CCNA Md102 Manage Applications Questions — Page 3 of 3

151

MCQmedium

You have configured the above app protection policy for iOS. What is the effect on managed apps?

A.Users can use Face ID to unlock apps

B.Users cannot take screenshots within managed apps

C.Users can back up app data to iCloud

D.Users can print from managed apps

AnswerB

Screen capture is blocked.

Why this answer

The app protection policy for iOS includes a setting to prevent screenshots and screen captures in managed apps. When this policy is configured, the OS restricts the ability to capture the screen within those apps, making option B correct. This is enforced by the iOS MDM framework, which disables the screenshot functionality at the app level.

Exam trap

The trap here is that candidates often confuse the screenshot prevention setting with other common app protection policies like PIN/biometric requirements or data transfer restrictions, leading them to select options A, C, or D incorrectly.

How to eliminate wrong answers

Option A is wrong because Face ID unlock is controlled by a separate policy setting ('Require PIN for access' or 'Use biometrics'), not by the screenshot prevention setting. Option C is wrong because backing up app data to iCloud is blocked by the 'Prevent backup' policy setting, which is independent of screenshot controls. Option D is wrong because printing from managed apps is governed by the 'Restrict cut, copy, and paste' or 'Allow printing' policy settings, not by the screenshot prevention configuration.

Practice this question →

152

MCQeasy

Your organization plans to deploy Microsoft 365 Apps to 500 Windows 10 devices using Microsoft Intune. You need to ensure that users do not need to enter their credentials to activate the apps. Which configuration should you use?

A.Enable device-based activation for Microsoft 365 Apps

B.Use a product key and activate via KMS server

C.Deploy Microsoft 365 Apps with user-based activation and ensure devices are Microsoft Entra ID joined

D.Configure Microsoft 365 Apps for enterprise with shared computer activation

AnswerC

User-based activation with Microsoft Entra ID provides single sign-on.

Why this answer

Deploying Microsoft 365 Apps with user-based activation on Microsoft Entra ID joined devices enables seamless single sign-on (SSO) using the user's cloud identity. When the device is Entra ID joined, the user's existing Microsoft Entra ID token is used to automatically activate Microsoft 365 Apps without requiring additional credential prompts, fulfilling the requirement for zero-touch activation.

Exam trap

The trap here is that candidates often confuse device-based activation (Option A) with user-based activation on Entra ID joined devices, mistakenly thinking device-based activation eliminates credential prompts, when in fact it requires a specific subscription and is not supported in Intune deployments.

How to eliminate wrong answers

Option A is wrong because device-based activation for Microsoft 365 Apps is not supported in Intune; it requires a subscription activation model that is only available with Windows 10/11 Enterprise E3/E5 or Microsoft 365 F3 subscriptions and is configured via Group Policy, not Intune. Option B is wrong because using a product key and KMS server is a volume activation method for on-premises environments, not for cloud-based Microsoft 365 Apps activation, and it still requires user credentials or a KMS client key, not eliminating credential entry. Option D is wrong because shared computer activation is designed for RDS or VDI environments where multiple users access the same device; it does not eliminate credential prompts for individual users on a dedicated Windows 10 device and requires user sign-in to activate.

Practice this question →

153

MCQmedium

An Android device running OS version 9.0 with app version 1.5.0 is targeted by the app protection policy in the exhibit. What is the expected behavior when the user tries to access work data?

A.Access is blocked because the OS version is below the warning level

B.Access is allowed with a warning to update the app and OS

C.Access is allowed without any warning because minimum requirements are met

D.Access is blocked because the app version is below the warning level

AnswerC

Correct. The device satisfies minimum requirements and is not at the warning level, so access is granted without warning.

Why this answer

The device meets the minimum OS and app version requirements, and the versions are not at the warning threshold configured in the policy. Therefore, access is allowed without any warning.

Exam trap

Candidates may confuse the warning level with the block level or assume that meeting minimums always results in no warning, but here the warning level is higher than the device's versions.

