterprise-signed app, even when assigned as 'Required' via Intune.

Answer

Create an app protection policy and assign it to the devices.

Answer

Instruct the users to install the app manually from the Company Portal app.

Answer

Re-upload the .ipa file to Intune with a different version number.

Question 4

A company uses Intune to manage Windows 10 devices. They need to deploy a line-of-business (LOB) Win32 app to devices that are not assigned to any user. The app requires installation in the system context. Which installation behavior should be configured in the Intune Win32 app deployment?

Accepted Answer

System. (System) is correct because the Win32 app must run in the system context to install without a user session, which is required for devices not assigned to any user. In Intune, the 'System' installation behavior runs the installer as the local SYSTEM account, enabling silent, elevated installations regardless of user presence.

Answer

User

Answer

Device

Answer

LoggedOnUser

Question 5

A company uses Microsoft Intune to manage Windows 10 devices. They are deploying a Win32 app using the Intune Management Extension. The app requires a reboot and must ensure that the installation completes successfully before the device is allowed to restart. Which TWO deployment settings should be configured?

Accepted Answer

Set 'Device restart behavior' to 'No specific action'. Setting 'Device restart behavior' to 'No specific action' allows Intune to complete the Win32 app installation without forcing an immediate reboot, which is necessary when the app itself handles the reboot or when you want to control the restart timing. This setting prevents the Intune Management Extension from triggering a restart before the installation is fully complete, ensuring the app's post-installation processes (e.g., file copies, registry writes) finish successfully.

Answer

Enable 'Delivery optimization' for the app

Answer

Set 'Device restart behavior' to 'Require device restart'

Answer

Configure 'Supersedence' to replace the app

Question 6

Order the steps to configure a Windows 10 device for Microsoft 365 Apps deployment via Intune.

Accepted Answer

Sign in to Intune admin center, add a new app, select Microsoft 365 Apps, configure the suite settings, assign the app to groups.. Begin in Intune admin center, add a new app, choose Microsoft 365 Apps, configure suite, and assign.

Answer

Sign in to Intune admin center, add a new app, select Microsoft 365 Apps, assign the app to groups, configure the suite settings.

Answer

Sign in to Intune admin center, select Microsoft 365 Apps, add a new app, configure the suite settings, assign the app to groups.

Answer

Add a new app, sign in to Intune admin center, select Microsoft 365 Apps, configure the suite settings, assign the app to groups.

Question 7

Order the steps to deploy a Windows 10 virtual desktop in Azure using Windows 365.

Accepted Answer

1. Ensure appropriate licenses, 2. Access Microsoft Endpoint Manager admin center, 3. Create a provisioning policy, 4. Configure provisioning policy settings, 5. Provision Cloud PCs, 6. Assign users to Cloud PCs. Deploying Windows 10 virtual desktops via Windows 365 requires a specific sequence: first, ensure you have the appropriate licenses (Windows 365 Enterprise or Business). Then access the Microsoft Endpoint Manager admin center, create a provisioning policy, and configure its settings (e.g., network, management). After the policy is configured, you can provision Cloud PCs in bulk. Finally, assign the Cloud PCs to users. Common mistakes include swapping the order of licensing and portal access, configuring after provisioning, or assigning before provisioning.

Answer

1. Access Microsoft Endpoint Manager admin center, 2. Ensure appropriate licenses, 3. Create a provisioning policy, 4. Configure provisioning policy settings, 5. Provision Cloud PCs, 6. Assign users to Cloud PCs

Answer

1. Ensure appropriate licenses, 2. Access Microsoft Endpoint Manager admin center, 3. Create a provisioning policy, 4. Provision Cloud PCs, 5. Configure provisioning policy settings, 6. Assign users to Cloud PCs

Answer

1. Ensure appropriate licenses, 2. Access Microsoft Endpoint Manager admin center, 3. Create a provisioning policy, 4. Configure provisioning policy settings, 5. Assign users to Cloud PCs, 6. Provision Cloud PCs

Question 8

Match each Intune configuration profile type to its purpose.

Accepted Answer

Device restrictions: Controls device settings and features (e.g., camera, Bluetooth). Device restrictions manage device features, Endpoint protection handles security settings, Administrative templates use ADMX, and Custom uses OMA-URI. Common confusions involve swapping the first two.

Answer

Device restrictions: Manages security settings like antivirus and firewall

Answer

Endpoint protection: Controls device settings and features (e.g., camera, Bluetooth)

Question 9

Match each Windows Update for Business deployment service to its capability.

Accepted Answer

Update Rings: Configures deferral periods and deadlines for updates. The correct matches are: Update Rings configures deferral periods and deadlines; Feature Update Policies specify which feature update version is offered; Quality Update Policies control which quality updates are offered. Common confusions arise from mixing the roles of these policies.

