MD-102 Manage applications Practice Test 6 — 15 Questions

Question 1

Your organization uses Intune to manage macOS devices. You need to deploy a .pkg app. What must be done before uploading the app to Intune?

Accepted Answer

Use the Intune App Wrapping Tool for macOS. Pkg apps must be wrapped using the Intune App Wrapping Tool for macOS before uploading to Intune. Option A is incorrect because .pkg apps cannot be uploaded directly; they must be wrapped first. Option B is incorrect because the .intunemac format is the output of the Intune App Wrapping Tool, not a conversion of the package itself. Option D is incorrect because signing is not required before uploading; the Intune App Wrapping Tool handles signing if necessary.

Answer

Nothing, upload the .pkg directly

Answer

Convert the package to .intunemac format

Answer

Sign the package with an Apple Developer certificate

Question 2

You are planning the deployment of Microsoft 365 Apps for enterprise to Windows 10 devices. You need to minimize network bandwidth during installation. Which THREE actions should you take?

Accepted Answer

Use the Office Deployment Tool with a local source. Option A is correct because using the Office Deployment Tool (ODT) with a local source lets you pre-download the installation files once and deploy them from an on-premises share, so clients do not each pull the full payload from the internet. Option C is correct because enabling peer caching for Office 365 Content (via the Office Content Delivery Network, using the ODT property or Group Policy 'Enable Peer Caching') allows clients to share downloaded Office content with each other on the local network, reducing WAN consumption. Option E is correct because express updates for Office deliver only the changed portions of the files rather than the full update payload, substantially lowering update bandwidth. Option B is not correct because BranchCache is a general Windows WAN optimization feature and is not the Office-specific mechanism for reducing Microsoft 365 Apps installation/update traffic in this scenario. Option D is not correct because downloading the full installation files from the internet on every device increases, rather than minimizes, network bandwidth usage.

Answer

Configure BranchCache

Answer

Download the full installation files from the internet

Question 3

Your organization uses Intune to manage iOS devices. You need to deploy a custom configuration for a line-of-business app. Which TWO methods can you use?

Accepted Answer

App Configuration Policy for managed devices. Option A (App Configuration Policy for managed devices) is correct because Intune supports app configuration policies targeted at managed iOS devices, which deliver key/value settings to a line-of-business app via the MDM channel without requiring the app to be rebuilt. Option C (iOS app configuration file in the app package) is correct because an iOS app can embed a default configuration (for example, an .plist or a settings bundle) inside the app package itself, which the app reads at runtime as its built-in configuration. Option B (App Protection Policy) is incorrect because app protection policies enforce data-loss-prevention controls like PIN, encryption, and copy/paste restrictions, not custom app configuration values. Option D (App Configuration Policy for managed apps) is incorrect because that policy type targets managed apps on Android and applies to apps managed via MAM without enrollment, not the iOS managed-device scenario described. Option E (Device Configuration Profile) is incorrect because device configuration profiles configure device-level settings such as Wi-Fi, VPN, and restrictions, not per-app custom configuration for a line-of-business app.

Answer

App Protection Policy

Answer

App Configuration Policy for managed apps

Answer

Device Configuration Profile

Question 4

Refer to the exhibit. You run the PowerShell command on a Windows 10 device to troubleshoot why a Win32 app did not install. What information does this command provide?

Accepted Answer

The start of an app installation attempt. The PowerShell command `Get-MgDeviceManagementManagedDevice -DeviceId <id> | Select-Object -ExpandProperty LastAppInstallStartTime` retrieves the timestamp of the most recent attempt to start installing an app on the managed device. This is useful for troubleshooting because it tells you when the installation process was initiated, helping to determine if the device is receiving the installation trigger from Intune. A correct start time indicates the policy was delivered and the client began processing, even if the installation later failed.

Answer

The list of assigned policies

Answer

The result of a completed app installation

Answer

Errors from the last sync

Question 5

Refer to the exhibit. You see this JSON in an Intune policy for a Windows 10 device. What type of app is being deployed?

Accepted Answer

Microsoft Store app. The JSON includes the key 'productId' with a value like '9WZDNCRFJ3PS', which is a Microsoft Store product identifier. Intune uses this identifier to deploy apps directly from the Microsoft Store for Windows 10 devices, making this a Microsoft Store app deployment. The absence of an installation command line, file path, or URL confirms it is not a Win32, LOB, or web app.

