MD-102 Manage applications Practice Test 9 — 15 Questions

Question 1

A user reports that Microsoft 365 Apps for enterprise is not installing on their Windows 10 device. The app is assigned as 'Available' to the user group. What must the user do to trigger the installation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Open the Company Portal app and install from there. Available app installs require user interaction via the Company Portal. Option A is wrong because the app is not required. Option C is wrong because the user can initiate install anytime. Option D is wrong because no restart is needed before install.

Answer

Wait for the next device sync

Answer

Restart the device

Answer

Log off and log back in

Question 2

Your organization plans to deploy a Win32 app to Windows 10 devices using Intune. The app requires the .NET Framework 4.8, which is not present on all devices. How should you handle this dependency?

Accepted Answer

Add a dependency in Intune for the .NET Framework. Intune's dependency feature allows you to specify another app (like .NET Framework 4.8) that must be installed before the Win32 app. Intune automatically installs the dependency app from the same Intune management extension context, ensuring the required runtime is present without manual scripting or bundling. This is the native, supported method for handling prerequisites in Win32 app deployment.

Answer

Include the .NET installer in the same package

Answer

Use a PowerShell script to install .NET before the app

Answer

Configure a detection rule for .NET

Question 3

You need to deploy a web app to Android Enterprise work profile devices. The app is available in the Managed Google Play store. How should you make it available in Intune?

Accepted Answer

Add the app from Managed Google Play in Intune. When a web app is available in the Managed Google Play store, the proper method to make it available in Intune is to add it directly from the Managed Google Play console within the Intune admin center. This synchronizes the app's metadata and licensing with Intune, allowing you to assign it as Required or Available for Android Enterprise work profile devices without needing to upload an APK.

Answer

Upload the APK file to Intune

Answer

Direct users to Google Play to install

Answer

Sync device groups with Google Play

Question 4

Your organization uses Microsoft Defender for Endpoint. You need to ensure that all Windows devices have the Defender Antivirus platform update installed. Which Intune app type should you use?

Accepted Answer

Microsoft Defender for Endpoint app type. The Microsoft Defender for Endpoint app type in Intune is specifically designed to manage and deploy Defender platform updates, including the antivirus platform update, to Windows devices. This app type ensures that the Defender components are kept up to date through Intune's integration with the Microsoft Defender for Endpoint service, providing a streamlined update mechanism that other app types do not offer.

Answer

Windows app (Win32)

Answer

Microsoft 365 Apps for enterprise

Answer

Line-of-business app

Question 5

You assign a required app to a device group. After the next sync, some devices report a 'Failed' status. What should you check first?

Accepted Answer

The device management log. The device management log (also known as the Intune management extension log or the MDM agent log on the device) provides detailed, real-time error codes and failure reasons for app installation attempts. When a required app shows 'Failed' status after sync, this log is the first place to check because it captures the exact cause—such as a download failure, dependency issue, or script execution error—that the Intune console cannot surface in summary views.

Answer

The device's last sync time

Answer

If a newer version is already installed

Answer

Whether the user is licensed

Question 6

You are deploying a managed Google Play app to Android Enterprise fully managed devices. The app is not appearing in the work profile. What is the most likely reason?

Accepted Answer

The app is not approved in Managed Google Play. The most likely reason the app is not appearing is that it has not been approved in Managed Google Play. For Android Enterprise fully managed devices, apps must be approved in the Managed Google Play console before they can be deployed via Intune. Option B is incorrect because the work profile is not relevant for fully managed devices; they are corporate-owned and do not use work profiles. Option C is incorrect because the device must be enrolled in Intune, but if it is enrolled and the app is missing, lack of enrollment is not the most likely reason. Option D is incorrect because fully managed devices are associated with a managed Google account via the enrollment token, not a personal Google account.

Answer

The work profile is not enabled

Answer

The device is not enrolled in Intune

Answer

The device is not associated with a Google account

Question 7

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate applications. Which TWO configurations should you implement?

Accepted Answer

Create a device compliance policy. A device compliance policy defines the security requirements (e.g., encryption, OS version, jailbreak detection) that a device must meet to be considered compliant. Option E is correct because a Conditional Access policy can enforce that only compliant devices are granted access to corporate applications, using the 'Require device to be marked as compliant' grant control. Together, these two configurations ensure that non-compliant devices are blocked from accessing corporate apps.

Answer

Deploy an App Protection Policy

Answer

Configure a device configuration profile

Answer

Enable multifactor authentication (MFA) for all users

Question 8

You are planning the deployment of Microsoft 365 Apps for enterprise to Windows 10 devices. You need to minimize network bandwidth during installation. Which THREE actions should you take?

Accepted Answer

Use the Office Deployment Tool with a local source. The Office Deployment Tool (ODT) can be configured with a local source path (SourcePath attribute in configuration.xml) to store installation files on a network share or local cache. This eliminates repeated downloads from the internet for each client, significantly reducing WAN bandwidth usage during deployment.

