Exam Bundle

This observation would validate a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. It would check 'The query returns only eligible devices with the vulnerable app version.' after 'Use the supported Intune device query with valid KQL and an appropriate scope.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint receives policies without losing user data.'.

This observation would validate a different case: An Intune device record shows 'retire pending' yet security operations claims corporate data has been removed from an offline phone. It would check 'A test report tracks pending and completed states separately with last contact time.' after 'Distinguish queued retirement from confirmed device-side completion.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint receives policies without losing user data.'.

This observation would validate a different case: A Windows laptop's Intune diagnostics are too old to explain a policy deployment failure after the latest OS upgrade. It would check 'The support case includes post-upgrade logs tied to the affected profile ID.' after 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.'. It does not establish success for the stated scenario; the needed evidence is 'The test endpoint receives policies without losing user data.'.

This action is appropriate for a different case: Windows clients are marked pending restart after the monthly cumulative patch, and compliance reports show older build versions. There, the targeted fix is 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.' because installed updates may require reboot to become fully effective. The current scenario instead requires 'Use an eligible expedited quality update policy with targeted monitoring.' and verification that affected devices report the designated quality update within the approved urgent deadline.

This action is appropriate for a different case: Android work-profile devices must not be interrupted by a forced OS update during a defined maintenance freeze. There, the targeted fix is 'Use supported Android system-update policies or OEM configuration suited to the ownership mode.' because Android update controls vary by management mode and manufacturer. The current scenario instead requires 'Use an eligible expedited quality update policy with targeted monitoring.' and verification that affected devices report the designated quality update within the approved urgent deadline.

This action is appropriate for a different case: A user wants to apply hotpatch on any Windows 11 computer with no regard for supported edition or baseline. There, the targeted fix is 'Check hotpatch eligibility, supported OS/architecture and necessary baseline state before enabling policy.' because hotpatch is conditional on device prerequisites and its baseline lifecycle. The current scenario instead requires 'Use an eligible expedited quality update policy with targeted monitoring.' and verification that affected devices report the designated quality update within the approved urgent deadline.

This action is appropriate for a different case: A Windows update ring has conflicting deferral settings with a feature update policy and machines move to a release that was not approved. There, the targeted fix is 'Inspect effective update policies and correct overlapping feature controls.' because multiple policy types influence Windows Update behavior. The current scenario instead requires 'Check supervision and platform prerequisites before configuring Apple update enforcement.' and verification that the eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.

This action is appropriate for a different case: A company wants Windows 11 monthly security updates delivered in predictable pilot and broad rings with different restart windows. There, the targeted fix is 'Configure Intune Windows update rings with staged assignments and appropriate deadlines.' because update rings manage cadence and user experience for eligible quality updates. The current scenario instead requires 'Check supervision and platform prerequisites before configuring Apple update enforcement.' and verification that the eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.

This action is appropriate for a different case: The security team notices Windows 365 Cloud PCs receive updates far later than physical laptops. There, the targeted fix is 'Check Cloud PC update policy assignment and Windows Autopatch/Intune targeting.' because Cloud PCs are managed endpoints whose update policy must be explicitly effective. The current scenario instead requires 'Check supervision and platform prerequisites before configuring Apple update enforcement.' and verification that the eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.

This observation would validate a different case: A user enrolls a second Windows machine and receives an Intune maximum device count failure. It would check 'The approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.' after 'Check enrollment device limits and approved user quota rather than deleting unrelated devices.'. It does not establish success for the stated scenario; the needed evidence is 'The approved pilot BYOD phone enrolls while disallowed device types still fail.'.

This observation would validate a different case: A device enrolls but its compliance policy never arrives because it is placed in an unexpectedly excluded dynamic group. It would check 'A corrected pilot membership receives compliance policies without enrolling again.' after 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'The approved pilot BYOD phone enrolls while disallowed device types still fail.'.

This observation would validate a different case: A chain purchases Android handsets in bulk and wants zero-touch registration when users first power them on. It would check 'An eligible reseller-uploaded device automatically receives the intended Intune enrollment configuration.' after 'Integrate compatible Android zero-touch enrollment with Intune configuration assignments.'. It does not establish success for the stated scenario; the needed evidence is 'The approved pilot BYOD phone enrolls while disallowed device types still fail.'.

