Exam Bundle

This action is appropriate for a different case: The Intune Vulnerability Remediation Agent ranks devices by risk but a business-critical host cannot be patched this week. There, the targeted fix is 'Evaluate the agent's prioritization with business context and compensating control planning.' because automated risk scoring requires human operational decisions. The current scenario instead requires 'Return the supported JSON schema without extra stdout content and validate the rules file.' and verification that the pilot returns a parseable evaluation and its compliance state matches test conditions.

This action is appropriate for a different case: A Security Copilot agent recommends disabling a conditional access grant because some users are blocked from an app. There, the targeted fix is 'Validate identity security policy intent and evidence before applying suggestions to production.' because automated guidance should not override established Zero Trust access requirements. The current scenario instead requires 'Return the supported JSON schema without extra stdout content and validate the rules file.' and verification that the pilot returns a parseable evaluation and its compliance state matches test conditions.

This action is appropriate for a different case: A PowerShell cleanup script mistakenly removes device records because it matches display name instead of a stable managed device identifier. There, the targeted fix is 'Resolve and validate unique Intune managedDevice IDs before mutation calls.' because device names can collide, making them unsafe destructive keys. The current scenario instead requires 'Return the supported JSON schema without extra stdout content and validate the rules file.' and verification that the pilot returns a parseable evaluation and its compliance state matches test conditions.

This action is appropriate for a different case: A scheduled remediation needs to run on a small pilot set during evening hours, not across all corporate laptops. There, the targeted fix is 'Configure supported scheduling and scoped assignments for the remediation package.' because maintenance automation should honor rollout and working-hour constraints. The current scenario instead requires 'Create scoped enrollment failure reports with platform, profile and error details.' and verification that a sample export groups failures accurately by OS and enrollment profile.

This action is appropriate for a different case: A device has a recurring local disk cache issue that support technicians fix manually every morning. There, the targeted fix is 'Deploy a supported Intune Remediations detection script plus narrowly scoped corrective script.' because scheduled detection and remediation can automate repeatable endpoint maintenance. The current scenario instead requires 'Create scoped enrollment failure reports with platform, profile and error details.' and verification that a sample export groups failures accurately by OS and enrollment profile.

This action is appropriate for a different case: A remediation script shows success but endpoint performance still degrades after each reboot. There, the targeted fix is 'Correlate remediation output with independent Endpoint Analytics metrics and repeating-event reports.' because successful script exit is not equivalent to sustained user-experience improvement. The current scenario instead requires 'Create scoped enrollment failure reports with platform, profile and error details.' and verification that a sample export groups failures accurately by OS and enrollment profile.

This action is appropriate for a different case: A Windows device fails the feature update because of a safeguard hold while security fixes install normally. There, the targeted fix is 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.' because feature and quality update failure paths can be independent. The current scenario instead requires 'Distinguish scan, offer, download, install and reboot stages in update reports.' and verification that the exported report identifies installed builds and outstanding restarts separately.

This action is appropriate for a different case: A long-offline laptop rejoins and receives many updates at once, creating avoidable branch congestion. There, the targeted fix is 'Use supported update deadlines, Delivery Optimization and staged release policies for returning devices.' because catch-up servicing should respect bandwidth and security targets. The current scenario instead requires 'Distinguish scan, offer, download, install and reboot stages in update reports.' and verification that the exported report identifies installed builds and outstanding restarts separately.

This action is appropriate for a different case: A macOS fleet reports inconsistent patch status because the management reporting sync hasn't completed after update. There, the targeted fix is 'Check device check-in, update reporting lag and local OS version before declaring failure.' because update installation and service reporting can differ in timing. The current scenario instead requires 'Distinguish scan, offer, download, install and reboot stages in update reports.' and verification that the exported report identifies installed builds and outstanding restarts separately.

This observation would validate a different case: A Windows configuration profile shows 'conflict' for password length because two profiles target the same device with different values. It would check 'The pilot reports one intended applied password policy and no setting conflict.' after 'Inspect per-setting status and revise overlapping profile assignments or definitions.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot receives the essential profile during setup rather than hours later.'.

This observation would validate a different case: A mobile team pushes an Android Wi-Fi profile that references an enterprise certificate missing on the target devices. It would check 'A pilot Android device receives the certificate and connects to the secure SSID.' after 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot receives the essential profile during setup rather than hours later.'.

This observation would validate a different case: A HoloLens 2 headset is used for guided industrial work and must have management settings applied without modifying desktops. It would check 'An enrolled headset receives only its intended kiosk and enterprise configuration.' after 'Assign supported HoloLens device configuration policies to its dedicated managed group.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot receives the essential profile during setup rather than hours later.'.

This observation would validate a different case: A device operator is assigned Intune Administrator and can view every corporate profile although their job is only collecting diagnostics. It would check 'The operator collects allowed logs and cannot modify unrelated enrollment policies.' after 'Replace broad tenant roles with appropriately scoped Intune RBAC diagnostic rights.'. It does not establish success for the stated scenario; the needed evidence is 'The regional admin can view local Cloud PCs but cannot change the other unit's policy.'.

This observation would validate a different case: A Windows LAPS password appears in directory but ordinary users can retrieve it due to overly broad role membership. It would check 'The ordinary user cannot retrieve the secret while an authorized operator can with logging.' after 'Restrict LAPS password retrieval permissions with approved RBAC and audit usage.'. It does not establish success for the stated scenario; the needed evidence is 'The regional admin can view local Cloud PCs but cannot change the other unit's policy.'.