How to eliminate wrong answers

Option A is wrong because the OS version 9.0 is not below the warning level (8.0) — it is above it, so access is not blocked for OS version. Option C is wrong because while access is allowed, the statement 'without any warning because minimum requirements are met' is partially correct, but the question expects the behavior when the user tries to access work data — the policy allows access with a warning only if the app or OS is below the warning level but above the minimum; here both are above warning levels, so no warning is shown, making C technically correct but the exam answer is B because the exhibit likely shows the app version is below the warning level (1.5.0 vs 1.4.0 warning) — wait, re-evaluating: if app version 1.5.0 is above warning 1.4.0, no warning. The trap is that the exhibit might show the warning level for OS as 8.0 and app as 1.4.0, but the device OS 9.0 is above warning, app 1.5.0 is above warning, so no warning.

Option D is wrong because the app version 1.5.0 is not below the warning level (1.4.0) — it is above, so access is not blocked for app version.

Practice this question →

154

Multi-Selecthard

An administrator uses Intune to deploy a line-of-business (LOB) app for Android. The app is failing to install on some devices. The administrator reviews the Intune management extension logs and sees error 'Device not compliant with app configuration policy'. Which THREE conditions could cause this error?

Select 3 answers

A.The device is not enrolled in Android Enterprise work profile

B.The device is a personally owned device with work profile when the app requires fully managed device

C.The app was previously installed and then uninstalled

D.The Company Portal app is not installed on the device

E.The device's Android version is below the minimum required by the app

AnswersA, B, E

App configuration policies often require work profile enrollment.

Why this answer

The 'Device not compliant with app configuration policy' error occurs when an Android Enterprise work profile is required for the app's deployment but the device lacks this enrollment. Intune uses app configuration policies to enforce settings like work profile enrollment; if the device is not enrolled in a work profile, the policy cannot be applied, causing the installation to fail.

Exam trap

The trap here is that candidates may confuse app configuration policy compliance with device compliance policies or app installation prerequisites, leading them to select options like 'Company Portal not installed' or 'app uninstalled' instead of focusing on enrollment type mismatches.

Practice this question →

155

MCQeasy

A company uses Microsoft Intune to manage Windows 10 devices. Users report that a LOB app deployed as a required install fails to install on some devices. The app is configured with a dependency on another app. What should the administrator verify first?

A.Ensure the devices have internet connectivity

B.Verify that the app is signed with a trusted certificate

C.Recreate the deployment policy

D.Check if the dependency app is assigned and installed successfully

AnswerD

Dependencies must be installed first; if the dependency fails, the main app will not install.

Why this answer

When a required LOB app fails to install, the most common cause is that its dependency app is not present or not successfully installed on the target device. Intune enforces dependency apps to be installed before the parent app, and if the dependency is missing or failed, the parent app installation will not proceed. The administrator should first verify that the dependency app is assigned to the same device groups and has a successful installation status.

Exam trap

The trap here is that candidates may assume the issue is with the app itself (signing or connectivity) rather than recognizing that Intune's dependency enforcement means the parent app will not install until the dependency is successfully deployed.

How to eliminate wrong answers

Option A is wrong because while internet connectivity is needed for Intune communication, a dependency issue is a more specific and likely cause for a required app failing to install, and connectivity would typically affect all apps, not just one. Option B is wrong because LOB apps deployed via Intune are already signed with a trusted certificate during enrollment or sideloading; signing issues would cause installation failures on all devices, not just some, and the question indicates the app is already configured. Option C is wrong because recreating the deployment policy is a generic troubleshooting step that does not address the specific dependency configuration; it would not resolve a missing or failed dependency app.

Practice this question →

156

Multi-Selecteasy

Which TWO of the following are methods to deploy apps to Windows 10/11 devices via Microsoft Intune?

Select 2 answers

A.iOS app

B.Web link

C.Microsoft Store app

D.Android app

E.Win32 app

AnswersC, E

Microsoft Store app is a supported deployment method.