Answer

Win32 app

Answer

Web app

Answer

Line-of-business app

Question 6

Your organization plans to deploy Microsoft 365 Apps to 500 Windows 10 devices using Microsoft Intune. You need to ensure that users do not need to enter their credentials to activate the apps. Which configuration should you use?

Accepted Answer

Deploy Microsoft 365 Apps with user-based activation and ensure devices are Microsoft Entra ID joined. Deploying Microsoft 365 Apps with user-based activation on Microsoft Entra ID joined devices enables seamless single sign-on (SSO) using the user's cloud identity. When the device is Entra ID joined, the user's existing Microsoft Entra ID token is used to automatically activate Microsoft 365 Apps without requiring additional credential prompts, fulfilling the requirement for zero-touch activation.

Answer

Enable device-based activation for Microsoft 365 Apps

Answer

Use a product key and activate via KMS server

Answer

Configure Microsoft 365 Apps for enterprise with shared computer activation

Question 7

You manage Windows 10 devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is not available in the Microsoft Store. The app is an .msi file that requires admin privileges to install. Which deployment method should you use?

Accepted Answer

Use the Microsoft Win32 Content Prep Tool to wrap the .msi into an .intunewin file and deploy as a Win32 app. The correct deployment method is to use the Microsoft Win32 Content Prep Tool to wrap the .msi into an .intunewin file and deploy it as a Win32 app. This is required because Intune's native line-of-business (LOB) app deployment only supports .msi files that install in the user context without elevation, whereas this app requires admin privileges. The Win32 app model allows Intune to run the installer with system context, handle detection rules, and support complex installation logic.

Answer

Upload the .msi file as a line-of-business app directly

Answer

Add the app as a Microsoft Store for Business app

Answer

Deploy the app using a PowerShell script in Intune

Question 8

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy an internal web app as a web clip on users' devices. The app requires users to authenticate with their organization credentials. Which configuration is required to ensure a seamless single sign-on experience?

Accepted Answer

Add the web clip with 'Managed App Configuration' including SSO key. Deploying the web clip with 'Managed App Configuration' including an SSO key allows Intune to inject authentication tokens into the web clip, enabling seamless single sign-on (SSO) without requiring the user to re-enter credentials. This leverages the Microsoft Enterprise SSO plug-in or a custom SSO configuration to automatically authenticate against the internal web app using the user's organization credentials.

Answer

Enable 'Use managed browser' in the app assignment

Answer

Deploy a VPN configuration that forces traffic through the corporate network

Answer

Configure the web clip with 'Full screen' option enabled

Question 9

You need to deploy a custom Win32 app to Windows 10 devices. The app installation is silent and requires a reboot. You set the installation behavior to 'system' and the device restart behavior to 'Allow'. After deployment, users report that the app is installed but not working properly. What is the most likely cause?

Accepted Answer

The device was not restarted after installation. When the device restart behavior is set to 'Allow', Intune will request a reboot but does not force it; the user can postpone or ignore the prompt. If the app requires a reboot to complete its installation or initialize properly, skipping the restart leaves the app in a partially installed state, causing it to appear installed but malfunction. This is the most likely reason the app is not working correctly after deployment.

Answer

The app requires user interaction to complete setup

Answer

The detection rule is misconfigured

Answer

The app was not wrapped correctly with the Intune Win32 Content Prep Tool

Question 10

Your organization uses Microsoft Intune to manage Android enterprise devices. You need to ensure that only approved apps from the managed Google Play store can be installed on work profiles. Which configuration should you use?

Accepted Answer

Configure a device compliance policy that requires 'Allow installation from unknown sources' to be disabled. A device compliance policy that requires 'Allow installation from unknown sources' to be disabled ensures that only apps from the managed Google Play store can be installed on Android Enterprise work profiles. This setting prevents side-loading of apps from untrusted sources, which is the primary mechanism to enforce app approval in a managed environment. Intune compliance policies evaluate this setting and can trigger conditional access or mark devices as non-compliant if unknown sources are enabled.