This observation would validate a different case: A junior admin submits a destructive device configuration change that must be approved by another authorized administrator. It would check 'A protected change remains pending until an authorized independent approver approves it.' after 'Use Intune multi-admin approval for the protected change type.'. It does not establish success for the stated scenario; the needed evidence is 'The regional admin can view local Cloud PCs but cannot change the other unit's policy.'.

This action is appropriate for a different case: A field team reports enrollment failures only on outdated Android versions not supported by the corporate platform baseline. There, the targeted fix is 'Apply documented platform minimum-version enrollment restrictions and communicate upgrade requirements.' because enrollment requirements must match the supported operating-system policy. The current scenario instead requires 'Guide the user through supported macOS enrollment approval and verify the management profile.' and verification that the Mac shows the management profile and responds to a scheduled check-in.

This action is appropriate for a different case: A device enrolls but its compliance policy never arrives because it is placed in an unexpectedly excluded dynamic group. There, the targeted fix is 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.' because enrollment success does not imply every policy is targeted. The current scenario instead requires 'Guide the user through supported macOS enrollment approval and verify the management profile.' and verification that the Mac shows the management profile and responds to a scheduled check-in.

This action is appropriate for a different case: Apple enrollment receives error messages after Intune certificate renewal because the technician created a new push certificate instead of renewing the existing one. There, the targeted fix is 'Restore or remediate the Apple MDM certificate identity using Microsoft's supported migration guidance.' because a mismatched push identity can require device re-enrollment and is not a harmless rename. The current scenario instead requires 'Guide the user through supported macOS enrollment approval and verify the management profile.' and verification that the Mac shows the management profile and responds to a scheduled check-in.

This observation would validate a different case: A Windows endpoint is missing from an Entra dynamic group because its directory attributes have not synchronized. It would check 'The updated attributes place the endpoint in the group without a standing manual workaround.' after 'Confirm directory synchronization and membership processing before manually adding a permanent exception.'. It does not establish success for the stated scenario; the needed evidence is 'A renamed unapproved device does not acquire the privileged group's resources.'.

This observation would validate a different case: An Entra device dynamic group stops updating after an administrator changes the membership rule syntax. It would check 'The corrected group evaluates test device properties to the expected membership outcome.' after 'Validate the rule syntax and supported device attributes, then inspect membership processing results.'. It does not establish success for the stated scenario; the needed evidence is 'A renamed unapproved device does not acquire the privileged group's resources.'.

This observation would validate a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. It would check 'A test shared device is enrolled under the approved ownership workflow without a permanent user affinity.' after 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.'. It does not establish success for the stated scenario; the needed evidence is 'A renamed unapproved device does not acquire the privileged group's resources.'.

This observation would validate a different case: A network team needs to deploy Microsoft 365 Apps during Autopilot without downloading every language package during setup. It would check 'The pilot receives only the selected applications and languages.' after 'Use a tailored Office Deployment Tool configuration or Intune suite profile for required components.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot work app notifications follow the quiet period while personal alerts still work.'.

This observation would validate a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. It would check 'The app installs before the employee is allowed to start regulated work.' after 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot work app notifications follow the quiet period while personal alerts still work.'.

This observation would validate a different case: An employee leaves and a work app must be removed from managed devices without deleting personal software. It would check 'The enterprise app is removed and unrelated personal apps remain.' after 'Configure appropriate app uninstall assignment and selective corporate-data removal.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot work app notifications follow the quiet period while personal alerts still work.'.

This action is appropriate for a different case: A user requests a local antivirus exception for a downloaded installer without validating its publisher or hash. There, the targeted fix is 'Verify software provenance and route any exclusion request through approved security policy.' because untrusted application exceptions can create a new malware execution path. The current scenario instead requires 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' and verification that a newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.

This action is appropriate for a different case: An attacker uses Office macros to launch credential theft from a managed Windows laptop. There, the targeted fix is 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' because ASR reduces specific abuse paths beyond ordinary malware signatures. The current scenario instead requires 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' and verification that a newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.

This action is appropriate for a different case: A security baseline uses an older configuration and the team wants to adopt a new recommended baseline version without breaking specialized apps. There, the targeted fix is 'Compare baseline versions and pilot the updated policy with compatibility tests.' because baseline revisions can alter settings and require controlled migration. The current scenario instead requires 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' and verification that a newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.

This observation would validate a different case: A company-owned Windows kiosk should provision without any individual user signing in during out-of-box experience. It would check 'The kiosk reaches its managed configuration without binding to a named employee.' after 'Use a supported Windows Autopilot self-deploying profile on eligible hardware.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Cloud PC provisions successfully and reaches approved corporate resources.'.

This observation would validate a different case: An Autopilot enrollment failure exposes only a generic timeout and the administrator keeps wiping the laptop without collecting diagnostics. It would check 'Logs identify the failed enrollment stage and a targeted correction succeeds.' after 'Collect Autopilot deployment logs and Intune enrollment diagnostics before making another change.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Cloud PC provisions successfully and reaches approved corporate resources.'.

This observation would validate a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. It would check 'The approved eligible devices upgrade and blocked hardware shows a documented reason.' after 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Cloud PC provisions successfully and reaches approved corporate resources.'.