Exam Bundle

This action is appropriate for a different case: An attacker uses Office macros to launch credential theft from a managed Windows laptop. There, the targeted fix is 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' because ASR reduces specific abuse paths beyond ordinary malware signatures. The current scenario instead requires 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' and verification that the pilot shows the required secure value without outstanding setting conflicts.

This action is appropriate for a different case: A service desk user can retrieve BitLocker recovery keys for every subsidiary despite being responsible for one region. There, the targeted fix is 'Limit recovery key access and Intune/Entra role scope to authorized device populations.' because recovery secrets are highly sensitive and require least privilege. The current scenario instead requires 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' and verification that the pilot shows the required secure value without outstanding setting conflicts.

This action is appropriate for a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. There, the targeted fix is 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.' because removing a policy is not the same as changing existing disk encryption state. The current scenario instead requires 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' and verification that the pilot shows the required secure value without outstanding setting conflicts.

This action is appropriate for a different case: An enterprise uses the new Microsoft Store for its Windows app distribution and still relies on retired legacy store integration. There, the targeted fix is 'Choose the supported Microsoft Store app deployment method within Intune.' because modern store integration replaces older Microsoft Store for Business workflows. The current scenario instead requires 'Review Microsoft 365 Apps servicing configuration and distribution separately from Windows OS updates.' and verification that Office updates complete under the chosen bandwidth and channel policy.

This action is appropriate for a different case: A corporate iPad should install a paid in-house app purchased through Apple Business Manager without personal Apple IDs. There, the targeted fix is 'Sync Apps and Books with Intune and assign the licensed application appropriately.' because organization-managed app licenses do not require each employee's personal purchase. The current scenario instead requires 'Review Microsoft 365 Apps servicing configuration and distribution separately from Windows OS updates.' and verification that Office updates complete under the chosen bandwidth and channel policy.

This action is appropriate for a different case: A packaged Win32 application uses a shared UNC path installer that remote laptops cannot reach off VPN. There, the targeted fix is 'Distribute packaged installation content through Intune rather than relying on an inaccessible internal share.' because cloud-managed remote deployments should not depend on unavailable local installation paths. The current scenario instead requires 'Review Microsoft 365 Apps servicing configuration and distribution separately from Windows OS updates.' and verification that Office updates complete under the chosen bandwidth and channel policy.

This observation would validate a different case: A business wants to deploy an emergency Windows fix only to a device class that runs the affected application. It would check 'The vulnerable cohort receives the fix and unaffected endpoints remain on routine schedules.' after 'Assign the appropriate expedited quality policy to a verified at-risk group.'. It does not establish success for the stated scenario; the needed evidence is 'The affected model is paused for remediation while other cohorts continue patching.'.

This observation would validate a different case: A user wants to apply hotpatch on any Windows 11 computer with no regard for supported edition or baseline. It would check 'An eligible pilot receives hotpatch while an ineligible PC takes the normal cumulative update path.' after 'Check hotpatch eligibility, supported OS/architecture and necessary baseline state before enabling policy.'. It does not establish success for the stated scenario; the needed evidence is 'The affected model is paused for remediation while other cohorts continue patching.'.

This observation would validate a different case: A company wants Windows 11 monthly security updates delivered in predictable pilot and broad rings with different restart windows. It would check 'Pilot devices patch first and broader devices follow after a monitored validation window.' after 'Configure Intune Windows update rings with staged assignments and appropriate deadlines.'. It does not establish success for the stated scenario; the needed evidence is 'The affected model is paused for remediation while other cohorts continue patching.'.

This action is appropriate for a different case: A reporting dashboard displays the last update scan rather than actual installation date and leaders incorrectly mark patching complete. There, the targeted fix is 'Distinguish scan, offer, download, install and reboot stages in update reports.' because update lifecycle stages have different compliance implications. The current scenario instead requires 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.' and verification that the blocked feature update shows its precise hold while quality updates continue.