Answer

Use a conditional access policy to block unapproved apps

Answer

Create an app configuration policy that blocks side-loading

Answer

Assign a device restriction policy that sets 'Allow all apps' to false

Question 11

You are troubleshooting an app deployment issue. A Win32 app fails to install on some Windows 10 devices. The Intune management extension logs show error code 0x80070643. What is the most likely cause?

Accepted Answer

A pending reboot from a previous installation is blocking the install. Error code 0x80070643 translates to 'ERROR_INSTALL_FAILURE' and is commonly associated with a pending reboot that blocks the installation of a Win32 app via Intune. The Intune Management Extension checks for pending reboot status before executing app installations; if a reboot is required, the installation fails with this error to prevent system instability.

Answer

The app package is corrupted

Answer

The device does not meet the minimum OS version requirement

Answer

The user does not have admin privileges

Question 12

You need to deploy Microsoft Edge for Business to Windows 10 devices using Microsoft Intune. Which app type should you select in the Intune portal?

Accepted Answer

Built-in app. The 'Built-in app' type in Microsoft Intune is specifically designed for deploying pre-packaged Microsoft applications, including Microsoft Edge for Business. This option automatically handles the installation and configuration of Edge without requiring manual packaging or complex deployment rules, making it the correct choice for this scenario.

Answer

Web link

Answer

Windows app (Win32)

Answer

Microsoft 365 Apps

Question 13

Which TWO are prerequisites for deploying Win32 apps via Microsoft Intune?

Accepted Answer

The Intune management extension must be installed on devices. Option A is correct because Win32 app deployment in Intune relies on the Intune Management Extension (IME) agent, which is automatically installed on Windows devices when a Win32 app or PowerShell script is assigned; the IME is what actually downloads, executes, and reports on the .intunewin package. Option C is correct because devices must be Microsoft Entra ID joined (or hybrid Microsoft Entra ID/Entra joined) so they can enroll into Intune and receive the management channel and policies required for Win32 app delivery. Option B is wrong because Win32 apps are packaged with the Microsoft Win32 Content Prep Tool into .intunewin format and do not require a Microsoft-issued signing certificate. Option D is wrong because there is no 4 GB RAM prerequisite for Win32 app deployment. Option E is wrong because user affinity is optional; Win32 apps can be deployed to devices without user affinity (for example, device-targeted or self-deploying scenarios).

Answer

The app must be signed with a Microsoft certificate

Answer

Devices must have at least 4 GB of RAM

Answer

Devices must be enrolled with user affinity

Question 14

Which THREE are valid methods to deploy an app as available for users in Microsoft Intune?

Accepted Answer

Assign the app to a user group with the 'Required' setting. Option C is correct because assigning an app to a user group with the 'Required' intent makes it mandatory and automatically installed for those users, which is a valid deployment method in Intune. Option D is correct because assigning an app to a user group with the 'Available' intent publishes it in the Company Portal for users to install on demand. Option E is correct because the 'Available for enrolled devices' intent assigns an app to a user group but makes it available only on enrolled devices, which is a supported deployment method. Option A is not correct because 'Available' is a user-centric intent; assigning it to a device group is not a valid Intune app assignment method. Option B is not correct because featuring an app in the Company Portal without an assignment does not make it available to users; an assignment is required.

Answer

Assign the app to a device group with the 'Available' setting

Answer

Add the app to the Company Portal as a featured app without assignment

Question 15

Which TWO app types can be deployed to iOS/iPadOS devices using Microsoft Intune?

Accepted Answer

iOS LOB app. Option B (iOS LOB app) is correct because Intune supports deploying line-of-business apps for iOS/iPadOS, typically as .ipa files or app packages uploaded to Intune and assigned to enrolled devices. Option D (iOS store app) is also correct because Intune can deploy apps from the Apple App Store to iOS/iPadOS devices by selecting the app and assigning it to users or devices. Option A (Web link) is not one of the two iOS/iPadOS app types in this context, as web links are a separate app type used to pin a URL rather than deploy an iOS app package. Option C (Win32 app) is incorrect because Win32 apps are deployed to Windows devices, not iOS/iPadOS. Option E (Android store app) is incorrect because Android store apps target Android devices, not iOS/iPadOS.

Answer

Web link

Answer

Win32 app

Answer

Android store app