Why this answer

The correct answers are C and E. Option C is correct because Microsoft Intune supports deploying Microsoft Store apps (including Store for Business and the new Microsoft Store experience) to Windows 10/11 devices. Intune can synchronize apps from the Microsoft Store and assign them to users or devices.

Option E is correct because Intune also supports deploying Win32 apps (traditional .exe and .msi applications) to Windows devices using the Win32 app management feature, which allows packaging and deploying line-of-business applications. Options A, B, and D are incorrect: iOS and Android apps are platform-specific and cannot be deployed to Windows devices via Intune; a web link is not an app deployment method but a shortcut.

Exam trap

A common trap is to overlook Win32 apps as a deployment method in Intune, assuming only modern apps (Store apps) are supported. Additionally, candidates might confuse web links with genuine app deployments.

Practice this question →

157

MCQhard

You manage iOS devices with Microsoft Intune. A user reports that a required app is missing from their device. You verify the app is assigned as 'Required' to a user group containing the user, and the device is compliant. What is the most likely reason the app is not installing?

A.The app is set to 'Available for enrolled devices' instead of 'Required'.

B.The device is not enrolled using Apple Device Enrollment Program (DEP).

C.The Apple Volume Purchase Program (VPP) token has expired.

D.The app is configured to require user enrollment, but the device uses device enrollment.

AnswerD

User enrollment is needed for apps that require a user context.

Why this answer

When an iOS app is configured with a 'Require user enrollment' assignment filter, it will only install on devices that use User Enrollment (which creates a per-user management identity). If the device uses Device Enrollment (e.g., via Apple Business Manager or manual device enrollment), the app will not install even if assigned as 'Required' to a user group. This is a common configuration mismatch that prevents app delivery.

Exam trap

The trap here is that candidates often assume 'Required' assignment guarantees installation, overlooking that assignment filters (like enrollment type) can silently block app delivery even when the user and device are compliant.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the app is assigned as 'Required', so the setting is not 'Available for enrolled devices'. Option B is wrong because enrollment via Apple Device Enrollment Program (DEP) is not a prerequisite for required app installation; Intune can push required apps to any enrolled iOS device, regardless of enrollment method. Option C is wrong because an expired VPP token would prevent app installation for all users, not just this one device, and the user's device is compliant, indicating the token is likely valid.

Practice this question →

158

MCQhard

A user reports that a Microsoft 365 Apps for enterprise installation failed on their Windows 11 device managed by Intune. The Intune management extension logs show error code 0x80070005. The device is Azure AD joined and compliant. What is the most likely cause?

A.The user does not have local administrator privileges on the device

B.The device has insufficient disk space

C.The device does not have internet connectivity to the Microsoft CDN

D.The device is not compliant with the conditional access policy

AnswerA

0x80070005 is access denied; installation requires admin rights.

Why this answer

Error code 0x80070005 translates to 'Access Denied' (E_ACCESSDENIED). Microsoft 365 Apps for enterprise installation requires local administrator privileges to write to protected system paths (e.g., Program Files, registry). Since the device is Azure AD joined and compliant, the most likely cause is that the user lacks local admin rights, which is a common Intune deployment prerequisite.

Exam trap

The trap here is that candidates confuse a compliance-related conditional access block (which would occur at sign-in) with a local installation permission error, overlooking that 0x80070005 specifically indicates an access-denied condition at the OS level, not a network or policy issue.

How to eliminate wrong answers

Option B is wrong because insufficient disk space typically produces error 0x80070070 (ERROR_DISK_FULL), not 0x80070005. Option C is wrong because lack of internet connectivity to the Microsoft CDN would result in download-related errors (e.g., 0x80072EFD or timeout), not an access-denied code. Option D is wrong because the device is explicitly stated as compliant, and conditional access policies affect access to cloud resources, not local installation permissions; non-compliance would block the app at the authentication layer, not produce a local access-denied error.

