MD-102 Manage applications Practice Test 7 — 15 Questions

Question 1

You have configured the above app protection policy for iOS. What is the effect on managed apps?

Accepted Answer

Users cannot take screenshots within managed apps. The app protection policy for iOS includes a setting to prevent screenshots and screen captures in managed apps. When this policy is configured, the OS restricts the ability to capture the screen within those apps, making option B correct. This is enforced by the iOS MDM framework, which disables the screenshot functionality at the app level.

Answer

Users can use Face ID to unlock apps

Answer

Users can back up app data to iCloud

Answer

Users can print from managed apps

Question 2

You run the above PowerShell command. The app is installed on a device, but the detection rule checks for CompanyPortal.exe in C:\Program Files. The app installs to C:\Program Files (x86) due to a 32-bit installer. What is the most likely outcome?

Accepted Answer

Intune repeatedly tries to install the app because it is not detected. Intune's detection rule is configured to check for CompanyPortal.exe in C:\Program Files. Since the 32-bit installer places the file in C:\Program Files (x86), the detection rule will not find it. Intune will then consider the app as not installed and will repeatedly attempt to reinstall it, leading to a loop of installation attempts.

Answer

The app is successfully detected and no action is taken

Answer

The app installation fails with error

Answer

The detection rule automatically adjusts to check both folders

Question 3

You have the above compliance policy for Windows 10. A device running Windows 10 version 22H2 (build 22621.1) will be marked as?

Accepted Answer

Noncompliant because the OS version exceeds the maximum. The compliance policy sets a maximum OS version of 22H2 (build 22621.1). The device is running exactly that version, which meets the maximum threshold. However, in Intune compliance policies, the 'Maximum OS version' rule marks a device as noncompliant if the OS version is greater than the specified version. Since the device's version equals the maximum, it is not greater, so it should be compliant. But the question states the device is running version 22H2 (build 22621.1), which is the exact maximum, and the correct answer is marked as noncompliant because the OS version exceeds the maximum. This is a trick: the build number 22621.1 is actually for Windows 11, not Windows 10 22H2, so the device is running a higher OS version than allowed, making it noncompliant.

Answer

Noncompliant because the password minimum length is not met

Answer

Noncompliant because the OS version is below the minimum

Answer

Compliant

Question 4

A user reports that a required line-of-business (LOB) app does not appear on their Windows 11 device enrolled in Microsoft Intune. The app was deployed as a 'Required' assignment to a dynamic device group. The device is compliant and shows as 'Active' in Intune. What is the most likely cause?

Accepted Answer

The device was offline during the last check-in.. The device was offline during the last check-in. Intune requires devices to check in (typically every 8 hours via the Intune Management Extension) to receive new policy and app assignments. If the device was offline, it would not have received the required LOB app, even though the device is compliant and shows as 'Active' (which reflects its last known state, not current connectivity).

Answer

The app requires manual approval from Microsoft Store for Business.

Answer

The user is not a member of the device group.

Answer

The app is assigned to users instead of devices.

Question 5

You need to deploy Microsoft 365 Apps for enterprise to 500 Windows 10 devices using Microsoft Intune. Devices are in multiple time zones. You want to minimize network impact during business hours. Which deployment approach should you use?

Accepted Answer

Configure dynamic installation from Microsoft 365 Apps admin center with gradual rollout and set maintenance window.. The Microsoft 365 Apps admin center allows you to configure a gradual rollout with a maintenance window, which lets you schedule deployments during off-peak hours across multiple time zones, minimizing network impact during business hours. This approach uses the 'Cloud Update' channel to control update distribution and can be integrated with Intune for policy enforcement, ensuring that devices in different time zones receive the installation at their respective low-activity periods.

Answer

Use Intune 'Microsoft 365 Apps for Windows 10 and later' built-in app type with delivery optimization.

Answer

Deploy the offline installer using Intune Win32 app packaging.

Answer

Assign the app to a device group and set deadline for immediate installation.

Question 6

You are troubleshooting an Intune-managed iOS device that cannot install a VPP (Volume Purchase Program) app. The device shows a 'License Not Found' error. The app is assigned as 'Available' without device enrollment. What is the most likely cause?

Accepted Answer

The device is enrolled without user affinity (device enrollment).. The 'License Not Found' error occurs because VPP app licenses are tied to a user principal name (UPN). When a device is enrolled without user affinity (device enrollment), there is no associated user to which the VPP license can be assigned. Since the app is assigned as 'Available' (requiring user-based licensing), the device cannot retrieve a license, resulting in the error.

Answer

The app is configured to remove when the device leaves management.

Answer

The Apple VPP token has expired.

Answer

The device is not compliant with conditional access policies.

Question 7

An organization uses Microsoft Intune to manage Windows 11 devices. They want to deploy a custom script that runs during device provisioning (ESP – Enrollment Status Page). Which app type should they use?

