Exam Bundle

This action is appropriate for a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. There, the targeted fix is 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' because encryption management must preserve recovery information for authorized administrators. The current scenario instead requires 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' and verification that a controlled macro-based process launch is blocked without harming approved documents.

This action is appropriate for a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. There, the targeted fix is 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.' because firmware and TPM changes can affect boot trust and recovery without indicating absent encryption. The current scenario instead requires 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' and verification that a controlled macro-based process launch is blocked without harming approved documents.

This action is appropriate for a different case: A device receives two security baseline profiles that set conflicting Windows Defender options. There, the targeted fix is 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' because security baselines are configurable templates that can conflict with other policies. The current scenario instead requires 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.' and verification that a controlled macro-based process launch is blocked without harming approved documents.

This action is appropriate for a different case: A user complains that an optional productivity tool installs on every corporate phone without consent. There, the targeted fix is 'Change the Intune app assignment from Required to Available where appropriate.' because required and available assignments create different deployment experiences. The current scenario instead requires 'Choose the supported Microsoft Store app deployment method within Intune.' and verification that the test Store application becomes available and installs from its current source.

This action is appropriate for a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. There, the targeted fix is 'Package it as a supported Intune Win32 app and configure the required install command.' because Win32 app packaging supports installation of traditional desktop software with monitoring. The current scenario instead requires 'Choose the supported Microsoft Store app deployment method within Intune.' and verification that the test Store application becomes available and installs from its current source.

This action is appropriate for a different case: An internal line-of-business Windows app uses an MSI package and needs quiet installation across managed PCs. There, the targeted fix is 'Deploy the application using the appropriate Intune LOB/Win32 app packaging approach.' because install format and management needs determine the supported deployment method. The current scenario instead requires 'Choose the supported Microsoft Store app deployment method within Intune.' and verification that the test Store application becomes available and installs from its current source.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app permits company OneDrive and blocks personal destinations.'.

This observation would validate a different case: A company wants managed iOS and Android apps to receive a company tenant identifier without requiring users to type it every launch. It would check 'The targeted app starts with the right corporate tenant and no manual text entry.' after 'Use supported app configuration policies for managed apps or devices according to enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app permits company OneDrive and blocks personal destinations.'.

This observation would validate a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. It would check 'The work browser opens the approved home page while personal browsing remains untouched.' after 'Use managed app configuration for the supported work browser and targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'The protected app permits company OneDrive and blocks personal destinations.'.

This observation would validate a different case: A contractor attempts to use Remote Help to control devices outside their scope tag and role assignment. It would check 'The contractor can assist the approved device but cannot start an unauthorized session.' after 'Limit Remote Help permissions and device scope through supported RBAC arrangements.'. It does not establish success for the stated scenario; the needed evidence is 'The approved utility works and unrelated command execution does not gain admin rights.'.

This observation would validate a different case: A Tunnel for MAM deployment sends unrelated personal device traffic into the corporate network instead of only the approved managed app. It would check 'Only the approved corporate app's requests traverse the tunnel during a controlled test.' after 'Constrain tunnel configuration and application policy to permitted work-app traffic.'. It does not establish success for the stated scenario; the needed evidence is 'The approved utility works and unrelated command execution does not gain admin rights.'.

This observation would validate a different case: An enterprise needs to deploy a commonly used third-party Windows app and does not want to maintain every vendor installer version manually. It would check 'A pilot app installs from the catalog and updates to an approved newer release.' after 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.'. It does not establish success for the stated scenario; the needed evidence is 'The approved utility works and unrelated command execution does not gain admin rights.'.

This observation would validate a different case: Windows clients are marked pending restart after the monthly cumulative patch, and compliance reports show older build versions. It would check 'After managed restart the pilot reports the new build and update-compliant state.' after 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot receives hotpatch while an ineligible PC takes the normal cumulative update path.'.

This observation would validate a different case: A Windows update fails only on one device model after a firmware revision and the team considers blocking all tenant updates. It would check 'The affected model is paused for remediation while other cohorts continue patching.' after 'Use per-model diagnostics and staged targeting to isolate the compatibility defect.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot receives hotpatch while an ineligible PC takes the normal cumulative update path.'.

This observation would validate a different case: A Windows update ring has conflicting deferral settings with a feature update policy and machines move to a release that was not approved. It would check 'The corrected pilot remains on the approved target release through the test update cycle.' after 'Inspect effective update policies and correct overlapping feature controls.'. It does not establish success for the stated scenario; the needed evidence is 'An eligible pilot receives hotpatch while an ineligible PC takes the normal cumulative update path.'.

This action is appropriate for a different case: A business relies on a legacy Windows 32-bit app that fails silently on a Windows 11 machine and shows an Intune error. There, the targeted fix is 'Collect Intune Management Extension logs and app installer exit codes before modifying detection.' because an installation failure must be distinguished from platform incompatibility. The current scenario instead requires 'Use the supported Teams Rooms app servicing and specialized device management path.' and verification that the room console receives the approved client version without unsupported Office installation.

This action is appropriate for a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. There, the targeted fix is 'Use supported app applicability rules plus appropriate assignment filters.' because being targeted does not make an incompatible OS able to install the app. The current scenario instead requires 'Use the supported Teams Rooms app servicing and specialized device management path.' and verification that the room console receives the approved client version without unsupported Office installation.

This action is appropriate for a different case: A managed Android app must suppress work notifications outside working hours for employee well-being. There, the targeted fix is 'Configure supported Android Quiet Time policy for eligible managed applications.' because quiet Time can limit work app interruptions without blocking personal phone use. The current scenario instead requires 'Use the supported Teams Rooms app servicing and specialized device management path.' and verification that the room console receives the approved client version without unsupported Office installation.