This action is appropriate for a different case: An Intune report says an update was assigned but users claim it is installed; the team has no deployment status evidence. There, the targeted fix is 'Review Windows update deployment and per-device installation reports, including pending restart state.' because assignment alone does not confirm an update completed successfully. The current scenario instead requires 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.' and verification that the blocked feature update shows its precise hold while quality updates continue.

This action is appropriate for a different case: A device receives a hotpatch month update but the team falsely claims it never needs another restart. There, the targeted fix is 'Explain and plan baseline cumulative updates that require reboot alongside hotpatch months.' because hotpatch cycles still include periodic baseline updates and restart requirements. The current scenario instead requires 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.' and verification that the blocked feature update shows its precise hold while quality updates continue.

This action is appropriate for a different case: A technician attempts to Entra join company devices using an account that is not permitted to join additional devices. There, the targeted fix is 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' because authentication alone does not override tenant device join restrictions. The current scenario instead requires 'Design a supported device identity and enrollment migration including unjoin, re-registration, and data preservation steps.' and verification that a pilot device transitions under an approved plan with its new tenant record and user data intact.

This action is appropriate for a different case: A security group uses a device display-name prefix to decide privileged access, and users can influence the machine name. There, the targeted fix is 'Base privileged targeting on controlled device properties and separate authorization, not an untrusted name.' because a mutable name string alone is a weak proof of managed device trust. The current scenario instead requires 'Design a supported device identity and enrollment migration including unjoin, re-registration, and data preservation steps.' and verification that a pilot device transitions under an approved plan with its new tenant record and user data intact.

This action is appropriate for a different case: A branch requires traditional on-premises domain authentication for line-of-business software while also using cloud-based identity policies. There, the targeted fix is 'Plan Microsoft Entra hybrid join with synchronized identity and valid domain connectivity.' because hybrid join retains an AD DS dependency while enabling Entra device identity. The current scenario instead requires 'Design a supported device identity and enrollment migration including unjoin, re-registration, and data preservation steps.' and verification that a pilot device transitions under an approved plan with its new tenant record and user data intact.

This action is appropriate for a different case: An endpoint team wants proactive insight into hardware performance regressions across a large fleet, beyond basic inventory. There, the targeted fix is 'Enable eligible Intune Advanced Analytics capabilities and review supported anomaly or risk insights.' because advanced analytics can surface patterns for deeper investigation and remediation decisions. The current scenario instead requires 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.' and verification that the pilot reports one supported application installation with the desired detected version.

This action is appropriate for a different case: An analytics dashboard shows severe startup time regression on a model whose drivers changed last week. There, the targeted fix is 'Correlate Advanced Analytics/Endpoint Analytics data with driver versions and recent deployment changes.' because a fleet anomaly needs causal evidence before reversing unrelated policies. The current scenario instead requires 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.' and verification that the pilot reports one supported application installation with the desired detected version.

This action is appropriate for a different case: A technician decides to allow all unknown executables to elevate because many help desk elevation requests are pending. There, the targeted fix is 'Review EPM elevation requests and create narrow approved rules rather than blanket authorization.' because EPM is meant to reduce uncontrolled standing privilege. The current scenario instead requires 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.' and verification that the pilot reports one supported application installation with the desired detected version.

This observation would validate a different case: A Windows quality update policy explicitly disables hotpatch while a tenant default enables it and the admin expects default precedence. It would check 'A pilot's update diagnostics show the targeted hotpatch setting is effective.' after 'Honor the effective device-assigned quality update policy when it overrides tenant hotpatch default.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot defers updates during the freeze and installs after the approved period.'.

This observation would validate a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. It would check 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.' after 'Check supervision and platform prerequisites before configuring Apple update enforcement.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot defers updates during the freeze and installs after the approved period.'.

This observation would validate a different case: A Windows device fails the feature update because of a safeguard hold while security fixes install normally. It would check 'The blocked feature update shows its precise hold while quality updates continue.' after 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot defers updates during the freeze and installs after the approved period.'.

