Exam Bundle

This action is appropriate for a different case: An administrator wants to restrict a sensitive app to devices that are company-managed and mistakenly assumes Entra join guarantees security compliance. There, the targeted fix is 'Combine appropriate managed device identity with evaluated Intune compliance and Conditional Access requirements.' because identity ownership and actual security posture are separate trust signals. The current scenario instead requires 'Use stable provider-enumerated device properties and verified managed inventory data for reporting groups.' and verification that an inventory check classifies sampled devices accurately despite arbitrary renamed devices.

This action is appropriate for a different case: An Entra-registered personal phone is replaced, but the old device remains in the account's list long after retirement. There, the targeted fix is 'Use a verified stale registration cleanup process respecting user and enrollment ownership.' because orphaned identities distort device inventory and risk decisions. The current scenario instead requires 'Use stable provider-enumerated device properties and verified managed inventory data for reporting groups.' and verification that an inventory check classifies sampled devices accurately despite arbitrary renamed devices.

This action is appropriate for a different case: A manufacturer issues company-owned Windows laptops and wants device-based single sign-on without maintaining on-premises domain join. There, the targeted fix is 'Choose Microsoft Entra join for cloud-native corporate devices and assign managed enrollment.' because Entra join establishes organization-owned cloud identity without requiring local Active Directory. The current scenario instead requires 'Use stable provider-enumerated device properties and verified managed inventory data for reporting groups.' and verification that an inventory check classifies sampled devices accurately despite arbitrary renamed devices.

This observation would validate a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. It would check 'The protected app removes corporate documents but the user's personal content remains.' after 'Trigger selective corporate app data wipe for the managed identity where supported.'. It does not establish success for the stated scenario; the needed evidence is 'Tests show each account can access only its authorized data in the protected app.'.

This observation would validate a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. It would check 'Work content pastes into an approved work app but not an unprotected personal app.' after 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.'. It does not establish success for the stated scenario; the needed evidence is 'Tests show each account can access only its authorized data in the protected app.'.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'Tests show each account can access only its authorized data in the protected app.'.

This action is appropriate for a different case: Windows clients are marked pending restart after the monthly cumulative patch, and compliance reports show older build versions. There, the targeted fix is 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.' because installed updates may require reboot to become fully effective. The current scenario instead requires 'Explain and plan baseline cumulative updates that require reboot alongside hotpatch months.' and verification that the maintenance schedule shows baseline reboots and hotpatch months are documented separately.

This action is appropriate for a different case: A Windows device fails the feature update because of a safeguard hold while security fixes install normally. There, the targeted fix is 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.' because feature and quality update failure paths can be independent. The current scenario instead requires 'Explain and plan baseline cumulative updates that require reboot alongside hotpatch months.' and verification that the maintenance schedule shows baseline reboots and hotpatch months are documented separately.

This action is appropriate for a different case: A Windows update ring has conflicting deferral settings with a feature update policy and machines move to a release that was not approved. There, the targeted fix is 'Inspect effective update policies and correct overlapping feature controls.' because multiple policy types influence Windows Update behavior. The current scenario instead requires 'Explain and plan baseline cumulative updates that require reboot alongside hotpatch months.' and verification that the maintenance schedule shows baseline reboots and hotpatch months are documented separately.

This action is appropriate for a different case: A support technician manually edits the local Windows firewall after Intune policy applies, and the next sync reverses their change. There, the targeted fix is 'Manage required settings through the authoritative Intune configuration policy instead of permanent local exceptions.' because MDM can reapply centrally assigned settings during check-in. The current scenario instead requires 'Apply controlled phased assignments and monitored pilot rings for Intune settings.' and verification that the pilot proves the setting and later cohorts remain unchanged until promotion.

This action is appropriate for a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. There, the targeted fix is 'Use Group Policy analytics to import and assess supported settings migration paths.' because analytics identifies candidate cloud-manageable settings before recreating GPOs. The current scenario instead requires 'Apply controlled phased assignments and monitored pilot rings for Intune settings.' and verification that the pilot proves the setting and later cohorts remain unchanged until promotion.