This action is appropriate for a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. There, the targeted fix is 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.' because pre-registration and actual MDM enrollment are separate lifecycle stages. The current scenario instead requires 'Assign the Mac to the right ABM server and sync its automated enrollment profile.' and verification that a wiped Mac proceeds through organization-owned management during Setup Assistant.

This action is appropriate for a different case: A device enrolls but its compliance policy never arrives because it is placed in an unexpectedly excluded dynamic group. There, the targeted fix is 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.' because enrollment success does not imply every policy is targeted. The current scenario instead requires 'Assign the Mac to the right ABM server and sync its automated enrollment profile.' and verification that a wiped Mac proceeds through organization-owned management during Setup Assistant.

This action is appropriate for a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. There, the targeted fix is 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.' because personal devices should not inherit corporate supervised device restrictions. The current scenario instead requires 'Assign the Mac to the right ABM server and sync its automated enrollment profile.' and verification that a wiped Mac proceeds through organization-owned management during Setup Assistant.

This observation would validate a different case: Windows devices require a browser security setting available in the Intune settings catalog, but the admin creates an unrelated compliance rule. It would check 'The expected browser setting appears effective on targeted Windows pilot devices.' after 'Create a Windows device configuration profile using the supported settings catalog control.'. It does not establish success for the stated scenario; the needed evidence is 'A clean Mac and an existing Mac converge on the same approved configuration after sync.'.

This observation would validate a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. It would check 'A migration report distinguishes supported controls from ones needing redesign.' after 'Use Group Policy analytics to import and assess supported settings migration paths.'. It does not establish success for the stated scenario; the needed evidence is 'A clean Mac and an existing Mac converge on the same approved configuration after sync.'.

This observation would validate a different case: A device configuration profile is changed but its rollout has no staged group, causing an immediate company-wide restriction. It would check 'The pilot proves the setting and later cohorts remain unchanged until promotion.' after 'Apply controlled phased assignments and monitored pilot rings for Intune settings.'. It does not establish success for the stated scenario; the needed evidence is 'A clean Mac and an existing Mac converge on the same approved configuration after sync.'.

This observation would validate a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. It would check 'OOBE finishes with essentials and remaining applications deploy after check-in.' after 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.'. It does not establish success for the stated scenario; the needed evidence is 'A remote employee signs in at OOBE and reaches the managed desktop with required configuration.'.

This observation would validate a different case: A company provisions Windows 365 Enterprise Cloud PCs but the chosen provisioning policy uses a network that lacks required connectivity. It would check 'A pilot Cloud PC provisions successfully and reaches approved corporate resources.' after 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.'. It does not establish success for the stated scenario; the needed evidence is 'A remote employee signs in at OOBE and reaches the managed desktop with required configuration.'.

This observation would validate a different case: Users complain that newly provisioned Cloud PCs are created in the wrong geographic location for data residency requirements. It would check 'A sample Cloud PC resides in the approved region and passes jurisdiction checks.' after 'Review provisioning policy region and supported placement settings before creating new Cloud PCs.'. It does not establish success for the stated scenario; the needed evidence is 'A remote employee signs in at OOBE and reaches the managed desktop with required configuration.'.

This observation would validate a different case: A corporate iPad should install a paid in-house app purchased through Apple Business Manager without personal Apple IDs. It would check 'A supervised iPad installs the licensed app under corporate management.' after 'Sync Apps and Books with Intune and assign the licensed application appropriately.'. It does not establish success for the stated scenario; the needed evidence is 'A removed app shows not installed despite the leftover registry entry.'.

This observation would validate a different case: Microsoft 365 Apps are installed with an undesired language despite an assigned corporate default. It would check 'The pilot Office UI and installed language packs match the approved configuration.' after 'Configure Microsoft 365 Apps language selections or deployment XML appropriately.'. It does not establish success for the stated scenario; the needed evidence is 'A removed app shows not installed despite the leftover registry entry.'.

This observation would validate a different case: Apple Business Manager's Apps and Books token expires and new app assignments stop synchronizing. It would check 'Current app licenses sync into Intune and a pilot install succeeds.' after 'Renew the managed Apps and Books location token and verify license sync.'. It does not establish success for the stated scenario; the needed evidence is 'A removed app shows not installed despite the leftover registry entry.'.

This action is appropriate for a different case: An administrator uses an Intune app assignment filter to include a device whose OS version does not support the app's minimum requirement. There, the targeted fix is 'Use supported app applicability rules plus appropriate assignment filters.' because being targeted does not make an incompatible OS able to install the app. The current scenario instead requires 'Verify application licensing and assigned user entitlement after confirming installation.' and verification that a licensed pilot user launches the app and an unlicensed test gets a controlled denial.

This action is appropriate for a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. There, the targeted fix is 'Package it as a supported Intune Win32 app and configure the required install command.' because Win32 app packaging supports installation of traditional desktop software with monitoring. The current scenario instead requires 'Verify application licensing and assigned user entitlement after confirming installation.' and verification that a licensed pilot user launches the app and an unlicensed test gets a controlled denial.

This action is appropriate for a different case: An organization replaces an outdated VPN client with a new version and wants the old package removed reliably. There, the targeted fix is 'Configure Intune app supersedence with the intended replacement and uninstall behavior.' because supersedence can coordinate upgrade or replacement of related Win32 applications. The current scenario instead requires 'Verify application licensing and assigned user entitlement after confirming installation.' and verification that a licensed pilot user launches the app and an unlicensed test gets a controlled denial.