MD-102 domain - 18% of the exam

Manage and Secure Applications

Manage and Secure Applications is 18% of the Microsoft 365 Certified: Endpoint Administrator Associate (MD-102) exam. These are the objectives it covers, each with practice questions, with every answer explained.

Objectives in this domain

Sample question from this domain

Free sampleManage and Secure Applicationsmedium

An administrator prepares a desktop application that ships as a setup executable with several supporting files, ready for deployment to Windows 11 devices with Microsoft Intune, and runs the Microsoft Win32 Content Prep Tool against the source folder. What does that tool produce, and what does it leave the administrator to define?

  • AIt converts the source installer into an MSIX package so that the Windows servicing stack installs and removes the application, leaving the administrator to choose an assignment group and nothing further about the install itself.
  • BIt inspects the source installer and writes the detection rules automatically from the product code that it finds, leaving the administrator to supply an install command but no rule that proves the application is present on the device.
  • CIt uploads the packaged payload straight into the tenant and creates the application record there, leaving the administrator to assign groups without ever attaching a package file to an app in the Microsoft Intune admin center.
  • DIt wraps the installer and its supporting files into an encrypted .intunewin package that the Intune Management Extension decrypts on the device, leaving the administrator to declare the install command, the uninstall command and the detection rules in Intune. Correct
The Win32 Content Prep Tool only builds an encrypted .intunewin package; install behaviour and detection are authored on the app record in Intune. The content prep tool takes a source folder and a named setup file and emits a single encrypted .intunewin container. The Intune Management Extension downloads that container to the device, decrypts it, extracts it to a temporary location and runs whatever install command the app record carries. Because the package is opaque, Intune learns nothing about the application from it, so the install command, the uninstall command, the requirement rules and the detection rules all have to be stated separately when the app is created.

Why A is wrong: Tempting because MSIX is a genuine modern packaging format for Windows applications and Intune can deploy MSIX line-of-business packages. Conversion to MSIX is the job of the MSIX Packaging Tool; the content prep tool changes the container, not the installer technology inside it.

Why B is wrong: Tempting because detection based on an MSI product code is a real option on a Win32 app, so it feels as though the packaging step could fill it in. The tool performs no inspection of that kind, and an app saved with no detection rule cannot report an installed state.

Why C is wrong: Tempting because the tool is run with tenant deployment in mind and the output file is useless anywhere else. The tool is an offline packager with no connection to the tenant, and the .intunewin file it writes has to be uploaded by hand when the app is added.

Why D is correct: Correct. The tool only builds and encrypts the content package. Everything that describes how the payload behaves, meaning the command line that installs it, the command line that removes it and the rule that proves it is present, is authored on the app record in Intune.

Other domains in this exam

See also the MD-102 cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.