MD-102 Manage applications Practice Test 4 — 15 Questions

Question 1

A user reports that a required app is not installing on their Android Enterprise device. The device is enrolled in Intune and shows as compliant. The app is assigned to the user. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user does not have the Company Portal app installed.. On Android Enterprise devices enrolled in Intune, the Company Portal app is required to install line-of-business (LOB) apps or manage app installations via the Intune console. Without the Company Portal app, the device cannot receive app assignment push notifications or initiate the installation process, even if the device is compliant and the app is assigned to the user. This is a prerequisite for app deployment on Android Enterprise work profiles.

Answer

The device is not compliant with conditional access policies.

Answer

The app is not available on Managed Google Play.

Answer

The device does not have a work profile configured.

Question 2

Which TWO of the following are supported app types for deploying to iOS devices via Microsoft Intune?

Accepted Answer

iOS line-of-business app. Option B (iOS line-of-business app) is correct because Intune supports deploying custom or in-house iOS apps packaged as .ipa files (often with a provisioning profile and mobileprovision/manifest) to enrolled iOS devices. Option C (iOS store app) is correct because Intune supports deploying apps from the Apple App Store to iOS devices by searching for and syncing the app from the store. Option A (Web link) is not an iOS app type but a web clip/URL shortcut, which is not an app deployment type for iOS. Option D (Android app) targets Android devices, not iOS. Option E (Win32 app) is a Windows app type (.intunewin) and is not supported for iOS deployment.

Answer

Web link

Answer

Android app

Answer

Win32 app

Question 3

Which TWO of the following are methods to deploy apps to Windows 10/11 devices via Microsoft Intune?

Accepted Answer

Microsoft Store app. Option C (Microsoft Store app) is correct because Intune supports deploying Universal Windows Platform (UWP) and Microsoft Store apps to Windows 10/11 devices by connecting to the Microsoft Store for Business or syncing store apps, which is a native Windows app deployment method. Option E (Win32 app) is correct because Intune's Win32 app type allows packaging .intunewin files with the Microsoft Win32 Content Prep Tool and deploying them to Windows 10/11 devices, supporting detection rules, requirements, and install/uninstall commands. Options A (iOS app) and D (Android app) are incorrect because those app types target iOS/iPadOS and Android devices respectively, not Windows 10/11. Option B (Web link) is not among the marked correct answers for this scenario, as the question specifically asks for the two Windows app deployment methods represented by the Store and Win32 app types.

Answer

iOS app

Answer

Web link

Answer

Android app

Question 4

You are reviewing the Intune Win32 app configuration for Microsoft Edge. The app is deployed to Windows 10 devices. Users report that Edge is not being installed on some devices. What is the most likely issue with the detection rule?

Accepted Answer

The detection rule requires an exact version match, which may not match if a different version is installed.. The most likely issue is that the detection rule is configured to require an exact version match. If a device already has a different version of Microsoft Edge installed (e.g., a newer or older build), Intune will evaluate the detection rule as 'not detected' and attempt to reinstall the app, which may fail or be skipped because the installer detects an existing version. This is a common misconfiguration in Win32 app deployments where version-specific detection rules cause false negatives.

Answer

The uninstall command is incorrect.

Answer

The install command is missing the --silent flag.

Answer

The detection rule is checking the 32-bit registry on a 64-bit system.

Question 5

Refer to the exhibit. You are deploying a line-of-business app to Windows 10 devices. The JSON shows the app configuration in Microsoft Graph. Which of the following is true about this deployment?

Accepted Answer

The app will install in system context.. The JSON configuration includes the 'installExperience' property set to 'system', which means the app will be installed in the system context (as SYSTEM account) rather than per-user. This is typical for line-of-business apps deployed via Microsoft Intune, ensuring the app is available to all users on the device and can perform system-level operations without user interaction.

Answer

The device will restart automatically after installation.

Answer

The app will only install if the product code matches.

Answer

The app will be installed from the Microsoft Store for Business.