This observation would validate a different case: A tenant's Intune service communications warn of a regional enrollment issue but support continues reinstalling Company Portal on every phone. It would check 'The incident is recorded as provider-side and new enrollment succeeds after recovery.' after 'Check Intune tenant status, service health and message center notifications first.'. It does not establish success for the stated scenario; the needed evidence is 'A sample export groups failures accurately by OS and enrollment profile.'.

This observation would validate a different case: An Intune report contains sensitive employee device details and should be shared with executives who need only risk totals. It would check 'Executives see accurate fleet trends without individual employee identifiers.' after 'Aggregate or redact user-level data and apply report access restrictions.'. It does not establish success for the stated scenario; the needed evidence is 'A sample export groups failures accurately by OS and enrollment profile.'.

This observation would validate a different case: An admin dashboard shows compliance percentages but hides the tenant's oldest policy evaluation timestamp. It would check 'Each sample device shows its latest status and actual last evaluation time.' after 'Expose freshness and evaluation-time metadata in monitoring reports.'. It does not establish success for the stated scenario; the needed evidence is 'A sample export groups failures accurately by OS and enrollment profile.'.

This action is appropriate for a different case: A mobile team pushes an Android Wi-Fi profile that references an enterprise certificate missing on the target devices. There, the targeted fix is 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.' because enterprise wireless access depends on correct certificate and EAP prerequisites. The current scenario instead requires 'Plan enrollment-time grouping and assignment precedence for critical first-login configurations.' and verification that the pilot receives the essential profile during setup rather than hours later.

This action is appropriate for a different case: An administrator needs to deploy browser restrictions to Windows devices but wants to avoid conflict with an existing security baseline. There, the targeted fix is 'Compare overlapping settings and select one authoritative assignment for each control.' because multiple policy sources can generate conflicting desired states. The current scenario instead requires 'Plan enrollment-time grouping and assignment precedence for critical first-login configurations.' and verification that the pilot receives the essential profile during setup rather than hours later.

This action is appropriate for a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. There, the targeted fix is 'Use Group Policy analytics to import and assess supported settings migration paths.' because analytics identifies candidate cloud-manageable settings before recreating GPOs. The current scenario instead requires 'Plan enrollment-time grouping and assignment precedence for critical first-login configurations.' and verification that the pilot receives the essential profile during setup rather than hours later.

This observation would validate a different case: Microsoft 365 Apps updates consume bandwidth at a remote site even though Windows Delivery Optimization is tuned. It would check 'Office updates complete under the chosen bandwidth and channel policy.' after 'Review Microsoft 365 Apps servicing configuration and distribution separately from Windows OS updates.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected path yields a successful detection while compliance state is unchanged.'.

This observation would validate a different case: A mobile app installed on an iPad is removed by users despite being required for device compliance tasks. It would check 'The supervised test iPad retains the required app after sync and the policy reports success.' after 'Use appropriate required app assignment and supervised device restrictions where supported.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected path yields a successful detection while compliance state is unchanged.'.

This observation would validate a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. It would check 'A targeted Windows device installs the accounting app silently and Intune reports success.' after 'Package it as a supported Intune Win32 app and configure the required install command.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected path yields a successful detection while compliance state is unchanged.'.

This action is appropriate for a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. There, the targeted fix is 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' because encryption management must preserve recovery information for authorized administrators. The current scenario instead requires 'Verify software provenance and route any exclusion request through approved security policy.' and verification that the approved signed installer runs without a general exclusions directory.

This action is appropriate for a different case: A business requires separate security baseline configurations for kiosks and ordinary employee laptops. There, the targeted fix is 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.' because endpoint risk and application compatibility differ by device role. The current scenario instead requires 'Verify software provenance and route any exclusion request through approved security policy.' and verification that the approved signed installer runs without a general exclusions directory.

This action is appropriate for a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. There, the targeted fix is 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.' because endpoint data protection and cloud device trust require separate response actions. The current scenario instead requires 'Verify software provenance and route any exclusion request through approved security policy.' and verification that the approved signed installer runs without a general exclusions directory.