MD-102 Manage applications Practice Test 5 — 15 Questions

Question 1

Which THREE factors can cause a required app deployment to fail on a Windows 10 device managed by Intune? (Choose three.)

Accepted Answer

The device is not connected to the internet.. Intune requires a device to have internet connectivity to communicate with the Microsoft Intune service and download required app deployments. Without internet access, the Intune Management Extension cannot retrieve the app assignment policy or download the application content from the cloud, causing the deployment to fail.

Answer

The device has an app update policy that blocks updates.

Answer

The user is not assigned to the app.

Question 2

Which TWO app types are available for deploying apps to iOS/iPadOS devices in Microsoft Intune? (Choose two.)

Accepted Answer

iOS/iPadOS app store app. Microsoft Intune supports deploying iOS/iPadOS app store apps (option B) by integrating with the Apple Volume Purchase Program (VPP) or directly assigning public store apps via the Intune console. iOS/iPadOS line-of-business apps (option E) are custom-built apps that are uploaded as .ipa files and deployed to devices without going through the public App Store. Both are native app types for iOS/iPadOS management in Intune.

Answer

Web link

Answer

Windows app (Win32)

Answer

Android Line-of-business app

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved Microsoft Store apps can be installed on company devices. The solution must not require users to be local administrators. What should you configure?

Accepted Answer

Deploy a local AppLocker policy using Intune.. AppLocker, when deployed via Intune as a local policy, allows you to create rules that restrict application execution to only approved Microsoft Store apps. This policy is enforced at the kernel level and does not require users to have local administrator privileges, as the rules are applied system-wide and cannot be overridden by standard users.

Answer

Enable Conditional Access to block non-approved apps.

Answer

Configure Windows Defender Application Control (WDAC) policy.

Answer

Assign an Intune App Protection Policy (APP) for Windows.

Question 4

You are deploying a line-of-business (LOB) app to iOS devices using Microsoft Intune. The app is signed with an enterprise certificate. Users report that the app installs but crashes immediately on launch. What is the most likely cause?

Accepted Answer

The enterprise developer certificate is not trusted on the device.. The most likely cause is that the enterprise developer certificate is not trusted on the device. iOS requires that enterprise-signed apps have their root certificate manually trusted via a profile (e.g., MDM or manual installation) before the app can run. Without this trust, iOS blocks the app from executing, causing an immediate crash on launch.

Answer

The Intune company portal app is not installed.

Answer

The app is not signed.

Answer

The app requires a VPN connection.

Question 5

Your organization is migrating from on-premises SCCM to Microsoft Intune. You have a Win32 app that requires a custom script to run after installation. The app must be available to users in a remote office with limited internet connectivity. What should you use to deploy the app?

Accepted Answer

Deploy the Win32 app via Intune with Delivery Optimization and peer caching enabled.. Delivery Optimization combined with peer caching allows devices in a remote office with limited internet connectivity to download the Win32 app from other peers on the same local network, reducing WAN bandwidth usage. Intune natively supports Win32 app deployment with this feature, and the custom script can be included as a post-installation detection or requirement script. This approach aligns with the migration from SCCM to Intune while addressing connectivity constraints.

Answer

Configure a cloud management gateway (CMG) to distribute the app.

Answer

Store the app in Azure Files and mount it on devices.

Answer

Use a PowerShell script deployed via Intune to download the app from a local file share.

Question 6

You use Microsoft Intune to manage Android Enterprise fully managed devices. You need to ensure that only work apps can access corporate data. Personal apps should not be able to read work data. What should you configure?

Accepted Answer

Configure an Intune App Protection Policy (APP) targeting the work apps.. Intune App Protection Policies (APP) can be configured to restrict data transfer between managed and unmanaged apps, ensuring that only approved work apps can access corporate data. This policy applies at the app layer, blocking personal apps from reading or copying work data even on fully managed devices, which aligns with the requirement to prevent personal app access to corporate data.

Answer

Configure Conditional Access to block personal apps.

Answer

Enable Android Enterprise work profile on the devices.

Answer

Deploy Windows Information Protection (WIP) policy.

Question 7

Your organization uses Microsoft Intune to manage macOS devices. You need to deploy a custom PKG file that requires administrative privileges to install. The deployment must be silent without user interaction. What should you do?

Accepted Answer

Deploy the PKG as a line-of-business app in Intune and assign it as required.. Intune supports deploying PKG files as line-of-business (LOB) apps on macOS. When you upload the PKG and assign it as 'Required', Intune silently installs it using the macOS Installer framework with administrative privileges, without requiring user interaction. The Intune management agent on the device handles the installation in the system context, ensuring a silent deployment.

Answer

Use a shell script to run the PKG installer with sudo privileges via a launch daemon.

Answer

Add the PKG to Apple Business Manager and distribute via VPP.

Answer

Place the PKG in a network share and instruct users to install via Company Portal.

Question 8

You deploy a Microsoft 365 Apps for enterprise suite via Intune to Windows devices. Users report that updates are not being applied automatically. You need to ensure that updates are installed from the Office Content Delivery Network (CDN) without user intervention. What should you configure?

Accepted Answer

Configure the Office update channel via an Intune administrative template (ADMX).. Configuring the Office update channel via an Intune administrative template (ADMX) directly sets the registry policy that controls which update channel (e.g., Monthly Enterprise) Office 365 Apps use, and by default, those updates are delivered from the Office Content Delivery Network (CDN) without user intervention. This policy ensures updates are applied automatically in the background, meeting the requirement for no user interaction.

