Exam Bundle

This action is appropriate for a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. There, the targeted fix is 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' because encryption management must preserve recovery information for authorized administrators. The current scenario instead requires 'Verify software provenance and route any exclusion request through approved security policy.' and verification that the approved signed installer runs without a general exclusions directory.

This action is appropriate for a different case: A business requires separate security baseline configurations for kiosks and ordinary employee laptops. There, the targeted fix is 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.' because endpoint risk and application compatibility differ by device role. The current scenario instead requires 'Verify software provenance and route any exclusion request through approved security policy.' and verification that the approved signed installer runs without a general exclusions directory.

This action is appropriate for a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. There, the targeted fix is 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.' because endpoint data protection and cloud device trust require separate response actions. The current scenario instead requires 'Verify software provenance and route any exclusion request through approved security policy.' and verification that the approved signed installer runs without a general exclusions directory.

This observation would validate a different case: Enterprise users report duplicate Microsoft 365 Apps installations after both a Win32 Office package and an Intune suite deployment target the same computers. It would check 'Pilot devices report one approved Office installation and channel after cleanup.' after 'Choose one authoritative Microsoft 365 Apps deployment method and remove overlapping assignments.'. It does not establish success for the stated scenario; the needed evidence is 'Current app licenses sync into Intune and a pilot install succeeds.'.

This observation would validate a different case: A Windows Win32 app detection rule checks only a registry key that remains after uninstall, causing false positives. It would check 'A removed app shows not installed despite the leftover registry entry.' after 'Use a reliable detection strategy reflecting actual installed application state.'. It does not establish success for the stated scenario; the needed evidence is 'Current app licenses sync into Intune and a pilot install succeeds.'.

This observation would validate a different case: A user-based app assignment should follow an employee to a replacement device rather than remain on the original hardware ID. It would check 'The employee signs into the new enrolled device and receives the intended application.' after 'Assign supported apps to the appropriate Entra user group rather than only a stale device group.'. It does not establish success for the stated scenario; the needed evidence is 'Current app licenses sync into Intune and a pilot install succeeds.'.

This observation would validate a different case: A user with a personal phone signs into a protected Outlook app, but Conditional Access requires Intune-compliant device status that BYOD phones cannot meet. It would check 'The protected BYOD app signs in and an unsupported unprotected client is denied.' after 'Require an approved app protection policy in Conditional Access where supported instead of full device compliance.'. It does not establish success for the stated scenario; the needed evidence is 'The corporate app receives its server address and the BYOD version does not.'.

This observation would validate a different case: An Intune app protection policy requires data encryption, but the user reports that a supported app still opens without an app PIN. It would check 'The protected work account receives the intended PIN requirement.' after 'Inspect the targeted app list, account identity and effective policy settings.'. It does not establish success for the stated scenario; the needed evidence is 'The corporate app receives its server address and the BYOD version does not.'.

This observation would validate a different case: An administrator creates a strict app protection policy for Android and accidentally targets personal iPhones as well. It would check 'Android targets receive the rule and unrelated iOS users are unaffected.' after 'Use platform-specific app protection policies with precise assignment scopes.'. It does not establish success for the stated scenario; the needed evidence is 'The corporate app receives its server address and the BYOD version does not.'.

This action is appropriate for a different case: An enrollment error appears during iPad provisioning immediately after the Apple enrollment token was refreshed, but the profile assignment is missing. There, the targeted fix is 'Check the token synchronization and automated enrollment profile mapping for the actual device.' because token health and device-to-profile assignment must both be correct. The current scenario instead requires 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.' and verification that a corrected pilot membership receives compliance policies without enrolling again.

This action is appropriate for a different case: A company permits personal apps on its corporate Android phones but wants firm separation of employee and enterprise data. There, the targeted fix is 'Deploy Android Enterprise corporate-owned devices with work profile (COPE) enrollment.' because cOPE separates personal space while retaining corporate device ownership and policy. The current scenario instead requires 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.' and verification that a corrected pilot membership receives compliance policies without enrolling again.