Answer

Update Rings: Controls which feature updates are offered to devices

Answer

Feature Update Policies: Configures deferral periods for quality updates

Question 10

You are deploying a new line-of-business (LOB) app to Windows 10 devices managed by Microsoft Intune. The app requires a specific registry key to be set before installation. What is the best approach to ensure the registry key is applied before the app installs?

Accepted Answer

Define a requirement rule in the Win32 app that checks for the registry key; if missing, use a proactive remediation script to create it.. Win32 app deployment in Intune supports requirement rules that can check for prerequisites like registry keys. When the requirement is not met, you can pair the app with a proactive remediation script that creates the missing registry key before the app installation runs, ensuring the dependency is satisfied without manual intervention.

Answer

Create a compliance policy that requires the registry key and mark the app as required.

Answer

Use a device configuration policy to set the registry key, then assign the app as available.

Answer

Include a PowerShell script in the app's installation command that sets the registry key before the main installer runs.

Question 11

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a VPP (Volume Purchase Program) app that is already purchased and assigned to your tenant. What is the minimum configuration required to make the app available to users?

Accepted Answer

Sync the VPP token, then add the app from the store and assign it.. VPP apps require the VPP token to be synced with Intune first, then the app can be added from the store and assigned to users. Option A is wrong because device enrollment restrictions control device enrollment settings, not app deployment. Option C is wrong because the Company Portal is used for available apps, but the app must first be added and assigned in Intune; it is not automatically available without configuration. Option D is wrong because VPP apps are distributed through the store, not by uploading IPA files.

Answer

Configure a device enrollment restriction to allow the app.

Answer

Distribute the app via the Company Portal without any additional configuration.

Answer

Upload the app IPA file to Intune, then create an app configuration policy.

Question 12

You are troubleshooting a Microsoft 365 Apps for enterprise deployment on Windows 10 devices managed by Intune. Users report that the apps are not installing, but the deployment status in Intune shows 'Success' for some devices and 'Failed' for others. On a failing device, you discover that the Office Deployment Tool (ODT) logs indicate '0x80070005 - Access denied'. What is the most likely cause?

Accepted Answer

The Office Deployment Tool is running in user context instead of system context.. The error code 0x80070005 (Access denied) in Office Deployment Tool (ODT) logs indicates a permissions issue. When Intune deploys Microsoft 365 Apps, it runs the ODT in the system context via the Intune Management Extension. If the ODT is inadvertently executed in the user context (e.g., due to a misconfigured detection script or deployment script that doesn't elevate), it lacks the necessary privileges to write to the Program Files directory or modify system registry keys, causing the access denied error.

Answer

The device has insufficient disk space for the installation.

Answer

The configuration.xml file has an invalid Channel attribute.

Answer

The device does not have internet connectivity to download Office installation files.

Question 13

You need to deploy a web link as an app to Android Enterprise work profile devices. Users should see the link in the Company Portal app. What type of app should you add in Microsoft Intune?

Accepted Answer

Managed Google Play web link. Managed Google Play web links are the correct app type for deploying a web link as an app to Android Enterprise work profile devices. When added in Intune, this web link appears in the Company Portal app under the 'Apps' tab, allowing users to open the link directly. Other app types like iOS web clips or Android store apps do not support this specific deployment method for Android Enterprise work profiles.

Answer

iOS/iPadOS web clip

Answer

Android store app

Answer

Windows app package (MSI)

Question 14

Your organization manages Windows devices with Intune and uses Azure Information Protection (AIP) to classify documents. You are deploying the AIP client as a Win32 app. After deployment, some users report that the AIP add-in is not visible in Office applications. What should you check first?

Accepted Answer

Ensure that the required .NET Framework and Visual Studio Tools for Office runtime are installed.. The AIP client add-in for Office requires the .NET Framework and Visual Studio Tools for Office runtime to be installed. If these prerequisites are missing, the add-in will not load. Option A is incorrect because while Office updates may be necessary, the most common issue is missing prerequisites. Option C is incorrect because local administrator rights are not required for the add-in to be visible after installation. Option D is incorrect because internet access is needed for activation but does not affect add-in visibility.

Answer

Confirm that Office is updated to the latest version.

Answer

Verify that the user has local administrator rights.

Answer

Check if the device has internet access to activate the client.

Question 15

You are designing an app protection policy (APP) for Microsoft 365 mobile apps accessing corporate data on iOS devices. The security team requires that when a user opens a work document in the Microsoft Word app, the user must authenticate with Face ID or a passcode. Which setting should you configure?

Accepted Answer

Require PIN or Face ID for access (iOS). The 'Require PIN or Face ID for access (iOS)' setting enforces biometric or passcode authentication specifically when a user launches a managed app or resumes it from the background. This directly meets the requirement that opening a work document in Word triggers Face ID or passcode verification, as the app protection policy (APP) intercepts the app launch and prompts for authentication before granting access to corporate data.

Answer

Block managed apps from running on jailbroken devices

Answer

Encrypt app data

Answer

Require app PIN when device PIN is not set