MD-102 Manage applications Practice Test 9 — 15 Questions

Question 1

You are an endpoint administrator for Contoso, which uses Microsoft Intune to manage Windows 11 devices. The security team requires that Microsoft Edge be configured with a specific set of security baselines and extensions on all managed devices. You need to deploy Microsoft Edge to all devices and ensure the settings are applied automatically. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the Microsoft Edge app from the Microsoft Intune app catalog, and configure the desired settings using the Microsoft Edge settings in Intune.. The Microsoft Edge app in Intune is purpose-built for enterprise deployment and includes native settings management for security baselines and extensions. This method ensures that Edge is installed and configured automatically on all targeted devices, satisfying the security team's requirements without custom packaging or scripting.

Answer

Create a configuration profile with the Edge settings, and deploy it to all devices; Edge will be installed automatically when the profile is applied.

Answer

Deploy Microsoft Edge as a Win32 app using the Microsoft Win32 Content Prep Tool, and include a PowerShell script to configure the settings.

Answer

Assign the Microsoft Edge (Windows) app from the Microsoft Store (new) to all devices, and configure the settings via a PowerShell script.

Question 2

A company uses Microsoft Intune to manage Windows 11 devices. The IT team needs to deploy a Win32 app that installs per-user, not per-system. The app must install only when the user is logged on and must be removed when the user signs out. What should you configure in the Intune app deployment?

Accepted Answer

Set the install behavior to User in the app configuration.. The install behavior setting in Intune Win32 app properties controls the installation context. Selecting User ensures the app installs only when the user is logged on and runs in the user's context, which matches the requirement. System context would install for all users and not remove on sign-out. Other options do not change the fundamental installation context.

Answer

Configure the app to run as a scheduled task using PowerShell.

Answer

Deploy the app as a required app with a PowerShell script that checks for user logon.

Answer

Set the app to install in system context and add a detection rule for the user's profile.

Question 3

You are an Endpoint Administrator at a company that uses Microsoft Intune to manage Windows 11 devices. The security team requires that Microsoft Edge on all managed devices must be configured to block users from signing in with a personal Microsoft account, and the setting must be enforced even if a user reinstalls the browser. You need to apply this configuration with the least administrative effort while keeping it separate from device compliance policies. What should you configure?

Accepted Answer

Create a Settings catalog policy in Intune, add the Microsoft Edge category, configure the 'Block sign-in with a personal Microsoft account' setting, and assign it to the device group.. The Settings catalog is the modern, CSP-backed way to configure Microsoft Edge on Windows in Intune, and a device-assigned configuration policy reapplies the setting whenever the browser starts, so reinstalling Edge does not remove the restriction. Scripts run one time and compliance policies only evaluate state, so neither enforces browser configuration continuously.

Answer

Configure an app configuration policy for Microsoft Edge and assign it to the All Users group in Intune.

Answer

Deploy a PowerShell script through Intune that writes the appropriate registry value to HKLM under the Edge policies key on each device.

Answer

Create a device compliance policy that adds a custom setting requiring the Edge sign-in restriction, and assign it to the device group.

Question 4

You are an endpoint administrator for a company that uses Microsoft Intune to manage Windows 11 devices. The company has a line-of-business (LOB) app that must be installed on all devices in the Sales department. The app is a .msi file that requires no user interaction. You need to deploy this app using Intune. What should you do?

Accepted Answer

Upload the .msi file as a Win32 app using the Microsoft Win32 Content Prep Tool, then assign it as required to the Sales department.. The Microsoft Win32 Content Prep Tool is required to package .msi installers into .intunewin format for Intune Win32 app deployment. Once packaged, the app can be assigned as required to a group, ensuring it installs automatically on all targeted devices. This approach supports silent installation, detection rules, and detailed reporting, making it the correct method for deploying a line-of-business .msi app.

Answer

Use a PowerShell script to install the .msi file and deploy it as a platform script assigned to the Sales department.

Answer

Upload the .msi file as a Windows app (Win32) directly without using the Content Prep Tool and assign it to the Sales department.

Answer

Upload the .msi file as a Microsoft Store app (new) and assign it as required to the Sales department.

Question 5

You manage Android Enterprise fully managed devices with Microsoft Intune. You deploy a required managed Google Play app to a device group. After deployment, users report that the app is not installed. You verify that the app is assigned correctly. What is the most likely reason?

Accepted Answer

The app is not approved in the Managed Google Play store.. For managed Google Play apps to be deployed, they must be approved in the Managed Google Play store for the organization. If the app is not approved, it cannot be assigned or installed, even if it appears in the Intune console. This is a common configuration step that is often missed.