This action is appropriate for a different case: A macOS Mac enrolled through Company Portal fails to receive management after the user denies the required profile installation. There, the targeted fix is 'Guide the user through supported macOS enrollment approval and verify the management profile.' because user-approved enrollment needs a valid installed MDM profile on the Mac. The current scenario instead requires 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.' and verification that a corrected pilot membership receives compliance policies without enrolling again.

This action is appropriate for a different case: Two Android departments share a device group, but only warehouse devices should receive a barcode-scanning restriction. There, the targeted fix is 'Split assignments using trusted device attributes and supported filters or group membership.' because broad assignments can apply vendor-specific controls to the wrong devices. The current scenario instead requires 'Use supported Zebra/OEMConfig or specialty-device settings for targeted rugged-device groups.' and verification that a pilot Zebra scanner receives the intended profile and other Android phones are unaffected.

This action is appropriate for a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. There, the targeted fix is 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' because some Apple configuration controls depend on supervision and ownership. The current scenario instead requires 'Use supported Zebra/OEMConfig or specialty-device settings for targeted rugged-device groups.' and verification that a pilot Zebra scanner receives the intended profile and other Android phones are unaffected.

This action is appropriate for a different case: An administrator assigns a corporate VPN profile to every iOS device but wants it only on devices with a supported OS version. There, the targeted fix is 'Use appropriate Intune assignment filters alongside group targeting.' because filters can refine assignment eligibility using supported device properties. The current scenario instead requires 'Use supported Zebra/OEMConfig or specialty-device settings for targeted rugged-device groups.' and verification that a pilot Zebra scanner receives the intended profile and other Android phones are unaffected.

This observation would validate a different case: A Windows endpoint is missing from an Entra dynamic group because its directory attributes have not synchronized. It would check 'The updated attributes place the endpoint in the group without a standing manual workaround.' after 'Confirm directory synchronization and membership processing before manually adding a permanent exception.'. It does not establish success for the stated scenario; the needed evidence is 'A test Windows device joins the intended group and a test macOS device does not.'.

This observation would validate a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. It would check 'A test shared device is enrolled under the approved ownership workflow without a permanent user affinity.' after 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.'. It does not establish success for the stated scenario; the needed evidence is 'A test Windows device joins the intended group and a test macOS device does not.'.

This observation would validate a different case: An administrator wants to restrict a sensitive app to devices that are company-managed and mistakenly assumes Entra join guarantees security compliance. It would check 'A joined noncompliant laptop is blocked, while a joined compliant one passes the test policy.' after 'Combine appropriate managed device identity with evaluated Intune compliance and Conditional Access requirements.'. It does not establish success for the stated scenario; the needed evidence is 'A test Windows device joins the intended group and a test macOS device does not.'.

This action is appropriate for a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. There, the targeted fix is 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.' because shared-use devices should not inherit an arbitrary employee's personal management scope. The current scenario instead requires 'Validate the rule syntax and supported device attributes, then inspect membership processing results.' and verification that the corrected group evaluates test device properties to the expected membership outcome.

This action is appropriate for a different case: An acquired company has devices in a different Microsoft Entra tenant and plans to enroll them directly into the new tenant without transitioning ownership. There, the targeted fix is 'Design a supported device identity and enrollment migration including unjoin, re-registration, and data preservation steps.' because an enrolled device is tied to its source tenant and cannot be reassigned by display-name change. The current scenario instead requires 'Validate the rule syntax and supported device attributes, then inspect membership processing results.' and verification that the corrected group evaluates test device properties to the expected membership outcome.

This action is appropriate for a different case: New company laptops unexpectedly enroll under personal ownership when users register work accounts manually. There, the targeted fix is 'Use the approved corporate provisioning and ownership recognition workflow.' because manual account association can differ from organization-controlled provisioning. The current scenario instead requires 'Validate the rule syntax and supported device attributes, then inspect membership processing results.' and verification that the corrected group evaluates test device properties to the expected membership outcome.

This action is appropriate for a different case: An endpoint team wants proactive insight into hardware performance regressions across a large fleet, beyond basic inventory. There, the targeted fix is 'Enable eligible Intune Advanced Analytics capabilities and review supported anomaly or risk insights.' because advanced analytics can surface patterns for deeper investigation and remediation decisions. The current scenario instead requires 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.' and verification that a pilot app installs from the catalog and updates to an approved newer release.