Question 6

Refer to the exhibit. You are deploying a line-of-business iOS app. Which statement is correct about this app?

Accepted Answer

The app will expire on December 31, 2025.. The exhibit shows the app's expiration date is set to December 31, 2025, under the 'Expiration date' field. In Microsoft Intune, when you configure a line-of-business (LOB) iOS app, you can specify an expiration date; after that date, the app will be blocked from installation or launch. Therefore, option C is correct because the app will expire on that date.

Answer

The app requires iOS 15.0 or later.

Answer

The app can only be installed on iPads.

Answer

The app has no expiration date.

Question 7

A company uses Microsoft Intune to manage Windows devices. They want to ensure that only approved Microsoft Store apps can be installed on corporate devices. Which configuration policy should they use?

Accepted Answer

Windows app control policy. Windows app control policy in Microsoft Intune is specifically for Windows Defender Application Control (WDAC), which uses a base policy to allow only trusted apps. To restrict installation to only approved Microsoft Store apps, you can configure a WDAC policy with a base policy that only allows apps from the Microsoft Store. This policy blocks all other executables. Option B (sideloading policy) allows installation of non-Store apps, not restrict. Option C (Microsoft Store for Business app policy) is for managing deployment of Store apps, not controlling which apps can run. Option D (app inventory policy) is for reporting, not restricting.

Answer

Windows app sideloading policy

Answer

Microsoft Store for Business app policy

Answer

Windows app inventory policy

Question 8

An organization uses Microsoft Intune to manage iOS devices. They need to deploy an internal line-of-business (LOB) app that is signed with an enterprise certificate. The app must be available to users who are members of a dynamic Microsoft Entra ID group. Which deployment method should you use?

Accepted Answer

Assign the LOB app as 'Available' to the dynamic group. Deploying an internal LOB app signed with an enterprise certificate as 'Available' to a dynamic Microsoft Entra ID group allows users to install the app on demand from the Company Portal, while still targeting the group dynamically. This method supports enterprise-signed apps without requiring a VPP token, and 'Available' assignments are the only way to make the app visible in the Company Portal for optional installation by dynamic group members.

Answer

Use a VPP token to deploy the app

Answer

Configure a managed open-in policy

Answer

Assign the LOB app as 'Required' to the dynamic group

Question 9

A company uses Microsoft Intune to manage Windows 11 devices. They want to deploy a Win32 app that requires user interaction during installation. The app must be installed with administrative privileges. Which installation behavior setting should you configure?

Accepted Answer

System context (device). The correct setting is 'System context (device)' because the app must be installed with administrative privileges. In Intune, the 'System' installation behavior runs the installer as the SYSTEM account, which inherently has administrative privileges. While this context does not allow user interaction, the requirement for admin privileges takes precedence. If user interaction were absolutely necessary, a different installation method (such as running the installer in user context with self-elevation) would be required, but the question asks for the installation behavior setting that provides administrative privileges, which is System context.

Answer

Installation time (64-bit vs 32-bit)

Answer

Device restart behavior

Answer

User context (user)

Question 10

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a PKG app that requires reboot. Which app type should you select?

Accepted Answer

macOS LOB app. A macOS LOB (line-of-business) app type is required because Intune uses this type to deploy PKG files that can include installation scripts and handle reboots. The LOB app type supports the .pkg format natively and allows Intune to manage the installation lifecycle, including required reboots, through the Intune management agent on macOS.

Answer

macOS web app

Answer

Microsoft 365 for macOS

Answer

macOS DMG app

Question 11

A company uses Microsoft Intune to manage Android Enterprise personally-owned work profile devices. They need to deploy a managed app that restricts data transfer between work and personal profiles. Which app configuration policy should they use?

Accepted Answer

Managed app configuration policy. For Android Enterprise personally-owned work profile devices, a managed app configuration policy (option B) is used to deploy managed apps with specific settings, such as restricting data transfer between the work and personal profiles. This policy applies configuration keys directly to the app at runtime, enabling controls like copy/paste restrictions or data sharing boundaries without requiring device-level enforcement.