Answer

Configure Delivery Optimization to download from peers.

Answer

Enable Windows Update for Business to manage Office updates.

Answer

Use the Office Deployment Tool to set update settings.

Question 9

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy a Microsoft Copilot app that requires users to sign in with their work account. The app must be automatically installed without user interaction. What should you do?

Accepted Answer

Purchase the app through Apple Business Manager and assign it as a required app in Intune.. When you purchase an app through Apple Business Manager (formerly Volume Purchase Program), you can assign it as a required app in Intune. If the iOS/iPadOS device is supervised, the app is installed silently without user interaction. Option A is incorrect because a web clip only creates a shortcut on the home screen and does not install the app. Option B is incorrect because an App Protection Policy controls how data is used within an app, but it does not handle installation. Option C is incorrect because while a line-of-business app can be deployed via Company Portal, the user must manually initiate the installation from the Company Portal app.

Answer

Configure a web clip that links to the app in the App Store.

Answer

Create an Intune App Protection Policy for the app.

Answer

Add the app as a line-of-business app and deploy via Company Portal.

Question 10

You manage a fleet of Windows 10 devices with Microsoft Intune. You need to deploy a Win32 app that has a complex installation requiring multiple command-line parameters. The app must be available to users in the Company Portal. What is the best way to handle the installation parameters?

Accepted Answer

Use the Intune Win32 app packaging to specify the installation command with parameters.. Intune's Win32 app packaging allows you to specify the full installation command, including complex parameters, directly in the 'Install command' field. This method ensures the installer runs with the exact parameters needed, and the app is then published to the Company Portal for user self-service. PowerShell scripts or detection rules do not handle the installation parameters themselves, and administrative templates are for configuring settings, not installation commands.

Answer

Deploy a PowerShell script via Intune that runs the installer with parameters.

Answer

Configure detection rules to run a script that passes parameters.

Answer

Use an administrative template to set parameters before installing.

Question 11

Your organization has devices enrolled in Microsoft Intune that are not domain-joined. You need to deploy a LOB app that requires a license key stored in a file. The app must be installed automatically when devices are enrolled. What should you do?

Accepted Answer

Package the app as a Win32 app and include a script to copy the license file.. Microsoft Intune can deploy Win32 apps with installation scripts that can handle license file copying. Option B is incorrect because Microsoft Store for Business apps do not support custom license files as dependencies. Option C is incorrect because Group Policy requires domain-joined devices and Azure AD Join does not enable Group Policy for app installation in Intune. Option D is incorrect because App Protection Policies are used to manage data protection settings, not to deploy app binaries or license files.

Answer

Use a Microsoft Store for Business app and include the license as a dependency.

Answer

Join devices to Azure AD and use Group Policy to install.

Answer

Create an Intune App Protection Policy to deploy the license.

Question 12

Which TWO of the following are prerequisites for deploying a Win32 app via Microsoft Intune?

Accepted Answer

The app must be packaged using the Microsoft Win32 Content Prep Tool.. The Microsoft Win32 Content Prep Tool is required to package Win32 apps into the .intunewin format that Intune can process. This tool pre-processes the installation files and detection logic, ensuring the app can be uploaded and deployed through the Intune console.

Answer

The device must be running Windows 10 version 1803 or later.

Answer

The device must be Azure AD joined.

Answer

The device must have the Company Portal app installed.

Question 13

Which THREE of the following are valid methods to deploy Microsoft 365 Apps for enterprise using Microsoft Intune?

Accepted Answer

Use the built-in Microsoft 365 Apps app type in Intune.. Intune includes a built-in app type specifically for Microsoft 365 Apps for enterprise. This native integration allows you to configure installation settings (e.g., update channel, excluded apps, and language) directly in the Intune console without needing to create a custom package or script.

Answer

Assign the apps via Azure AD application registration.

Answer

Deploy the MSI version of Office via Intune.

Question 14

Which TWO of the following are benefits of using Microsoft Intune to manage applications on mobile devices?

Accepted Answer

Ability to deploy apps to devices without requiring sideloading.. Microsoft Intune uses the Company Portal app or the Intune app wrapper to deploy line-of-business (LOB) apps directly to devices without requiring users to manually sideload them. This simplifies app distribution by leveraging the MDM channel, which pushes the app package (e.g., .ipa for iOS, .apk for Android) to the device, ensuring it is installed silently or with minimal user interaction. Sideloading typically involves manual installation via USB or enterprise provisioning profiles, which Intune eliminates through its managed deployment capabilities.

Answer

Enforcement of device compliance before app installation.

Answer

Support for user-based licensing only.

Answer

Automatic backup of app data to the cloud.

Question 15

Refer to the exhibit. You deploy this AppLocker policy via Microsoft Intune to Windows 10 devices. The policy is in AuditOnly mode. Users are now able to run unsigned executables. You need to block unsigned executables without affecting signed ones. What should you do?

Accepted Answer

Change the EnforcementMode to 'Enabled' and add a deny rule for unsigned executables.. AppLocker's AuditOnly mode logs events but does not enforce rules. To block unsigned executables, you must change the EnforcementMode to 'Enabled' so that rules are enforced. Adding a deny rule for unsigned executables specifically blocks them while allowing signed executables to run, provided no conflicting allow rules exist. This approach ensures that only unsigned executables are blocked, leaving signed ones unaffected.

Answer

Add a deny rule for all Microsoft signed executables.

Answer

Keep the policy in AuditOnly and rely on Windows Defender to block unsigned apps.

Answer

Delete the existing rule and create a new rule that explicitly allows only specific signed apps.