Exam Bundle

This action is appropriate for a different case: Windows accessibility settings must stay usable, but a security configuration profile unintentionally disables all assistive technology. There, the targeted fix is 'Adjust only the conflicting setting within a scoped policy after accessibility testing.' because accessibility requirements should not be overridden by broad unvalidated restrictions. The current scenario instead requires 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' and verification that supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.

This action is appropriate for a different case: A Mac needs FileVault configuration but the admin targets a Windows BitLocker settings catalog profile. There, the targeted fix is 'Create and assign the platform-specific macOS FileVault and recovery-key configuration.' because encryption controls differ by operating system and management channel. The current scenario instead requires 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' and verification that supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.

This action is appropriate for a different case: An administrator needs to deploy browser restrictions to Windows devices but wants to avoid conflict with an existing security baseline. There, the targeted fix is 'Compare overlapping settings and select one authoritative assignment for each control.' because multiple policy sources can generate conflicting desired states. The current scenario instead requires 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' and verification that supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.

This observation would validate a different case: A compliance policy requires an OS version but most devices report noncompliant because the version constraint is misconfigured. It would check 'Supported test devices meet compliance while known outdated builds are flagged.' after 'Review supported platform minimum OS versions and assignments within the Intune compliance policy.'. It does not establish success for the stated scenario; the needed evidence is 'Android pilot devices evaluate their supported controls without irrelevant Windows errors.'.

This observation would validate a different case: A Windows local group policy replaces an emergency break-glass member by accident during rollout. It would check 'The pilot device contains both mandated emergency access and the intended managed members.' after 'Choose group-membership update semantics that preserve required approved break-glass access.'. It does not establish success for the stated scenario; the needed evidence is 'Android pilot devices evaluate their supported controls without irrelevant Windows errors.'.

This observation would validate a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. It would check 'The protected app signs in with its applied policy while an unsupported client is denied.' after 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.'. It does not establish success for the stated scenario; the needed evidence is 'Android pilot devices evaluate their supported controls without irrelevant Windows errors.'.

This action is appropriate for a different case: A fleet health score decreases but leadership cannot tell whether app reliability or startup performance was responsible. There, the targeted fix is 'Decompose Endpoint Analytics scores by dimension and inspect corresponding device groups.' because a composite health number requires component-level analysis. The current scenario instead requires 'Correct the detection exit code and result logic before enabling the repair script.' and verification that a stopped service triggers remediation while a healthy service reports compliant.

This action is appropriate for a different case: A policy configuration conflict generates hundreds of alerts for the same device every hour. There, the targeted fix is 'Deduplicate alert events and define actionable thresholds with correlation IDs.' because alert floods can obscure distinct urgent issues and overload support teams. The current scenario instead requires 'Correct the detection exit code and result logic before enabling the repair script.' and verification that a stopped service triggers remediation while a healthy service reports compliant.

This action is appropriate for a different case: Application startup performance degrades after a new security agent version and teams argue using anecdotal complaints. There, the targeted fix is 'Compare Endpoint Analytics app startup telemetry before and after the agent release.' because quantified user-experience metrics support change attribution. The current scenario instead requires 'Correct the detection exit code and result logic before enabling the repair script.' and verification that a stopped service triggers remediation while a healthy service reports compliant.

This observation would validate a different case: A corporate application fails because a security admin created an outbound firewall rule that blocks its authorized API endpoint. It would check 'The application connects to the approved API and unrelated destinations remain blocked.' after 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.'. It does not establish success for the stated scenario; the needed evidence is 'High-risk pilot devices are blocked while low-risk compliant devices retain access.'.

This observation would validate a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. It would check 'The device remains protected until an explicitly approved decryption task completes.' after 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.'. It does not establish success for the stated scenario; the needed evidence is 'High-risk pilot devices are blocked while low-risk compliant devices retain access.'.

This observation would validate a different case: An attacker uses Office macros to launch credential theft from a managed Windows laptop. It would check 'A controlled macro-based process launch is blocked without harming approved documents.' after 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.'. It does not establish success for the stated scenario; the needed evidence is 'High-risk pilot devices are blocked while low-risk compliant devices retain access.'.

This action is appropriate for a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. There, the targeted fix is 'Use managed-device app configuration targeting appropriate device groups.' because corporate managed device settings should not be broadcast to personal installations. The current scenario instead requires 'Configure Intune app protection policy with the required application PIN and reset behavior.' and verification that outlook prompts for the configured app PIN on the BYOD pilot.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Configure Intune app protection policy with the required application PIN and reset behavior.' and verification that outlook prompts for the configured app PIN on the BYOD pilot.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Configure Intune app protection policy with the required application PIN and reset behavior.' and verification that outlook prompts for the configured app PIN on the BYOD pilot.

This action is appropriate for a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. There, the targeted fix is 'Use an authorized Wipe action on the verified device record with incident tracking.' because a full wipe is appropriate for a lost corporate endpoint when approved. The current scenario instead requires 'Choose Sync or other non-destructive action rather than wipe when the goal is policy refresh.' and verification that the test endpoint receives policies without losing user data.

This action is appropriate for a different case: An employee leaves and IT must remove organizational data from their personally owned phone without deleting family photos. There, the targeted fix is 'Select Retire or selective corporate data removal where supported, not full device wipe.' because bYOD offboarding should respect ownership and preserve personal data. The current scenario instead requires 'Choose Sync or other non-destructive action rather than wipe when the goal is policy refresh.' and verification that the test endpoint receives policies without losing user data.