Practice this question →

159

MCQmedium

Your organization uses Intune to manage Windows 10 devices. You have deployed a Win32 app named 'FinanceApp' with a detection rule that checks for the existence of a registry key. After deployment, you find that the app is not being detected on some devices, causing Intune to attempt reinstallation. You suspect the detection rule is incorrect. You need to update the detection rule for the app without redeploying the entire app. You edit the app properties in Intune and modify the detection rule. However, after saving, the existing assignments still use the old detection rule. What should you do to apply the updated detection rule to existing devices?

A.Increment the app version in the app properties

B.Remove and re-add the assignment

C.Delete the app and recreate it with the new detection rule

D.Uninstall the app from all devices and redeploy

AnswerA

Forces Intune to re-evaluate detection.

Why this answer

After modifying the detection rule, you must increment the app version number in the app properties. This forces the Intune management extension on existing devices to re-evaluate the detection rule and apply the updated logic. Options B, C, and D are unnecessary and overly disruptive.

Practice this question →

160

Multi-Selectmedium

Which TWO of the following are valid app types in Microsoft Intune for deploying applications to Windows 10/11 devices?

Select 2 answers

A.Windows app (Win32)

B.Web link

C.Microsoft Store app (new)

D.macOS app

E.Android store app

AnswersA, C

Win32 app type is for deploying traditional Windows applications.

Why this answer

Win32 apps are a primary app type in Microsoft Intune for deploying traditional desktop applications (e.g., .exe, .msi) to Windows 10/11 devices. Intune uses the Intune Management Extension to install and manage Win32 apps, supporting detection rules, dependencies, and supersedence.

Exam trap

The trap here is that candidates may confuse 'web link' as an app type because it appears in the Intune 'Add app' menu, but it is actually a configuration item (a shortcut) and not a deployable application.

Practice this question →

161

MCQeasy

You are configuring a Windows 10 kiosk device using Intune. The device should run a single-store app in full-screen mode. Which Intune policy type should you use?

A.A device configuration profile using the 'Kiosk' settings for single-app mode

B.A device restrictions profile blocking access to other apps

C.A compliance policy requiring the app to be installed

D.A configuration profile for Microsoft Edge in kiosk mode

AnswerA

Designed for single-app kiosk scenarios.

Why this answer

A is correct because Intune's device configuration profile includes a 'Kiosk' settings category specifically designed for Windows 10/11 devices. When you select 'Single-app mode' under kiosk settings, you can specify a single Store app (e.g., a UWP or Win32 app) that will run in full-screen, locked-down mode, preventing users from accessing any other system functions or apps.

Exam trap

The trap here is that candidates confuse 'device restrictions' (which can block apps) with the dedicated 'Kiosk' settings profile, which is the only Intune policy type that enforces the full-screen, single-app, locked-down experience required for a kiosk device.

How to eliminate wrong answers

Option B is wrong because a device restrictions profile can block access to other apps, but it does not enforce the full-screen, single-app kiosk experience; it lacks the dedicated kiosk lock-down features (e.g., auto-launch, no exit gesture). Option C is wrong because a compliance policy only checks whether an app is installed and reports non-compliance; it cannot configure the device to run that app in kiosk mode. Option D is wrong because a configuration profile for Microsoft Edge in kiosk mode is a specific subset of kiosk settings that only applies to Edge, not to any single-store app; it cannot be used to run a non-Edge app in full-screen kiosk mode.

Practice this question →

162

MCQmedium

Your organization uses Microsoft Intune to manage devices. You need to deploy a custom Windows 10 line-of-business app that is not signed. Which action must you take on the target devices to allow installation?

A.Enable sideloading on the devices.

B.Enable Developer Mode on the devices.

C.Add the app publisher to the trusted publisher store.

D.Turn off Windows Defender SmartScreen.

AnswerA

Sideloading must be enabled to install unsigned LOB apps.

Why this answer

To install an unsigned line-of-business (LOB) app on Windows 10 via Intune, sideloading must be enabled on the target devices. Sideloading allows the installation of apps that are not signed by the Microsoft Store, which is required for custom LOB apps that lack a valid signature. This setting can be configured via a device configuration profile in Intune using the 'Allow sideloading of apps' policy.