Answer

Compliance policy

Answer

App protection policy

Answer

Device configuration policy

Question 12

Refer to the exhibit. An Intune admin configures the above Windows Update for Business policy. Users report that quality updates are not being installed until 7 days later than expected. What is the likely reason?

Accepted Answer

Quality updates are deferred by 7 days. QualityUpdateDeferralPeriodInDays is set to 7, which defers updates by 7 days. This is the intended behavior; no issue. However, the question implies users think updates are late. The policy is correct; perhaps users misunderstand. But the question asks for likely reason. The deferral period is 7 days, so updates are intentionally deferred. The update notification level is default. Feature updates deferred 30 days. No pause. So the quality update deferral is the cause.

Answer

Quality updates are paused

Answer

Feature updates are deferred by 30 days

Answer

Update notifications are set to default

Question 13

Refer to the exhibit. A KQL query is run in Microsoft Defender XDR for a device 'WIN10-PC'. The results show that a critical line-of-business app 'ContosoApp' version '2.0.0' has InstallationResult 'Failed' with ErrorCode '0x80073CF6'. What does this error code typically indicate?

Accepted Answer

The app package is not signed correctly. Error code 0x80073CF6 in Microsoft Defender XDR corresponds to APPX_E_CORRUPT_CONTENT, which indicates that the app package's digital signature is invalid or the package content has been tampered with. This typically occurs when the .appx or .msix package is not signed correctly or the signature does not match the package contents, preventing installation on Windows 10/11 devices.

Answer

The device does not have internet connectivity

Answer

The user does not have permission to install apps

Answer

The device has insufficient disk space

Question 14

Which TWO of the following can be used to deploy Microsoft 365 Apps to Windows devices managed by Microsoft Intune? (Select TWO.)

Accepted Answer

Intune built-in 'Microsoft 365 Apps for Windows 10 and later' app type. Option B is correct because Intune provides a built-in app type called 'Microsoft 365 Apps for Windows 10 and later' (Windows app, Microsoft 365 Apps type) that lets you select the Office apps, update channel, and architecture, then assign the app to Entra ID groups for installation on managed Windows devices. Option E is correct because the Microsoft 365 Apps admin center (config.office.com) includes the Office Customization Tool, which generates a configuration XML that can be used with Intune's Microsoft 365 Apps deployment or with the Office Deployment Tool to deploy and manage Microsoft 365 Apps. Option A is not correct in this context because Configuration Manager is a separate on-premises management product; it can deploy Microsoft 365 Apps but not directly through Intune-managed Windows devices unless co-management or the Configuration Manager agent is involved, so it is not one of the two Intune-based methods. Option C is not correct because Group Policy configures settings for already-installed Office apps but does not deploy the Microsoft 365 Apps package to Intune-managed devices. Option D is not correct because wrapping the Office installer as a Win32 app is not the supported or recommended Intune deployment method for Microsoft 365 Apps; the built-in app type and the Microsoft 365 Apps admin center are the intended approaches.

Answer

Configuration Manager

Answer

Group Policy

Answer

Win32 app wrapper

Question 15

Which THREE of the following are valid detection rule types for a Win32 app in Microsoft Intune? (Select THREE.)

Accepted Answer

MSI product code. For a Win32 app in Microsoft Intune, the detection rule types available include MSI product code (option B), which checks the product code of an installed MSI; File system (option C), which checks for a file or folder's existence, date, version, or size; and Registry (option D), which checks for a registry key or value's existence, string, integer, or version. These three are the standard detection methods supported for Win32 apps in Intune. Windows feature (option A) is not a detection rule type for Win32 apps; it is used for Windows update rings or feature updates. DNS query (option E) is not a supported detection rule type for Win32 apps in Intune.

Answer

Windows feature

Answer

DNS query