Exam Bundle

This action is appropriate for a different case: A Windows laptop's Intune diagnostics are too old to explain a policy deployment failure after the latest OS upgrade. There, the targeted fix is 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.' because old data can misrepresent the current failure mechanism. The current scenario instead requires 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' and verification that the resulting report shows the effective assignment and exclusion causing the difference.

This action is appropriate for a different case: A remote kiosk is frozen after an application update and operations needs a controlled reboot, not a factory reset. There, the targeted fix is 'Use the Restart remote device action with authorization and user-impact assessment.' because restart and wipe have drastically different data effects. The current scenario instead requires 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' and verification that the resulting report shows the effective assignment and exclusion causing the difference.

This action is appropriate for a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. There, the targeted fix is 'Use the supported Intune device query with valid KQL and an appropriate scope.' because Intune device query can answer targeted state questions without collecting all device images. The current scenario instead requires 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' and verification that the resulting report shows the effective assignment and exclusion causing the difference.

This action is appropriate for a different case: A customer wants only a specific device support group to be local Administrators on Windows endpoints, not every cloud user. There, the targeted fix is 'Configure the Windows local users and groups policy in Intune with supported membership settings.' because local administrative membership needs explicit managed authorization. The current scenario instead requires 'Trigger an authorized Windows LAPS rotation and verify directory backup state.' and verification that the old credential fails after rotation and authorized escrow shows a new protected value.

This action is appropriate for a different case: A company adds a new Intune compliance policy but Conditional Access continues permitting devices without any policy. There, the targeted fix is 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.' because an unassessed device should not be silently considered compliant. The current scenario instead requires 'Trigger an authorized Windows LAPS rotation and verify directory backup state.' and verification that the old credential fails after rotation and authorized escrow shows a new protected value.

This action is appropriate for a different case: A company uses corporate Windows endpoints but wants passwordless sign-in based on the user's biometric gesture, not network location. There, the targeted fix is 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.' because a biometric gesture unlocks a local cryptographic credential rather than substituting for authorization. The current scenario instead requires 'Trigger an authorized Windows LAPS rotation and verify directory backup state.' and verification that the old credential fails after rotation and authorized escrow shows a new protected value.

This observation would validate a different case: Windows Firewall is disabled locally by a privileged user each time the computer boots despite managed policy. It would check 'The managed firewall returns to the approved state and the override attempt is documented.' after 'Investigate effective endpoint security policy and tamper-protection or configuration drift.'. It does not establish success for the stated scenario; the needed evidence is 'Cloud requests fail for the missing device and management records capture the requested data removal.'.

This observation would validate a different case: A device receives two security baseline profiles that set conflicting Windows Defender options. It would check 'The pilot shows the required secure value without outstanding setting conflicts.' after 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.'. It does not establish success for the stated scenario; the needed evidence is 'Cloud requests fail for the missing device and management records capture the requested data removal.'.

This observation would validate a different case: A company's endpoints are enrolled in Intune but Defender XDR shows duplicate security device entries after rebuilding laptops. It would check 'Only the active security record is used for triage after stale-record verification.' after 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.'. It does not establish success for the stated scenario; the needed evidence is 'Cloud requests fail for the missing device and management records capture the requested data removal.'.

This action is appropriate for a different case: A KQL device query is returning no rows because the administrator copied a Log Analytics table name not available in Intune device query. There, the targeted fix is 'Use the device query supported schema and validate KQL syntax against its data model.' because KQL environments have different tables and available properties. The current scenario instead requires 'Issue a supported Intune Sync remote action and verify policy evaluation.' and verification that the device checks in and reports its updated compliance state.

This action is appropriate for a different case: A compliance team wants device diagnostics from a stolen laptop but the device has been offline for weeks. There, the targeted fix is 'Report remote collection status accurately and use available last-seen telemetry rather than claiming successful capture.' because remote actions require device connectivity and cannot guarantee results from offline endpoints. The current scenario instead requires 'Issue a supported Intune Sync remote action and verify policy evaluation.' and verification that the device checks in and reports its updated compliance state.

This action is appropriate for a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. There, the targeted fix is 'Use an authorized Wipe action on the verified device record with incident tracking.' because a full wipe is appropriate for a lost corporate endpoint when approved. The current scenario instead requires 'Issue a supported Intune Sync remote action and verify policy evaluation.' and verification that the device checks in and reports its updated compliance state.

This action is appropriate for a different case: A maker selects Autopilot device preparation for a pre-provisioned kiosk but the deployment fails to offer the requested technician mode. There, the targeted fix is 'Use classic Windows Autopilot for pre-provisioning rather than assuming device preparation supports it.' because device preparation and classic Autopilot have different mode and prerequisite support. The current scenario instead requires 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.' and verification that a pilot Cloud PC provisions successfully and reaches approved corporate resources.

This action is appropriate for a different case: The service desk attempts to pre-provision a Windows device with unsupported TPM attestation and receives a provisioning error. There, the targeted fix is 'Verify TPM and Autopilot pre-provisioning eligibility before retrying or selecting another mode.' because supported TPM attestation requirements vary by Autopilot deployment mode. The current scenario instead requires 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.' and verification that a pilot Cloud PC provisions successfully and reaches approved corporate resources.