This action is appropriate for a different case: A Mac configuration profile is marked succeeded but the security restriction is absent on one OS release. There, the targeted fix is 'Validate macOS version support and applicable payload settings before broad rollout.' because platform settings availability changes with OS and supervision support. The current scenario instead requires 'Apply controlled phased assignments and monitored pilot rings for Intune settings.' and verification that the pilot proves the setting and later cohorts remain unchanged until promotion.

This observation would validate a different case: A corporate iPhone user removes Company Portal and expects the supervised automated enrollment state to disappear. It would check 'After app removal the test device remains supervised and applicable MDM policy stays intact.' after 'Explain and manage corporate supervision through Apple automated enrollment rather than app removal.'. It does not establish success for the stated scenario; the needed evidence is 'A test managed application synchronizes into Intune and becomes assignable.'.

This observation would validate a different case: A chain purchases Android handsets in bulk and wants zero-touch registration when users first power them on. It would check 'An eligible reseller-uploaded device automatically receives the intended Intune enrollment configuration.' after 'Integrate compatible Android zero-touch enrollment with Intune configuration assignments.'. It does not establish success for the stated scenario; the needed evidence is 'A test managed application synchronizes into Intune and becomes assignable.'.

This observation would validate a different case: A corporate Mac needs zero-touch setup tied to Apple Business Manager but its serial is not assigned to the Intune MDM server. It would check 'A wiped Mac proceeds through organization-owned management during Setup Assistant.' after 'Assign the Mac to the right ABM server and sync its automated enrollment profile.'. It does not establish success for the stated scenario; the needed evidence is 'A test managed application synchronizes into Intune and becomes assignable.'.

This action is appropriate for a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. There, the targeted fix is 'Use managed-device app configuration targeting appropriate device groups.' because corporate managed device settings should not be broadcast to personal installations. The current scenario instead requires 'Trigger selective corporate app data wipe for the managed identity where supported.' and verification that the protected app removes corporate documents but the user's personal content remains.

This action is appropriate for a different case: A contractor has two organizational accounts on the same phone and one department must be unable to access the other's protected app data. There, the targeted fix is 'Plan per-identity app protection and access boundaries with separate Conditional Access scopes.' because work identity context matters when a device has multiple tenants or accounts. The current scenario instead requires 'Trigger selective corporate app data wipe for the managed identity where supported.' and verification that the protected app removes corporate documents but the user's personal content remains.

This action is appropriate for a different case: Employees bring personal phones to work and the company must prevent corporate documents from being copied into unmanaged messaging apps. There, the targeted fix is 'Create an Intune app protection policy restricting transfer of organizational data to unmanaged apps.' because MAM data protection can apply to supported work apps without full device management. The current scenario instead requires 'Trigger selective corporate app data wipe for the managed identity where supported.' and verification that the protected app removes corporate documents but the user's personal content remains.

This action is appropriate for a different case: A laptop’s BitLocker key was disclosed to a former contractor and merely hiding it from the portal is proposed as remediation. There, the targeted fix is 'Rotate the BitLocker recovery key and confirm replacement escrow under authorized access.' because credential disclosure calls for revocation/rotation rather than cosmetic access changes. The current scenario instead requires 'Replace the broad Defender exclusion with a narrowly justified and approved path/process rule.' and verification that the legitimate workload succeeds while a controlled test file outside the narrow exclusion is scanned.

This action is appropriate for a different case: App Control for Business enforcement blocks an essential finance application after a vendor update changed its signing certificate. There, the targeted fix is 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.' because overly narrow allow rules can unintentionally block updated legitimate software. The current scenario instead requires 'Replace the broad Defender exclusion with a narrowly justified and approved path/process rule.' and verification that the legitimate workload succeeds while a controlled test file outside the narrow exclusion is scanned.

This action is appropriate for a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. There, the targeted fix is 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.' because endpoint data protection and cloud device trust require separate response actions. The current scenario instead requires 'Replace the broad Defender exclusion with a narrowly justified and approved path/process rule.' and verification that the legitimate workload succeeds while a controlled test file outside the narrow exclusion is scanned.