This action is appropriate for a different case: A compliance team wants device diagnostics from a stolen laptop but the device has been offline for weeks. There, the targeted fix is 'Report remote collection status accurately and use available last-seen telemetry rather than claiming successful capture.' because remote actions require device connectivity and cannot guarantee results from offline endpoints. The current scenario instead requires 'Choose Sync or other non-destructive action rather than wipe when the goal is policy refresh.' and verification that the test endpoint receives policies without losing user data.

This observation would validate a different case: A registered device unexpectedly runs the old Autopilot profile instead of device preparation because its association state is not understood. It would check 'A pilot reports the intended deployment engine after device state is corrected.' after 'Check device association and Autopilot registration precedence before troubleshooting assignments.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot restores permitted settings while blocked personal restore content is not introduced.'.

This observation would validate a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. It would check 'The licensed test user receives a Cloud PC while unlicensed requests remain blocked.' after 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot restores permitted settings while blocked personal restore content is not introduced.'.

This observation would validate a different case: An Enrollment Status Page shows 'setup complete' before a required security application is installed on Windows devices. It would check 'The device does not complete gated setup until the designated security app succeeds.' after 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot restores permitted settings while blocked personal restore content is not introduced.'.

This action is appropriate for a different case: A company wants a semiannual Microsoft 365 Apps channel but devices keep updating from a different channel. There, the targeted fix is 'Set the correct Microsoft 365 Apps update channel through approved app management policy.' because Office update channel is separate from Windows feature update version. The current scenario instead requires 'Sync Apps and Books with Intune and assign the licensed application appropriately.' and verification that a supervised iPad installs the licensed app under corporate management.

This action is appropriate for a different case: An enterprise needs to remove a vulnerable app version before assigning a patched replacement, avoiding two conflicting versions. There, the targeted fix is 'Coordinate app supersedence or uninstall and replacement assignments with detection tests.' because lifecycle transitions should not leave multiple incompatible releases. The current scenario instead requires 'Sync Apps and Books with Intune and assign the licensed application appropriately.' and verification that a supervised iPad installs the licensed app under corporate management.

This action is appropriate for a different case: An enterprise needs every new laptop to install Microsoft 365 Apps automatically during initial Windows deployment. There, the targeted fix is 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' because Office app deployment can be managed alongside Windows enrollment provisioning. The current scenario instead requires 'Sync Apps and Books with Intune and assign the licensed application appropriately.' and verification that a supervised iPad installs the licensed app under corporate management.

This action is appropriate for a different case: The organization requires users to be standard users after Autopilot rather than local administrators during setup. There, the targeted fix is 'Configure supported account type settings for the applicable Autopilot deployment mode.' because deployment configuration controls whether users gain standing local administrative privilege. The current scenario instead requires 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.' and verification that oOBE finishes with essentials and remaining applications deploy after check-in.

This action is appropriate for a different case: A new laptop receives a random computer name but IT requires a predictable approved asset prefix during deployment. There, the targeted fix is 'Configure supported Windows Autopilot device-name template behavior on the applicable deployment profile.' because naming templates can apply standardized identifiers under supported Autopilot modes. The current scenario instead requires 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.' and verification that oOBE finishes with essentials and remaining applications deploy after check-in.

This action is appropriate for a different case: An Enrollment Status Page shows 'setup complete' before a required security application is installed on Windows devices. There, the targeted fix is 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.' because eSP readiness gates can wait for selected mandatory software rather than every optional assignment. The current scenario instead requires 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.' and verification that oOBE finishes with essentials and remaining applications deploy after check-in.

This action is appropriate for a different case: A security tool must be automatically installed on every company laptop and should not be treated as user-optional. There, the targeted fix is 'Assign the application as Required to the verified corporate device group.' because mandatory controls need device-wide automatic assignment. The current scenario instead requires 'Apply supported iOS Quiet Time policy to the intended managed work apps.' and verification that pilot work app notifications follow the quiet period while personal alerts still work.

This action is appropriate for a different case: An organization must centrally configure Outlook security settings while leaving Windows device OS update rings unchanged. There, the targeted fix is 'Manage Microsoft 365 Apps policy through Intune or Microsoft 365 Apps admin center as appropriate.' because application policy and OS update management have different targets. The current scenario instead requires 'Apply supported iOS Quiet Time policy to the intended managed work apps.' and verification that pilot work app notifications follow the quiet period while personal alerts still work.

This action is appropriate for a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. There, the targeted fix is 'Package it as a supported Intune Win32 app and configure the required install command.' because Win32 app packaging supports installation of traditional desktop software with monitoring. The current scenario instead requires 'Apply supported iOS Quiet Time policy to the intended managed work apps.' and verification that pilot work app notifications follow the quiet period while personal alerts still work.

This observation would validate a different case: An Entra-registered personal phone is replaced, but the old device remains in the account's list long after retirement. It would check 'The retired phone registration disappears without affecting the replacement device's sign-in.' after 'Use a verified stale registration cleanup process respecting user and enrollment ownership.'. It does not establish success for the stated scenario; the needed evidence is 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.'.

This observation would validate a different case: A manufacturer issues company-owned Windows laptops and wants device-based single sign-on without maintaining on-premises domain join. It would check 'A new laptop shows Entra joined ownership and its permitted user signs in with organization credentials.' after 'Choose Microsoft Entra join for cloud-native corporate devices and assign managed enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.'.

This observation would validate a different case: An Entra device dynamic group stops updating after an administrator changes the membership rule syntax. It would check 'The corrected group evaluates test device properties to the expected membership outcome.' after 'Validate the rule syntax and supported device attributes, then inspect membership processing results.'. It does not establish success for the stated scenario; the needed evidence is 'An authorized test user can join while a blocked identity still fails with the expected sign-in reason.'.