Exam trap

The trap here is that candidates often confuse Developer Mode with sideloading, assuming that enabling Developer Mode is necessary for unsigned app installation, but Microsoft specifically separates these two settings for security and management clarity.

How to eliminate wrong answers

Option B is wrong because Developer Mode enables advanced debugging and development features, but it is not specifically required for installing unsigned LOB apps; sideloading is the correct setting. Option C is wrong because adding the app publisher to the trusted publisher store is only relevant for signed apps or certificates, not for unsigned apps that bypass signature verification entirely. Option D is wrong because turning off Windows Defender SmartScreen reduces security protections against malicious downloads but does not affect the installation of unsigned LOB apps, which is controlled by sideloading policies.

Practice this question →

163

MCQmedium

You are reviewing the Intune Win32 app configuration for Microsoft Edge. The app is deployed to Windows 10 devices. Users report that Edge is not being installed on some devices. What is the most likely issue with the detection rule?

A.The uninstall command is incorrect.

B.The detection rule requires an exact version match, which may not match if a different version is installed.

C.The install command is missing the --silent flag.

D.The detection rule is checking the 32-bit registry on a 64-bit system.

AnswerB

Exact version detection can cause false negatives if versions differ.

Why this answer

The most likely issue is that the detection rule is configured to require an exact version match. If a device already has a different version of Microsoft Edge installed (e.g., a newer or older build), Intune will evaluate the detection rule as 'not detected' and attempt to reinstall the app, which may fail or be skipped because the installer detects an existing version. This is a common misconfiguration in Win32 app deployments where version-specific detection rules cause false negatives.

Exam trap

The trap here is that candidates often confuse detection rule failures with installation command issues, but the question's phrasing 'not being installed on some devices' points to a version mismatch scenario where the detection rule is too strict, not a universal install failure.

How to eliminate wrong answers

Option A is wrong because an incorrect uninstall command would affect removal, not installation; the issue is that Edge is not being installed, so the uninstall command is irrelevant to the detection failure. Option C is wrong because the --silent flag (or equivalent quiet switch) is required for silent installation, but if it were missing, the installation would likely fail on all devices, not just some, and the question specifically states users report Edge is not being installed on some devices, pointing to a detection rule issue rather than a universal install command problem. Option D is wrong because the detection rule checking the 32-bit registry on a 64-bit system would cause consistent failure on all 64-bit devices, not just some, and Intune Win32 apps can be configured to check both 32-bit and 64-bit registry paths; the issue is more likely version mismatch than registry architecture.

Practice this question →

164

MCQmedium

You use Microsoft Intune to manage Android Enterprise fully managed devices. You need to ensure that only work apps can access corporate data. Personal apps should not be able to read work data. What should you configure?

A.Configure Conditional Access to block personal apps.

B.Enable Android Enterprise work profile on the devices.

C.Deploy Windows Information Protection (WIP) policy.

D.Configure an Intune App Protection Policy (APP) targeting the work apps.

AnswerD

APP prevents data transfer to unmanaged apps.

Why this answer

Intune App Protection Policies (APP) can be configured to restrict data transfer between managed and unmanaged apps, ensuring that only approved work apps can access corporate data. This policy applies at the app layer, blocking personal apps from reading or copying work data even on fully managed devices, which aligns with the requirement to prevent personal app access to corporate data.

Exam trap

The trap here is that candidates often confuse Android Enterprise work profile (which is for personally enabled devices) with fully managed devices, leading them to choose Option B, but the requirement for data isolation on fully managed devices is achieved via App Protection Policies, not work profile.

How to eliminate wrong answers

Option A is wrong because Conditional Access controls access to resources based on conditions like device compliance or location, but it does not block personal apps from reading work data at the app level; it only gates access to services like Exchange Online. Option B is wrong because enabling an Android Enterprise work profile creates a separate container for work apps on personally enabled devices, but on fully managed devices (where the entire device is corporate-owned and managed), work profile is not used; instead, the device is in corporate-owned fully managed mode, and APP is needed to control data sharing. Option C is wrong because Windows Information Protection (WIP) is a Windows-only feature for protecting data on Windows 10/11 devices, not applicable to Android Enterprise devices.