This action is appropriate for a different case: A security team needs to audit which EPM-elevated executables employees actually run across a pilot fleet. There, the targeted fix is 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.' because privileged execution should be monitored to detect policy misuse. The current scenario instead requires 'Tighten EPM rules to approved publisher, file, certificate or hash criteria as supported.' and verification that the approved executable elevates and a same-named unsigned test binary is denied.

This action is appropriate for a different case: An enterprise needs to deploy a commonly used third-party Windows app and does not want to maintain every vendor installer version manually. There, the targeted fix is 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.' because the catalog can simplify packaging and update lifecycle for supported applications. The current scenario instead requires 'Tighten EPM rules to approved publisher, file, certificate or hash criteria as supported.' and verification that the approved executable elevates and a same-named unsigned test binary is denied.

This action is appropriate for a different case: A help desk needs remote interactive assistance for users but employees should be able to grant consent to support sessions. There, the targeted fix is 'Configure Microsoft Intune Remote Help with approved roles, tenant configuration and consent behavior.' because remote assistance should be governed and attributable to authorized support staff. The current scenario instead requires 'Tighten EPM rules to approved publisher, file, certificate or hash criteria as supported.' and verification that the approved executable elevates and a same-named unsigned test binary is denied.

This observation would validate a different case: The company wants SCEP or PKCS certificates without maintaining its own full on-premises certificate authority. It would check 'A pilot device receives a valid certificate whose issuer chain is accepted by its service.' after 'Plan Microsoft Cloud PKI and required Intune certificate profiles and trust chains.'. It does not establish success for the stated scenario; the needed evidence is 'The new pilot release is reported installed and a missing app is detected as absent.'.

This observation would validate a different case: An EPM elevation rule matches any application with a loose name and unexpectedly grants admin privilege to an unapproved binary. It would check 'The approved executable elevates and a same-named unsigned test binary is denied.' after 'Tighten EPM rules to approved publisher, file, certificate or hash criteria as supported.'. It does not establish success for the stated scenario; the needed evidence is 'The new pilot release is reported installed and a missing app is detected as absent.'.

This observation would validate a different case: A Microsoft Tunnel gateway is online but unenrolled Android users cannot start application-specific connections. It would check 'The test protected application establishes an authorized tunnel and its status reports healthy.' after 'Check Tunnel for MAM application configuration, gateway status and supported client integration.'. It does not establish success for the stated scenario; the needed evidence is 'The new pilot release is reported installed and a missing app is detected as absent.'.

This observation would validate a different case: A company wants Windows 11 monthly security updates delivered in predictable pilot and broad rings with different restart windows. It would check 'Pilot devices patch first and broader devices follow after a monitored validation window.' after 'Configure Intune Windows update rings with staged assignments and appropriate deadlines.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot Samsung device reports the intended firmware build after its FOTA policy.'.

This observation would validate a different case: A Windows client has a pending update and the restart schedule interrupts clinical workstations during business hours. It would check 'Pilot workstations install updates and restart within the specified maintenance policy.' after 'Adjust appropriate Windows update ring active hours and restart deadline controls.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot Samsung device reports the intended firmware build after its FOTA policy.'.

This observation would validate a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. It would check 'Pilot Macs report the approved OS version after the assigned update window.' after 'Deploy supported macOS software update policy through the Intune Settings Catalog.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot Samsung device reports the intended firmware build after its FOTA policy.'.

This observation would validate a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. It would check 'The query returns only eligible devices with the vulnerable app version.' after 'Use the supported Intune device query with valid KQL and an appropriate scope.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint receives policies without losing user data.'.

This observation would validate a different case: An Intune device record shows 'retire pending' yet security operations claims corporate data has been removed from an offline phone. It would check 'A test report tracks pending and completed states separately with last contact time.' after 'Distinguish queued retirement from confirmed device-side completion.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint receives policies without losing user data.'.

This observation would validate a different case: A Windows laptop's Intune diagnostics are too old to explain a policy deployment failure after the latest OS upgrade. It would check 'The support case includes post-upgrade logs tied to the affected profile ID.' after 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint receives policies without losing user data.'.