Exam Bundle

This observation would validate a different case: An endpoint admin wants an operational baseline for acceptable device startup time before an OS upgrade. It would check 'The post-upgrade cohort can be assessed against the saved pre-upgrade distribution.' after 'Measure representative Endpoint Analytics startup metrics and record target thresholds in advance.'. It does not establish success for the stated scenario; the needed evidence is 'The post-remediation model reports fewer unexpected restarts under comparable usage.'.

This observation would validate a different case: A service desk needs to identify whether Windows endpoints have slow startup caused by a new login agent rather than simple user complaints. It would check 'The agent-installed cohort shows its startup score compared with the previous baseline.' after 'Review Endpoint Analytics startup performance reports and compare deployment cohorts.'. It does not establish success for the stated scenario; the needed evidence is 'The post-remediation model reports fewer unexpected restarts under comparable usage.'.

This observation would validate a different case: Endpoint Analytics reports poor application reliability but the team monitors only Windows boot speed. It would check 'A targeted report identifies the affected app crash trend separately from boot duration.' after 'Use application reliability metrics alongside startup performance in Endpoint Analytics.'. It does not establish success for the stated scenario; the needed evidence is 'The post-remediation model reports fewer unexpected restarts under comparable usage.'.

This observation would validate a different case: A user requests a local antivirus exception for a downloaded installer without validating its publisher or hash. It would check 'The approved signed installer runs without a general exclusions directory.' after 'Verify software provenance and route any exclusion request through approved security policy.'. It does not establish success for the stated scenario; the needed evidence is 'The managed firewall returns to the approved state and the override attempt is documented.'.

This observation would validate a different case: An organization wants to allow only trusted, signed business executables on Windows endpoints. It would check 'Approved signed apps run and an unapproved executable fails during the enforcement pilot.' after 'Configure App Control for Business policies in a suitable audited then enforced rollout.'. It does not establish success for the stated scenario; the needed evidence is 'The managed firewall returns to the approved state and the override attempt is documented.'.

This observation would validate a different case: App Control for Business enforcement blocks an essential finance application after a vendor update changed its signing certificate. It would check 'The approved application executes and the untrusted test binary remains denied.' after 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.'. It does not establish success for the stated scenario; the needed evidence is 'The managed firewall returns to the approved state and the override attempt is documented.'.

This action is appropriate for a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. There, the targeted fix is 'Return the supported JSON schema without extra stdout content and validate the rules file.' because machine-readable output format is part of the custom compliance contract. The current scenario instead requires 'Evaluate the agent's prioritization with business context and compensating control planning.' and verification that the exception is documented and a prioritized remediation plan retains accountability.

This action is appropriate for a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. There, the targeted fix is 'Add preflight freshness checks and compare identifiers before applying bulk changes.' because inventory drift between read and write can alter the intended target list. The current scenario instead requires 'Evaluate the agent's prioritization with business context and compensating control planning.' and verification that the exception is documented and a prioritized remediation plan retains accountability.

This action is appropriate for a different case: An organization wants a custom device compliance check for a specialized local service that Intune's standard compliance profile cannot directly assess. There, the targeted fix is 'Implement supported custom compliance discovery scripts and JSON rule evaluation on eligible platforms.' because custom compliance can evaluate additional signals with prescribed result formats. The current scenario instead requires 'Evaluate the agent's prioritization with business context and compensating control planning.' and verification that the exception is documented and a prioritized remediation plan retains accountability.

This action is appropriate for a different case: A Security Copilot agent recommends disabling a conditional access grant because some users are blocked from an app. There, the targeted fix is 'Validate identity security policy intent and evidence before applying suggestions to production.' because automated guidance should not override established Zero Trust access requirements. The current scenario instead requires 'Use Microsoft Graph with scoped application or delegated permissions and paginated queries.' and verification that the script returns only approved inventory fields and cannot delete device records.