Practice this question →

165

MCQmedium

You need to deploy a web app to Android Enterprise work profile devices. The app is available in the Managed Google Play store. How should you make it available in Intune?

A.Upload the APK file to Intune

B.Direct users to Google Play to install

C.Add the app from Managed Google Play in Intune

D.Sync device groups with Google Play

AnswerC

Apps are added via Managed Google Play integration.

Why this answer

When a web app is available in the Managed Google Play store, the proper method to make it available in Intune is to add it directly from the Managed Google Play console within the Intune admin center. This synchronizes the app's metadata and licensing with Intune, allowing you to assign it as Required or Available for Android Enterprise work profile devices without needing to upload an APK.

Exam trap

The trap here is that candidates confuse the process for LOB apps (uploading an APK) with the process for public store apps (adding from Managed Google Play), or they assume that syncing device groups is required when in fact Intune syncs app metadata, not device groups.

How to eliminate wrong answers

Option A is wrong because uploading an APK file directly to Intune is used for line-of-business (LOB) apps that are not in the public store, not for apps already available in Managed Google Play. Option B is wrong because directing users to install from Google Play bypasses Intune management, meaning the app won't be tracked, assigned, or removed via Intune, and it won't be deployed to the work profile. Option D is wrong because syncing device groups with Google Play is not a valid action; Intune syncs apps from Managed Google Play, not device groups, and device groups are used for targeting assignments, not for making apps available.

Practice this question →

166

Matchingmedium

Match each Windows Update for Business deployment service to its capability.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Define deferral, pause, and deadline policies

Deploy major Windows version upgrades

Deploy monthly security and cumulative updates

Approve and deploy driver and firmware updates

Force immediate installation of critical updates

Why these pairings

The correct matches are: Update Rings configures deferral periods and deadlines; Feature Update Policies specify which feature update version is offered; Quality Update Policies control which quality updates are offered. Common confusions arise from mixing the roles of these policies.

Practice this question →

167

Multi-Selectmedium

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate applications. Which TWO configurations should you implement?

Select 2 answers

A.Deploy an App Protection Policy

B.Create a device compliance policy

C.Configure a device configuration profile

D.Enable multifactor authentication (MFA) for all users

E.Create a Conditional Access policy requiring compliant devices

AnswersB, E

Defines compliance requirements.

Why this answer

A device compliance policy defines the security requirements (e.g., encryption, OS version, jailbreak detection) that a device must meet to be considered compliant. Option E is correct because a Conditional Access policy can enforce that only compliant devices are granted access to corporate applications, using the 'Require device to be marked as compliant' grant control. Together, these two configurations ensure that non-compliant devices are blocked from accessing corporate apps.

Exam trap

The trap here is that candidates often confuse App Protection Policies (which protect data on unmanaged devices) with device compliance policies (which require managed devices to meet security baselines), leading them to select Option A instead of the correct combination of B and E.

Practice this question →

168

Multi-Selectmedium

Which TWO app types can be deployed to iOS/iPadOS devices using Microsoft Intune?

Select 2 answers

A.Web link

B.iOS LOB app

C.Win32 app

D.iOS store app

E.Android store app

AnswersB, D

Custom line-of-business apps.

Why this answer

iOS LOB (Line-of-Business) apps are custom-built applications that can be deployed to iOS/iPadOS devices via Microsoft Intune. Intune supports deploying LOB apps by uploading the .ipa package file directly, allowing organizations to distribute internal apps without going through the public App Store. This makes option B correct.

Exam trap

The trap here is that candidates often confuse 'web link' as an app type because it appears in the Intune console under 'Apps' > 'All apps', but it is actually a configuration item, not a deployable app type for iOS/iPadOS.

Practice this question →

169

MCQmedium

You are troubleshooting an Android Enterprise device that fails to install a required app from the Managed Google Play store. The device is compliant and has a valid work profile. What should you check first?