Answer

Configure BranchCache

Answer

Download the full installation files from the internet

Question 9

Your organization uses Intune to manage iOS devices. You need to deploy a custom configuration for a line-of-business app. Which TWO methods can you use?

Accepted Answer

App Configuration Policy for managed devices. App Configuration Policies for managed devices allow you to supply custom configuration settings (e.g., JSON or XML key-value pairs) to an iOS line-of-business app when the device is enrolled in Intune MDM. Option C is correct because you can embed a configuration file (e.g., a .plist) directly within the iOS app package, which the app reads at launch without requiring a separate policy push.

Answer

App Protection Policy

Answer

App Configuration Policy for managed apps

Answer

Device Configuration Profile

Question 10

Refer to the exhibit. An Intune administrator configured a Win32 app with the settings shown. What is the expected behavior when the app installation exits with return code 3010?

Accepted Answer

The device may restart after installation outside of active hours. Return code 3010 is a standard Windows Installer code indicating a reboot is required. In Intune, a Win32 app that exits with 3010 is treated as a successful installation, but the device may be restarted outside of active hours to apply changes. This behavior aligns with the 'Device restart behavior' setting configured in the app's properties, which defers the restart to a maintenance window.

Answer

The device restarts immediately

Answer

The installation is marked as failed

Answer

The app is not installed

Question 11

Refer to the exhibit. You run the PowerShell command on a Windows 10 device to troubleshoot why a Win32 app did not install. What information does this command provide?

Accepted Answer

The start of an app installation attempt. The PowerShell command `Get-MgDeviceManagementManagedDevice -DeviceId <id> | Select-Object -ExpandProperty LastAppInstallStartTime` retrieves the timestamp of the most recent attempt to start installing an app on the managed device. This is useful for troubleshooting because it tells you when the installation process was initiated, helping to determine if the device is receiving the installation trigger from Intune. A correct start time indicates the policy was delivered and the client began processing, even if the installation later failed.

Answer

The list of assigned policies

Answer

The result of a completed app installation

Answer

Errors from the last sync

Question 12

Refer to the exhibit. You see this JSON in an Intune policy for a Windows 10 device. What type of app is being deployed?

Accepted Answer

Microsoft Store app. The JSON includes the key 'productId' with a value like '9WZDNCRFJ3PS', which is a Microsoft Store product identifier. Intune uses this identifier to deploy apps directly from the Microsoft Store for Windows 10 devices, making this a Microsoft Store app deployment. The absence of an installation command line, file path, or URL confirms it is not a Win32, LOB, or web app.

Answer

Win32 app

Answer

Web app

Answer

Line-of-business app

Question 13

Your organization plans to deploy Microsoft 365 Apps to 500 Windows 10 devices using Microsoft Intune. You need to ensure that users do not need to enter their credentials to activate the apps. Which configuration should you use?

Accepted Answer

Deploy Microsoft 365 Apps with user-based activation and ensure devices are Microsoft Entra ID joined. Deploying Microsoft 365 Apps with user-based activation on Microsoft Entra ID joined devices enables seamless single sign-on (SSO) using the user's cloud identity. When the device is Entra ID joined, the user's existing Microsoft Entra ID token is used to automatically activate Microsoft 365 Apps without requiring additional credential prompts, fulfilling the requirement for zero-touch activation.

Answer

Enable device-based activation for Microsoft 365 Apps

Answer

Use a product key and activate via KMS server

Answer

Configure Microsoft 365 Apps for enterprise with shared computer activation

Question 14

You manage Windows 10 devices with Microsoft Intune. You need to deploy a line-of-business (LOB) app that is not available in the Microsoft Store. The app is an .msi file that requires admin privileges to install. Which deployment method should you use?

Accepted Answer

Use the Microsoft Win32 Content Prep Tool to wrap the .msi into an .intunewin file and deploy as a Win32 app. The correct deployment method is to use the Microsoft Win32 Content Prep Tool to wrap the .msi into an .intunewin file and deploy it as a Win32 app. This is required because Intune's native line-of-business (LOB) app deployment only supports .msi files that install in the user context without elevation, whereas this app requires admin privileges. The Win32 app model allows Intune to run the installer with system context, handle detection rules, and support complex installation logic.

Answer

Upload the .msi file as a line-of-business app directly

Answer

Add the app as a Microsoft Store for Business app

Answer

Deploy the app using a PowerShell script in Intune

Question 15

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to deploy an internal web app as a web clip on users' devices. The app requires users to authenticate with their organization credentials. Which configuration is required to ensure a seamless single sign-on experience?

Accepted Answer

Add the web clip with 'Managed App Configuration' including SSO key. Deploying the web clip with 'Managed App Configuration' including an SSO key allows Intune to inject authentication tokens into the web clip, enabling seamless single sign-on (SSO) without requiring the user to re-enter credentials. This leverages the Microsoft Enterprise SSO plug-in or a custom SSO configuration to automatically authenticate against the internal web app using the user's organization credentials.

Answer

Enable 'Use managed browser' in the app assignment

Answer

Deploy a VPN configuration that forces traffic through the corporate network

Answer

Configure the web clip with 'Full screen' option enabled