This action is appropriate for a different case: A company wants standard users to elevate one approved IT utility without granting permanent local administrator access. There, the targeted fix is 'Configure Intune Endpoint Privilege Management (EPM) elevation policies for that signed and approved app.' because just-in-time elevation narrows privilege compared with standing administrator membership. The current scenario instead requires 'Evaluate Microsoft Tunnel for MAM with the required gateway, app policy and tenant prerequisites.' and verification that a protected app accesses its allowed internal endpoint while other personal apps cannot use the tunnel.

This action is appropriate for a different case: A Cloud PKI test profile uses a wrong certificate subject name, so a VPN gateway rejects otherwise trusted certificates. There, the targeted fix is 'Adjust certificate template subject/usage requirements and reissue affected test certificates.' because trust is not enough if certificate identity or extended key usage is wrong. The current scenario instead requires 'Evaluate Microsoft Tunnel for MAM with the required gateway, app policy and tenant prerequisites.' and verification that a protected app accesses its allowed internal endpoint while other personal apps cannot use the tunnel.

This action is appropriate for a different case: Advanced Analytics recommends a configuration change that could affect every endpoint, but the operations team plans immediate mass deployment. There, the targeted fix is 'Validate the recommendation on a staged group before broad policy assignment.' because an insight is decision support, not authorization for uncontrolled changes. The current scenario instead requires 'Evaluate Microsoft Tunnel for MAM with the required gateway, app policy and tenant prerequisites.' and verification that a protected app accesses its allowed internal endpoint while other personal apps cannot use the tunnel.

This observation would validate a different case: A corporate application fails because a security admin created an outbound firewall rule that blocks its authorized API endpoint. It would check 'The application connects to the approved API and unrelated destinations remain blocked.' after 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.'. It does not establish success for the stated scenario; the needed evidence is 'Security reports show one applied scan schedule and no unresolved conflicts.'.

This observation would validate a different case: An organization wants standardized endpoint detection and response policies rather than installing separate scripts on every workstation. It would check 'Selected Windows devices show the expected EDR configuration and sensor health.' after 'Deploy Intune EDR endpoint security policies with supported Defender integration.'. It does not establish success for the stated scenario; the needed evidence is 'Security reports show one applied scan schedule and no unresolved conflicts.'.

This observation would validate a different case: A company's endpoints are enrolled in Intune but Defender XDR shows duplicate security device entries after rebuilding laptops. It would check 'Only the active security record is used for triage after stale-record verification.' after 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.'. It does not establish success for the stated scenario; the needed evidence is 'Security reports show one applied scan schedule and no unresolved conflicts.'.

This action is appropriate for a different case: A Windows update fails only on one device model after a firmware revision and the team considers blocking all tenant updates. There, the targeted fix is 'Use per-model diagnostics and staged targeting to isolate the compatibility defect.' because localized firmware issues should not halt unrelated secure devices. The current scenario instead requires 'Check Cloud PC update policy assignment and Windows Autopatch/Intune targeting.' and verification that targeted Cloud PCs show the approved monthly update version in reports.

This action is appropriate for a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. There, the targeted fix is 'Check supervision and platform prerequisites before configuring Apple update enforcement.' because some Apple update commands require corporate supervision. The current scenario instead requires 'Check Cloud PC update policy assignment and Windows Autopatch/Intune targeting.' and verification that targeted Cloud PCs show the approved monthly update version in reports.

This action is appropriate for a different case: An iPhone fleet needs supervised operating-system updates with deferred installation schedules and the administrator uses a Windows update ring. There, the targeted fix is 'Configure supported iOS/iPadOS update settings using Intune Settings Catalog or Apple update management controls.' because Apple software update mechanisms differ from Windows Update for Business. The current scenario instead requires 'Check Cloud PC update policy assignment and Windows Autopatch/Intune targeting.' and verification that targeted Cloud PCs show the approved monthly update version in reports.

This action is appropriate for a different case: A line-of-business app uses a dependency installer that requires a reboot before the main install can work. There, the targeted fix is 'Configure appropriate Intune dependency and restart handling for both packages.' because an incomplete reboot can leave prerequisite components unavailable. The current scenario instead requires 'Use a documented silent unattended install switch or repackage for managed deployment.' and verification that the installation completes in system context with no user prompt.