Answer

The device is not enrolled as a fully managed device.

Answer

The app requires a configuration policy to be applied before installation.

Answer

The device has not synced with Intune recently.

Question 6

You use Microsoft Intune to manage Windows 11 devices. You deploy a Microsoft Store app (new) as Required to a group of users. The app fails to install on devices that are joined to Microsoft Entra ID but not hybrid-joined. You need to ensure the app installs successfully. What should you configure first?

Accepted Answer

Configure the app to install in system context and assign it to a device group.. Microsoft Store apps (new) deployed as Required in Intune must be assigned to a device group and configured to install in system context. Assigning to a user group can cause installation failures on Microsoft Entra joined devices because the app installation runs in the user context and may not have the necessary permissions. Device group assignment with system context ensures the app installs correctly.

Answer

Configure the device to allow the Microsoft Store and ensure the Intune Management Extension is installed.

Answer

Assign the app as Available to the users and instruct them to install it from the Company Portal.

Answer

Ensure the app is assigned to a user group and that the device has the required Microsoft Store for Business or Store app prerequisites.

Question 7

You manage a fleet of Windows 11 devices with Microsoft Intune. A line-of-business MSI application must be installed only on devices in the Finance department, and the vendor requires that the installer run with SYSTEM privileges and include a custom detection rule based on a registry value that the installer writes. You need to deploy the app with the minimum number of steps. What should you do first?

Accepted Answer

Wrap the MSI with the Microsoft Win32 Content Prep Tool to produce an .intunewin file, then create a Windows app (Win32) in Intune.. A vendor MSI that requires SYSTEM context and a custom detection rule must be packaged as a Windows app (Win32) using the Microsoft Win32 Content Prep Tool, because only that app type supports .intunewin packaging, system-context installation, and registry-based detection rules in a single deployment.

Answer

Deploy the MSI as a Windows app (MSI) in Intune and configure a custom detection rule on the app's properties page.

Answer

Create a PowerShell script in Intune that runs msiexec with the silent flags and assign it to the Finance device group.

Answer

Upload the MSI directly as a Windows app (Win32) in Intune and specify the registry detection rule during the app creation wizard.

Question 8

You are deploying a Win32 app that requires a specific version of the .NET Framework. The app will be installed on Windows 10 and Windows 11 devices managed by Intune. You need to ensure the .NET Framework prerequisite is met before the app installs. What should you do?

Accepted Answer

Add a detection rule that checks for the .NET Framework version and configure the app to install it as part of the installation command.. To ensure the .NET Framework prerequisite is met, you can package the .NET Framework installer with the app and include it in the install command. A detection rule for the .NET Framework version verifies that it is installed. This method ensures the prerequisite is handled before the app installation completes, and Intune reports success only when both are present.

Answer

Add the .NET Framework installer as a dependency to the Win32 app.

Answer

Use a PowerShell script to install the .NET Framework before deploying the app.

Answer

Create a requirement rule that checks for the .NET Framework version.

Question 9

You are an endpoint administrator using Microsoft Intune to manage Windows devices. You need to deploy a new Win32 app that must be installed only when a specific registry key exists, and the app must be removed automatically if the key disappears. Which two actions must you perform when configuring the app? (Choose two.)

Accepted Answer

Configure the app to uninstall when the detection rule fails.. Detection rules determine installed state, and uninstall behavior allows Intune to remove an app when detection fails. Together, a registry-based detection rule plus uninstall-on-detection-failure ensures the app is present only while the registry key exists and is removed when the key is gone. Requirement rules and silent switches do not provide this conditional lifecycle control.

Answer

Set the install command to include the /qn silent switch.

Answer

Assign the app as available to all users.

Answer

Add the registry key as a requirement rule.

Question 10

You are deploying a Win32 app using Microsoft Intune. The app requires a specific registry key to be present for it to function correctly. You need to include a requirement rule that checks for this registry key. Which two actions must you perform when creating the app? (Choose two.)

Accepted Answer

Package the app using the Microsoft Win32 Content Prep Tool.. To ensure the Win32 app is only installed on devices with the required registry key, you must first package the app using the Microsoft Win32 Content Prep Tool, which is a prerequisite for any Win32 app deployment. Then, when configuring the app in Intune, you add a requirement rule that checks for the registry key. These two actions ensure the app is correctly packaged and that the prerequisite is enforced before installation.

Answer

Configure a detection rule that checks for the registry key.

Answer

Add a dependency to another app that creates the registry key.

Answer

Assign the app as required to a device group.

Question 11

You manage a fleet of Windows 11 Enterprise devices with Microsoft Intune. The security team requires that Microsoft Edge be configured so that users cannot sign in with a personal Microsoft account, and the setting must apply automatically without user interaction. You need to deploy this configuration to all devices. What should you create in Intune?