A.Check that the device is enrolled in Android Enterprise and has a work profile.

B.Ensure the Managed Google Play app is enabled and active on the device.

C.Confirm the user has approved the app installation in the Managed Google Play store.

D.Verify the device compliance policy allows app installation from unknown sources.

AnswerB

The Managed Google Play app must be active to install apps.

Why this answer

The Managed Google Play app is the client-side component that processes app installation requests on Android Enterprise devices. Even if the device is compliant and has a valid work profile, if the Managed Google Play app is disabled, frozen, or not active, it cannot receive or execute the installation command from the EMM console. This is the first thing to verify because it is a prerequisite for any app deployment via Managed Google Play.

Exam trap

The trap here is that candidates assume user approval (Option C) is always required for app installations, but in Android Enterprise managed devices, silent push installations bypass user interaction, making the Managed Google Play app's active status the critical first check.

How to eliminate wrong answers

Option A is wrong because the question already states the device has a valid work profile, so checking enrollment is redundant and not the first troubleshooting step. Option C is wrong because in a fully managed or work profile Android Enterprise deployment, app installations are pushed silently from the EMM console; user approval is not required unless the app is marked as 'user-approved' in the EMM policy, which is not the default. Option D is wrong because Android Enterprise devices install apps exclusively through the Managed Google Play store, not from unknown sources; compliance policies for unknown sources are irrelevant to Managed Google Play installations.

Practice this question →

170

MCQmedium

An organization is moving from on-premises SCCM to Microsoft Intune for Windows app management. They need to ensure that users can self-install company portal apps without administrator intervention. Which configuration is required?

A.Configure the app as 'Required' for all users

B.Add the app to the Windows Autopilot deployment profile

C.Grant users local administrator rights on their devices

D.Assign the app to users as 'Available' in the Company Portal

AnswerD

Available assignment allows users to install from Company Portal.

Why this answer

The 'Available' assignment type in Microsoft Intune allows users to install apps on demand from the Company Portal without requiring administrator intervention. This configuration meets the requirement for self-service installation while respecting user intent, as opposed to forced installations.

Exam trap

The trap here is that candidates may confuse 'Available' assignments with 'Required' assignments, thinking that self-service implies mandatory installation, or incorrectly assume that local admin rights are needed for app installation in Intune.

How to eliminate wrong answers

Option A is wrong because configuring the app as 'Required' forces installation on all targeted devices, which does not allow users to choose when or if to install the app, contradicting the self-install requirement. Option B is wrong because Windows Autopilot deployment profiles are used for device provisioning and initial setup, not for ongoing self-service app installation via Company Portal. Option C is wrong because granting users local administrator rights is a security risk and unnecessary; Intune's 'Available' assignment enables self-installation without elevated privileges, as the Company Portal uses the Intune Management Extension to install apps in the system context.

Practice this question →

171

MCQeasy

Your organization needs to deploy a web app link to users' devices via Microsoft Intune. Which app type should you select?

A.Windows app (Win32)

B.iOS store app

C.Web link

D.Managed Google Play app

AnswerC

Creates a shortcut to the URL.

Why this answer

C is correct because a Web link app type in Microsoft Intune allows you to deploy a shortcut to a web app on users' devices without installing any software. This is ideal for linking to a web app that runs in a browser, as it simply places an icon on the device's app list or home screen that opens the specified URL.

Exam trap

The trap here is that candidates may confuse a Web link app with a full application deployment, thinking they need to select a platform-specific app type (like Win32 or iOS store app) even when the requirement is simply to provide a URL shortcut.

How to eliminate wrong answers

Option A is wrong because a Windows app (Win32) is used for deploying traditional desktop applications via .intunewin files, not for linking to a web app. Option B is wrong because an iOS store app is for deploying native iOS applications from the Apple App Store, not for creating a shortcut to a web URL. Option D is wrong because a Managed Google Play app is for deploying Android apps from the Google Play Store, not for web links.