This action is appropriate for a different case: A custom compliance rule treats an unavailable service as compliant because its PowerShell check returns a default true value. There, the targeted fix is 'Implement a fail-safe discovery result and explicit error handling for missing data.' because unknown state should not automatically satisfy a security prerequisite. The current scenario instead requires 'Use Microsoft Graph with scoped application or delegated permissions and paginated queries.' and verification that the script returns only approved inventory fields and cannot delete device records.

This action is appropriate for a different case: An administrator wants to extend device compliance using PowerShell but the custom script is assigned to unsupported macOS targets. There, the targeted fix is 'Scope custom compliance discovery to supported device platforms and policy prerequisites.' because a valid script on Windows need not be a valid macOS compliance mechanism. The current scenario instead requires 'Use Microsoft Graph with scoped application or delegated permissions and paginated queries.' and verification that the script returns only approved inventory fields and cannot delete device records.

This action is appropriate for a different case: A security admin sees a Security Copilot agent suggest that 500 endpoints are stale and immediately prepares a bulk offboarding job. There, the targeted fix is 'Review the Device Offboarding Agent evidence and require authorized admin approval before changes.' because agent recommendations are supervised aids, not automatic deletion permission. The current scenario instead requires 'Reduce the automation identity's effective Graph scopes and target only approved device APIs.' and verification that the test identity can perform its device action but gets denied for unrelated user modifications.

This action is appropriate for a different case: A Security Copilot agent recommends disabling a conditional access grant because some users are blocked from an app. There, the targeted fix is 'Validate identity security policy intent and evidence before applying suggestions to production.' because automated guidance should not override established Zero Trust access requirements. The current scenario instead requires 'Reduce the automation identity's effective Graph scopes and target only approved device APIs.' and verification that the test identity can perform its device action but gets denied for unrelated user modifications.

This action is appropriate for a different case: A security operations script stores an Intune app secret in a shared plain text PowerShell file. There, the targeted fix is 'Use supported secure credential or certificate-based authentication and restricted identity permissions.' because automation credentials require separate lifecycle protection from script source. The current scenario instead requires 'Reduce the automation identity's effective Graph scopes and target only approved device APIs.' and verification that the test identity can perform its device action but gets denied for unrelated user modifications.

This observation would validate a different case: Windows laptops remain on an unsupported Windows 10 release while hardware meets the organization’s Windows 11 requirements. It would check 'A pilot fleet reports the intended Windows 11 version and user applications remain functional.' after 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices remain on the chosen feature release while receiving normal security updates.'.

This observation would validate a different case: An Enrollment Status Page shows 'setup complete' before a required security application is installed on Windows devices. It would check 'The device does not complete gated setup until the designated security app succeeds.' after 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices remain on the chosen feature release while receiving normal security updates.'.

This observation would validate a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. It would check 'The licensed test user receives a Cloud PC while unlicensed requests remain blocked.' after 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices remain on the chosen feature release while receiving normal security updates.'.

This observation would validate a different case: A managed catalog app requires a vendor-specific detection update after an upstream app build changes its install path. It would check 'The new pilot release is reported installed and a missing app is detected as absent.' after 'Update the Enterprise App Catalog app assignment or detection configuration using supported lifecycle procedures.'. It does not establish success for the stated scenario; the needed evidence is 'A sample support session has the required audit metadata and protected access to its records.'.

This observation would validate a different case: A Microsoft Tunnel gateway is online but unenrolled Android users cannot start application-specific connections. It would check 'The test protected application establishes an authorized tunnel and its status reports healthy.' after 'Check Tunnel for MAM application configuration, gateway status and supported client integration.'. It does not establish success for the stated scenario; the needed evidence is 'A sample support session has the required audit metadata and protected access to its records.'.

This observation would validate a different case: An enterprise uses Mobile Application Management on unenrolled phones and needs protected access to private web apps. It would check 'A protected app accesses its allowed internal endpoint while other personal apps cannot use the tunnel.' after 'Evaluate Microsoft Tunnel for MAM with the required gateway, app policy and tenant prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'A sample support session has the required audit metadata and protected access to its records.'.