Accepted Answer

A Settings catalog policy for Microsoft Edge. Edge browser restrictions on Windows are enforced through the Settings catalog, which surfaces the full Edge policy set as Intune settings. Assigning the policy to the device group ensures the setting applies automatically. App configuration policies are for mobile apps, compliance policies only assess state, and attack surface reduction policies target Defender features, so none of those deliver the required Edge configuration.

Answer

A Windows 10/11 custom compliance policy

Answer

An Endpoint security attack surface reduction policy

Answer

An app configuration policy for Microsoft Edge

Question 12

You use Microsoft Intune to manage Android Enterprise personally owned work profile devices. You deploy a required managed Google Play app to a user group. The app installs successfully, but users report they can also install the same app from the personal Google Play Store into their personal profile. You need to prevent installation of that app in the personal profile. What should you configure?

Accepted Answer

An app configuration policy for the managed Google Play app.. For Android Enterprise work profile devices, Intune supports app configuration policies for managed Google Play apps that include an option to prevent the app from being installed in the personal profile. Configuring this setting on the app's configuration policy blocks users from installing the same app from the personal Google Play Store, satisfying the requirement while still delivering the app in the work profile.

Answer

A device restrictions configuration profile that blocks the personal Google Play Store.

Answer

A device compliance policy that marks devices with the app in the personal profile as noncompliant.

Answer

An app protection policy assigned to the user group.

Question 13

You use Microsoft Intune to manage Windows 10 devices. You need to deploy a Win32 app that requires the Microsoft Edge WebView2 Runtime as a dependency. The WebView2 Runtime is already installed on some devices but not on others. You must ensure the app installs only on devices that have the WebView2 Runtime, and that the runtime is installed automatically if missing. Which two actions should you perform? (Choose two.)

Accepted Answer

Deploy the WebView2 Runtime as a separate Win32 app and assign it as Required to the same device group.. Intune Win32 apps support dependencies, which are other Win32 apps that must be installed before the main app. By adding the WebView2 Runtime as a dependency and also deploying it as a Required app, you ensure it is installed automatically on devices that lack it. This satisfies the requirement that the app installs only after the runtime is present.

Answer

Configure a requirement rule that checks for the WebView2 Runtime registry key.

Answer

Create a detection rule for the main app that checks for the WebView2 Runtime installation folder.

Answer

Add a PowerShell script to the main app's package that installs the WebView2 Runtime before the app installs.

Question 14

You manage a fleet of Windows 11 Enterprise devices with Microsoft Intune. The security team requires that Microsoft Edge be configured with a specific set of enterprise site list entries and that the browser be prevented from running outdated versions. You need to deploy this configuration with the least administrative effort while ensuring the settings apply automatically to all targeted devices. What should you do?

Accepted Answer

Create an Intune settings catalog policy that configures the Microsoft Edge security baselines and version restrictions, and assign it to the device group.. The settings catalog is the recommended modern way to configure Microsoft Edge policies on Intune-managed Windows devices because it surfaces the ADMX-backed settings natively and applies them through the MDM channel. Device-targeted assignment guarantees coverage regardless of who signs in. The other approaches either rely on unsupported or high-maintenance mechanisms, or they fail to enforce the version restriction requirement.

Answer

Deploy a Win32 app that runs a PowerShell script to write the required registry keys to each device.

Answer

Create an Intune app configuration policy for Microsoft Edge and assign it to the device group.

Answer

Publish a custom OMA-URI configuration profile for each Edge setting and assign it to the user group.

Question 15

You manage a set of Windows 11 devices with Microsoft Intune. A line-of-business Win32 app was deployed to a device group as Required, and the app installed successfully, but a new version must now reach those devices without any user interaction. The new package has a higher version number and the app's detection rule matches the newly installed version. What should you do?

Accepted Answer

Open the existing Win32 app, select App package file, upload the new .intunewin file, and save; Intune re-evaluates the detection rule and installs the higher version.. The correct action is to update the existing Win32 app by uploading the new .intunewin package. This preserves assignments, install and uninstall commands, requirement rules, and detection logic, so targeted devices silently reinstall the higher version when the detection rule no longer matches. Introducing a second app or changing the assignment intent breaks the silent-upgrade requirement.

Answer

Delete the existing app assignment and re-add the same group with an Available intent so users can trigger the upgrade themselves.

Answer

Edit the detection rule to require a registry value that only the new version writes, then wait for the next Intune sync cycle.

Answer

Create a new Win32 app entry with the same install and uninstall commands, then assign it to the same group as Required.