This action is appropriate for a different case: An enterprise needs to remove a vulnerable app version before assigning a patched replacement, avoiding two conflicting versions. There, the targeted fix is 'Coordinate app supersedence or uninstall and replacement assignments with detection tests.' because lifecycle transitions should not leave multiple incompatible releases. The current scenario instead requires 'Use a documented silent unattended install switch or repackage for managed deployment.' and verification that the installation completes in system context with no user prompt.

This action is appropriate for a different case: An enterprise needs every new laptop to install Microsoft 365 Apps automatically during initial Windows deployment. There, the targeted fix is 'Assign a supported Microsoft 365 Apps suite deployment to the required device cohort.' because Office app deployment can be managed alongside Windows enrollment provisioning. The current scenario instead requires 'Use a documented silent unattended install switch or repackage for managed deployment.' and verification that the installation completes in system context with no user prompt.

This observation would validate a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. It would check 'The pilot returns a parseable evaluation and its compliance state matches test conditions.' after 'Return the supported JSON schema without extra stdout content and validate the rules file.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible pilot is marked noncompliant when the service is absent and compliant when present.'.

This observation would validate a different case: A Graph script changes compliance policy assignments in production without recording input or output. It would check 'Every actual assignment update is attributable to an approved request and measured result.' after 'Add dry-run mode, explicit change approval, logging and post-change verification.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible pilot is marked noncompliant when the service is absent and compliant when present.'.

This observation would validate a different case: A Policy Configuration Agent proposes settings from a natural-language security standard without identifying policy conflicts. It would check 'The staged policy matches the security requirement and produces no unreviewed conflicts.' after 'Review proposed settings and existing Intune assignments before creating the new configuration.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible pilot is marked noncompliant when the service is absent and compliant when present.'.

This observation would validate a different case: A device is marked registered but the organization requires joined identity for a Windows security baseline deployment. It would check 'The rebuilt test device reports the intended join type before the baseline is assigned.' after 'Transition the eligible Windows endpoint to the appropriate Microsoft Entra joined provisioning path.'. It does not establish success for the stated scenario; the needed evidence is 'A joined noncompliant laptop is blocked, while a joined compliant one passes the test policy.'.

This observation would validate a different case: An Entra device registration does not show as compliant even though the user successfully authenticated to Microsoft 365. It would check 'The portal shows registration separately from management and compliance state after enrollment.' after 'Distinguish device identity registration from Intune enrollment and compliance policy evaluation.'. It does not establish success for the stated scenario; the needed evidence is 'A joined noncompliant laptop is blocked, while a joined compliant one passes the test policy.'.

This observation would validate a different case: A sales organization wants newly provisioned laptops automatically assigned to an Entra device group based on their operating system. It would check 'A test Windows device joins the intended group and a test macOS device does not.' after 'Create a dynamic device membership rule using supported operating system properties.'. It does not establish success for the stated scenario; the needed evidence is 'A joined noncompliant laptop is blocked, while a joined compliant one passes the test policy.'.

This action is appropriate for a different case: A device loses its Entra primary refresh token after a password reset and cloud application single sign-on stops functioning. There, the targeted fix is 'Inspect Entra sign-in/device diagnostics and refresh device authentication through supported steps.' because token and device identity failures should be isolated before reimaging. The current scenario instead requires 'Correlate device IDs and lifecycle state before removing a verified stale registration.' and verification that one active device identity remains after the stale entry is retired and no active access breaks.

This action is appropriate for a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. There, the targeted fix is 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.' because shared-use devices should not inherit an arbitrary employee's personal management scope. The current scenario instead requires 'Correlate device IDs and lifecycle state before removing a verified stale registration.' and verification that one active device identity remains after the stale entry is retired and no active access breaks.

This action is appropriate for a different case: A technician attempts to Entra join company devices using an account that is not permitted to join additional devices. There, the targeted fix is 'Review Entra device-join permissions and per-user device limits before repeating enrollment.' because authentication alone does not override tenant device join restrictions. The current scenario instead requires 'Correlate device IDs and lifecycle state before removing a verified stale registration.' and verification that one active device identity remains after the stale entry is retired and no active access breaks.