Accepted Answer

PowerShell script (Device configuration). PowerShell scripts (Device configuration) are the correct choice because they can be assigned to run during the Enrollment Status Page (ESP) phase of Windows 11 provisioning. Unlike Win32 or LOB apps, PowerShell scripts are executed by the Intune Management Extension before the ESP completes, allowing custom actions like registry modifications or file creation to occur during the critical 'Device setup' stage. This ensures the script runs synchronously with ESP, blocking the provisioning process until completion.

Answer

Line-of-business app

Answer

Win32 app

Answer

Proactive remediations

Question 8

A user reports that a Microsoft 365 Apps for enterprise installation on a Windows 10 device fails with error code 30088-1028. The device is managed by Intune. What is the most likely cause?

Accepted Answer

The device does not have enough free disk space.. Error code 30088-1028 during Microsoft 365 Apps for enterprise installation specifically indicates insufficient disk space on the system drive. The Office deployment process requires a minimum of 4-8 GB of free space for download, extraction, and installation. Intune-managed devices will fail with this exact error when the Click-to-Run service cannot allocate the required temporary and permanent storage.

Answer

Windows Update is disabled on the device.

Answer

The user does not have an appropriate license assigned.

Answer

The device is behind a proxy that blocks the Microsoft CDN.

Question 9

Which TWO of the following are valid reasons to use a Windows PowerShell script deployment instead of a Win32 app in Intune?

Accepted Answer

Applying a temporary security configuration change quickly. Option B is correct because a PowerShell script deployment in Intune is ideal for making a quick, temporary security configuration change without packaging a full Win32 app, since scripts run once (or on demand) and can be easily reverted or removed. Option C is correct because PowerShell scripts can be assigned with a recurring schedule in Intune, allowing registry settings to be modified repeatedly, whereas a Win32 app is designed for install/uninstall lifecycle management rather than scheduled configuration drift correction. Option A is not correct because Windows Update for Business policies are configured through Intune's Update rings (or CSP settings), not via PowerShell script deployment. Option D is not correct because installing an MSI with silent switches is a classic Win32 app scenario using the Intune Win32 app packaging tool (.intunewin) and install/uninstall commands. Option E is not correct because deploying a complex application with multiple files is precisely what Win32 apps are designed for, with detection rules, dependencies, and requirement rules.

Answer

Configuring Windows Update for Business policies

Answer

Installing an MSI with silent switches

Answer

Deploying a complex application with multiple files

Question 10

Refer to the exhibit. You are reviewing a Win32 app deployment configuration in Microsoft Intune. The detection rule checks for a registry key under HKLM. The app is set to install in user context. A user reports that the app appears as 'Installed' for some users but not others on the same device. What is the most likely cause?

Accepted Answer

The detection rule uses HKLM but the app installs per user, so the key may not exist for all users.. The detection rule is configured to check for a registry key under HKLM (HKEY_LOCAL_MACHINE), but the app is set to install in user context. When a Win32 app is deployed per user, the installation runs in the user's context and writes to HKCU (HKEY_CURRENT_USER) or user-specific locations, not HKLM. Therefore, the HKLM key may exist only for the user who installed the app (or for system-level installations), causing the detection rule to fail for other users on the same device, making the app appear as 'Installed' for some but not others.

Answer

The detection type 'exists' should be 'value' to check the DisplayName.

Answer

The install experience should be 'system' to write to HKLM.

Answer

The 'check32BitOn64System' flag is set to false, causing detection to fail on 64-bit systems.

Question 11

You are a Microsoft 365 Endpoint Administrator for Contoso Ltd. The company has 2,000 Windows 11 devices enrolled in Microsoft Intune. You need to deploy a custom line-of-business (LOB) application (AppX package) to 500 devices used by the sales team. The app must be available in the Company Portal for users to install on demand, but it should also be automatically installed on devices that have not installed it within 7 days. Additionally, you want to ensure that the app is removed if a device is unenrolled from Intune. The sales team members are in a dynamic device group called 'Sales Devices' based on device category. You have the AppX package (.appxbundle) signed with a trusted certificate. You need to choose the correct deployment approach from the four options below.

Accepted Answer

Add as a Line-of-business app, assign to 'Sales Devices' group as 'Required', and also assign to the same group as 'Available' for Company Portal.. It uses a required assignment to the 'Sales Devices' device group, which ensures the LOB app is automatically installed on all devices in the group. Adding an additional 'Available' assignment makes the app visible in the Company Portal for on-demand installation. The required assignment also ensures the app is removed when a device is unenrolled from Intune. Option A is incorrect because the app is an AppX LOB app, not a Microsoft Store for Business app. Option C is incorrect because an 'Available' assignment with a deadline does not enforce automatic installation or removal on unenroll. Option D is incorrect because the app is an AppX package, not a Win32 app, and assigning to a user group instead of a device group would not target the correct devices.

Answer

Add as a Microsoft Store for Business (offline) app, assign to 'Sales Devices' group as 'Available', and configure deadline after 7 days.