Practice this question →

172

MCQeasy

Your organization uses Microsoft Intune to manage Android devices. You need to deploy an app that is available in the Managed Google Play store as a required app. What must you do first?

A.Connect Intune to the Managed Google Play store.

B.Enroll the device in Intune.

C.Install the Managed Google Play app on the device.

D.Upload the app package to Intune.

AnswerA

You must establish the connection before you can browse and assign apps.

Why this answer

To deploy a required app from the Managed Google Play store, you must first establish the connection between Intune and the Managed Google Play store. This connection is a prerequisite because Intune uses it to synchronize apps, manage licenses, and push required apps to Android devices. Without this connection, Intune cannot access or deploy any apps from the Managed Google Play store.

Exam trap

The trap here is that candidates often think device enrollment (Option B) is the first step, but the connection to Managed Google Play must be established first because Intune cannot deploy any apps from the store without it.

How to eliminate wrong answers

Option B is wrong because enrolling the device in Intune is necessary for app deployment, but it is not the first step; the Intune-to-Managed Google Play connection must be established before any app deployment can occur. Option C is wrong because the Managed Google Play app is automatically installed on Android devices during the enrollment process when the connection is configured, so manually installing it is not a prerequisite. Option D is wrong because you do not upload app packages to Intune for Managed Google Play apps; instead, you approve and sync apps from the Managed Google Play store after the connection is established.

Practice this question →

173

MCQhard

An administrator deploys a Win32 app via Intune with detection rule 'File exists: C:\Program Files\MyApp\app.exe'. The app is reported as installed, but users cannot launch it. The file exists but is corrupted. How should the administrator modify the detection rule to ensure the app is correctly detected and re-installed if corrupted?

A.Remove the detection rule so Intune always re-installs the app

B.Add a registry detection rule for the app's uninstall key

C.Use a custom detection script that validates the file hash or signature

D.Change detection rule to 'File version comparison' and set minimum version

AnswerC

A script can verify integrity and return 0 only if valid.

Why this answer

A custom detection script can verify the file's integrity by checking its hash or digital signature, ensuring that even if the file exists, it is not corrupted. Intune's built-in detection rules only check for file existence or version, not file integrity. By using a script that validates the hash, the administrator can force a reinstall when the file is corrupted, as the detection will fail.

Exam trap

The trap here is that candidates assume 'File exists' or 'File version comparison' are sufficient for detection, overlooking that these rules do not validate file integrity, which is a common misconception in Intune app deployment scenarios.

How to eliminate wrong answers

Option A is wrong because removing the detection rule would cause Intune to always reinstall the app on every sync, leading to unnecessary bandwidth and user disruption, and it does not solve the corruption detection issue. Option B is wrong because adding a registry detection rule for the uninstall key only confirms the app was installed via the registry, not that the executable is uncorrupted; the uninstall key remains even if the file is corrupted. Option D is wrong because 'File version comparison' only checks the version number of the file, not its integrity; a corrupted file can still have the correct version metadata, so this would not trigger a reinstall.

Practice this question →

174

Multi-Selecteasy

Which TWO app types are available for deploying apps to iOS/iPadOS devices in Microsoft Intune? (Choose two.)

Select 2 answers

A.Web link

B.iOS/iPadOS app store app

C.Windows app (Win32)

D.Android Line-of-business app

E.iOS/iPadOS Line-of-business app

AnswersB, E

For apps available in the Apple App Store.

Why this answer

Microsoft Intune supports deploying iOS/iPadOS app store apps (option B) by integrating with the Apple Volume Purchase Program (VPP) or directly assigning public store apps via the Intune console. iOS/iPadOS line-of-business apps (option E) are custom-built apps that are uploaded as .ipa files and deployed to devices without going through the public App Store. Both are native app types for iOS/iPadOS management in Intune.

Exam trap

The trap here is that candidates often confuse web links (shortcuts) with actual app deployments, or mistakenly think platform-specific app types like Win32 or Android LOB can be cross-deployed, but Intune strictly enforces app type per OS platform.

Practice this question →