This action is appropriate for a different case: An administrator assigns a corporate VPN profile to every iOS device but wants it only on devices with a supported OS version. There, the targeted fix is 'Use appropriate Intune assignment filters alongside group targeting.' because filters can refine assignment eligibility using supported device properties. The current scenario instead requires 'Use Group Policy analytics to import and assess supported settings migration paths.' and verification that a migration report distinguishes supported controls from ones needing redesign.

This action is appropriate for a different case: A device configuration profile is changed but its rollout has no staged group, causing an immediate company-wide restriction. There, the targeted fix is 'Apply controlled phased assignments and monitored pilot rings for Intune settings.' because ring-based deployment reduces the scope of configuration defects. The current scenario instead requires 'Use Group Policy analytics to import and assess supported settings migration paths.' and verification that a migration report distinguishes supported controls from ones needing redesign.

This action is appropriate for a different case: Two Android departments share a device group, but only warehouse devices should receive a barcode-scanning restriction. There, the targeted fix is 'Split assignments using trusted device attributes and supported filters or group membership.' because broad assignments can apply vendor-specific controls to the wrong devices. The current scenario instead requires 'Use Group Policy analytics to import and assess supported settings migration paths.' and verification that a migration report distinguishes supported controls from ones needing redesign.

This action is appropriate for a different case: A finance workstation must prevent unsolicited inbound file sharing even when a user changes Wi-Fi networks. There, the targeted fix is 'Deploy a Windows Defender Firewall policy for the applicable network profiles.' because central firewall rules protect endpoint traffic across differing network contexts. The current scenario instead requires 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.' and verification that the reviewed audit log shows impacted signed apps and the staged block policy works.

This action is appropriate for a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. There, the targeted fix is 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.' because removing a policy is not the same as changing existing disk encryption state. The current scenario instead requires 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.' and verification that the reviewed audit log shows impacted signed apps and the staged block policy works.

This action is appropriate for a different case: A company combines Intune antivirus settings and security baseline policies with incompatible scan schedules. There, the targeted fix is 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' because duplicate management intent can create inconsistent endpoint protection. The current scenario instead requires 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.' and verification that the reviewed audit log shows impacted signed apps and the staged block policy works.

This action is appropriate for a different case: A security tool must be automatically installed on every company laptop and should not be treated as user-optional. There, the targeted fix is 'Assign the application as Required to the verified corporate device group.' because mandatory controls need device-wide automatic assignment. The current scenario instead requires 'Configure supported Android Quiet Time policy for eligible managed applications.' and verification that the approved work app stops notifications during the configured off-hours.

This action is appropriate for a different case: A Teams Rooms device must run its supported collaboration client but the admin deploys a normal desktop Office suite installer to it. There, the targeted fix is 'Use the supported Teams Rooms app servicing and specialized device management path.' because specialty room devices can have different application deployment models. The current scenario instead requires 'Configure supported Android Quiet Time policy for eligible managed applications.' and verification that the approved work app stops notifications during the configured off-hours.

This action is appropriate for a different case: A packaged enterprise app supports both 32-bit and 64-bit installations, but the wrong architecture is installed on ARM-based devices. There, the targeted fix is 'Define valid architecture applicability or separate packages according to supported platform.' because package architecture constraints affect installation eligibility. The current scenario instead requires 'Configure supported Android Quiet Time policy for eligible managed applications.' and verification that the approved work app stops notifications during the configured off-hours.

This observation would validate a different case: An organization needs a new ADMX-backed policy in Intune that is not yet included in its ordinary settings catalog. It would check 'The policy applies to supported Windows pilot devices and reports an effective value.' after 'Import the supported ADMX definition and publish the associated configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Android device receives the certificate and connects to the secure SSID.'.

This observation would validate a different case: A device configuration profile is changed but its rollout has no staged group, causing an immediate company-wide restriction. It would check 'The pilot proves the setting and later cohorts remain unchanged until promotion.' after 'Apply controlled phased assignments and monitored pilot rings for Intune settings.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Android device receives the certificate and connects to the secure SSID.'.

This observation would validate a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. It would check 'Supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.' after 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot Android device receives the certificate and connects to the secure SSID.'.