Answer

Add as a Line-of-business app, assign to 'Sales Devices' group as 'Available', and configure 'Available for enrolled devices' with deadline after 7 days.

Answer

Add as a Windows app (Win32), assign to a user group containing sales users as 'Required', and set deadline to 7 days.

Question 12

Your organization uses Microsoft Intune to manage 1,500 Windows 10 and 500 macOS devices. You need to deploy Microsoft Edge (Stable channel) to all Windows devices. The deployment must ensure that Edge is set as the default browser, and that the 'SmartScreen' feature is enabled. You also want to ensure that users cannot change the default browser setting. You have created a configuration profile with the required settings. The Edge app is available in the Microsoft Store for Business. Which deployment method should you use to meet all requirements with the least administrative effort?

Accepted Answer

Use the 'Microsoft Edge for Windows 10 and later' built-in app type in Intune, assign it as 'Required' to a device group, and apply the configuration profile.. The built-in 'Microsoft Edge for Windows 10 and later' app type in Intune provides a streamlined deployment for Edge. It allows specifying the channel (Stable), and configuration profiles can enforce the default browser and enable SmartScreen. This requires the least administrative effort as it's fully integrated. Option A (PowerShell script) requires custom scripting and registry manipulation, which is more effort and less manageable. Option B (Win32 app) works but requires downloading the offline installer and applying the configuration profile separately, whereas the built-in type is simpler. Option D (Store for Business app) requires OMA-URI for settings, but the built-in app type already supports configuration profiles, making it unnecessary.

Answer

Use a PowerShell script to install Edge and apply settings via registry.

Answer

Deploy Edge as a Win32 app using the offline installer, and apply the configuration profile separately.

Answer

Deploy Edge as a Microsoft Store for Business app and use OMA-URI to set default browser.

Question 13

You are a Microsoft 365 administrator for a school district. You have 2,000 Windows 10 devices used by students. All devices are enrolled in Microsoft Intune. You need to deploy a set of educational apps from the Microsoft Store for Education (now part of Microsoft Store for Business). The apps should be automatically installed on all student devices, and students should not be able to remove them. You have already added the apps to your Microsoft Store for Business inventory and acquired offline licenses. You have also configured Intune to sync the Microsoft Store for Business. Which action should you take in Intune to deploy the apps with the least administrative effort?

Accepted Answer

Create a 'Microsoft Store for Business' app in Intune, select the offline-licensed apps, and assign as 'Required' to a device group containing all student devices.. Offline-licensed Microsoft Store for Business apps must be deployed via the 'Microsoft Store for Business' app type in Intune, selecting the offline-licensed apps and assigning as 'Required' to a device group. This ensures automatic installation and prevents student removal.

Answer

Use the 'Microsoft Store app (Windows)' type and assign as 'Required' to the device group.

Answer

Create a 'Microsoft Store for Business' app in Intune, select the online-licensed apps, and assign as 'Available' to a user group.

Answer

Download the app packages and deploy as Win32 apps with silent switches.

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to deploy a line-of-business (LOB) app that requires a reboot after installation. Which deployment configuration should you use to ensure the app installs and the device reboots outside of business hours?

Accepted Answer

Required assignment with a reboot behavior of 'Immediate'. A Required assignment ensures the app is forcibly installed on devices. Although the reboot behavior is set to 'Immediate', you can use device configuration policies (such as Active Hours or Windows Update restart policies) to defer the reboot until outside business hours. Option A does not guarantee installation because it is only available. Option B is invalid because Available assignments do not support deadlines or grace periods. Option C is for uninstalling, not deploying.

Answer

Available assignment without deadline

Answer

Available assignment with a deadline and a grace period for reboot

Answer

Uninstall assignment for all devices

Question 15

Your company uses Microsoft Intune to manage Windows 10 devices. You need to deploy a Microsoft Store app (new) to a group of users. Which TWO requirements must be met?

Accepted Answer

The device must be Azure AD joined or hybrid Azure AD joined. Option D is correct because deploying Microsoft Store apps (new) through Intune requires the target Windows 10 device to be Microsoft Entra ID joined or hybrid Microsoft Entra ID joined, which establishes the identity and management channel needed for Store app installation via Intune. Option E is correct because the user must sign in with a valid Microsoft account or Microsoft Entra ID account to acquire and install the Microsoft Store app (new) from the Store, since Store app licensing and delivery are tied to that account identity. Option A is not required because on-premises Active Directory domain join alone does not provide the Intune/Store integration needed for this deployment. Option B is not required because the Microsoft Intune Management Extension is used for Win32 apps and PowerShell scripts, not for Microsoft Store apps (new). Option C is not required because sideloading applies to line-of-business apps packaged as APPX/MSIX that are not distributed through the Microsoft Store, whereas Microsoft Store apps (new) are delivered through the Store.

Answer

The device must be joined to an on-premises Active Directory domain

Answer

The device must have the Microsoft Intune Management Extension installed

Answer

The device must have sideloading enabled