This action is appropriate for a different case: A Cloud PKI test profile uses a wrong certificate subject name, so a VPN gateway rejects otherwise trusted certificates. There, the targeted fix is 'Adjust certificate template subject/usage requirements and reissue affected test certificates.' because trust is not enough if certificate identity or extended key usage is wrong. The current scenario instead requires 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.' and verification that a pilot app installs from the catalog and updates to an approved newer release.

This action is appropriate for a different case: A Microsoft Tunnel gateway is online but unenrolled Android users cannot start application-specific connections. There, the targeted fix is 'Check Tunnel for MAM application configuration, gateway status and supported client integration.' because gateway reachability does not guarantee a MAM policy correctly invokes it. The current scenario instead requires 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.' and verification that a pilot app installs from the catalog and updates to an approved newer release.

This observation would validate a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. It would check 'The licensed test user receives a Cloud PC while unlicensed requests remain blocked.' after 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.'. It does not establish success for the stated scenario; the needed evidence is 'The approved eligible devices upgrade and blocked hardware shows a documented reason.'.

This observation would validate a different case: A Windows Backup restore is offered during new Windows device setup but organizational policy forbids unmanaged personal restore sources. It would check 'A pilot restores permitted settings while blocked personal restore content is not introduced.' after 'Configure Windows Backup and restore policy with approved organizational device settings.'. It does not establish success for the stated scenario; the needed evidence is 'The approved eligible devices upgrade and blocked hardware shows a documented reason.'.

This observation would validate a different case: A company provisions Windows 365 Enterprise Cloud PCs but the chosen provisioning policy uses a network that lacks required connectivity. It would check 'A pilot Cloud PC provisions successfully and reaches approved corporate resources.' after 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.'. It does not establish success for the stated scenario; the needed evidence is 'The approved eligible devices upgrade and blocked hardware shows a documented reason.'.

This action is appropriate for a different case: An admin needs to deploy Cloud PCs to a different network without changing production provisioning policies for every existing user. There, the targeted fix is 'Create a tested dedicated Windows 365 provisioning policy for the new group and network.' because policy scoping can separate target cohorts without uncontrolled tenant-wide migration. The current scenario instead requires 'Verify TPM and Autopilot pre-provisioning eligibility before retrying or selecting another mode.' and verification that an eligible test device completes the technician phase and the ineligible device is identified.

This action is appropriate for a different case: A company provisions Windows 365 Enterprise Cloud PCs but the chosen provisioning policy uses a network that lacks required connectivity. There, the targeted fix is 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.' because Cloud PC creation requires a viable network and identity architecture. The current scenario instead requires 'Verify TPM and Autopilot pre-provisioning eligibility before retrying or selecting another mode.' and verification that an eligible test device completes the technician phase and the ineligible device is identified.

This action is appropriate for a different case: A business moves employees between Windows 365 Cloud PCs but misinterprets reprovisioning as a simple reboot. There, the targeted fix is 'Use the supported Cloud PC reprovisioning lifecycle only after confirming expected data impact.' because reprovisioning can replace managed virtual devices and may not preserve local state. The current scenario instead requires 'Verify TPM and Autopilot pre-provisioning eligibility before retrying or selecting another mode.' and verification that an eligible test device completes the technician phase and the ineligible device is identified.

This action is appropriate for a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. There, the targeted fix is 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' because encryption management must preserve recovery information for authorized administrators. The current scenario instead requires 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' and verification that a controlled macro-based process launch is blocked without harming approved documents.

This action is appropriate for a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. There, the targeted fix is 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.' because firmware and TPM changes can affect boot trust and recovery without indicating absent encryption. The current scenario instead requires 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' and verification that a controlled macro-based process launch is blocked without harming approved documents.

This action is appropriate for a different case: A device receives two security baseline profiles that set conflicting Windows Defender options. There, the targeted fix is 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' because security baselines are configurable templates that can conflict with other policies. The current scenario instead requires 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' and verification that a controlled macro-based process launch is blocked without harming approved documents.