This action is appropriate for a different case: A remote user encounters incorrect tenant branding during first Windows sign-in despite the company owning the laptop. There, the targeted fix is 'Validate the Autopilot hardware registration tenant and assigned deployment profile.' because the hardware hash and organizational registration control enrollment routing. The current scenario instead requires 'Validate the Azure network connection or supported Microsoft-hosted network choice and provisioning health.' and verification that a pilot Cloud PC provisions successfully and reaches approved corporate resources.

This action is appropriate for a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. There, the targeted fix is 'Configure the correct managed-app configuration policy for the targeted identity.' because app configuration for managed apps differs from device-wide iOS configuration. The current scenario instead requires 'Configure allowed save-location and data transfer restrictions in Intune app protection.' and verification that the protected app permits company OneDrive and blocks personal destinations.

This action is appropriate for a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. There, the targeted fix is 'Use managed-device app configuration targeting appropriate device groups.' because corporate managed device settings should not be broadcast to personal installations. The current scenario instead requires 'Configure allowed save-location and data transfer restrictions in Intune app protection.' and verification that the protected app permits company OneDrive and blocks personal destinations.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Configure allowed save-location and data transfer restrictions in Intune app protection.' and verification that the protected app permits company OneDrive and blocks personal destinations.

This action is appropriate for a different case: A tenant has four months of Intune compliance history but executives want trend reporting without manually copying screenshots. There, the targeted fix is 'Use Intune reporting exports or supported Graph reporting endpoints and create a governed dashboard.' because historical trend analysis requires repeatable, appropriately scoped data extraction. The current scenario instead requires 'Aggregate or redact user-level data and apply report access restrictions.' and verification that executives see accurate fleet trends without individual employee identifiers.

This action is appropriate for a different case: A report claims 100% compliance because it excludes devices that have not checked in for 30 days. There, the targeted fix is 'Include stale-device and missing-data treatment in compliance reporting definitions.' because selective omission can misstate fleet security health. The current scenario instead requires 'Aggregate or redact user-level data and apply report access restrictions.' and verification that executives see accurate fleet trends without individual employee identifiers.

This action is appropriate for a different case: An admin dashboard shows compliance percentages but hides the tenant's oldest policy evaluation timestamp. There, the targeted fix is 'Expose freshness and evaluation-time metadata in monitoring reports.' because a stale compliance observation cannot be treated as a live security fact. The current scenario instead requires 'Aggregate or redact user-level data and apply report access restrictions.' and verification that executives see accurate fleet trends without individual employee identifiers.

This action is appropriate for a different case: An executive wants email access blocked from unmanaged devices even when their passwords and MFA succeed. There, the targeted fix is 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.' because identity authentication alone does not prove required endpoint compliance. The current scenario instead requires 'Choose group-membership update semantics that preserve required approved break-glass access.' and verification that the pilot device contains both mandated emergency access and the intended managed members.

This action is appropriate for a different case: A company uses corporate Windows endpoints but wants passwordless sign-in based on the user's biometric gesture, not network location. There, the targeted fix is 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.' because a biometric gesture unlocks a local cryptographic credential rather than substituting for authorization. The current scenario instead requires 'Choose group-membership update semantics that preserve required approved break-glass access.' and verification that the pilot device contains both mandated emergency access and the intended managed members.

This action is appropriate for a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. There, the targeted fix is 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.' because managed application trust differs from MDM device compliance trust. The current scenario instead requires 'Choose group-membership update semantics that preserve required approved break-glass access.' and verification that the pilot device contains both mandated emergency access and the intended managed members.

This observation would validate a different case: A Windows 365 Cloud PC image contains an old line-of-business client and every new device inherits the obsolete version. It would check 'A new pilot Cloud PC starts with the approved application release.' after 'Update and validate the governed Cloud PC image or approved provisioning app deployment pipeline.'. It does not establish success for the stated scenario; the needed evidence is 'After correcting detection, the same application is recognized and setup proceeds.'.

This observation would validate a different case: Windows laptops remain on an unsupported Windows 10 release while hardware meets the organization’s Windows 11 requirements. It would check 'A pilot fleet reports the intended Windows 11 version and user applications remain functional.' after 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.'. It does not establish success for the stated scenario; the needed evidence is 'After correcting detection, the same application is recognized and setup proceeds.'.

This observation would validate a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. It would check 'OOBE finishes with essentials and remaining applications deploy after check-in.' after 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.'. It does not establish success for the stated scenario; the needed evidence is 'After correcting detection, the same application is recognized and setup proceeds.'.

This observation would validate a different case: An admin dashboard shows compliance percentages but hides the tenant's oldest policy evaluation timestamp. It would check 'Each sample device shows its latest status and actual last evaluation time.' after 'Expose freshness and evaluation-time metadata in monitoring reports.'. It does not establish success for the stated scenario; the needed evidence is 'The report lists each failed app installation and its relevant code.'.

This observation would validate a different case: A report claims 100% compliance because it excludes devices that have not checked in for 30 days. It would check 'The report explicitly identifies stale devices and does not count them as confirmed compliant.' after 'Include stale-device and missing-data treatment in compliance reporting definitions.'. It does not establish success for the stated scenario; the needed evidence is 'The report lists each failed app installation and its relevant code.'.

This observation would validate a different case: A fleet health score decreases but leadership cannot tell whether app reliability or startup performance was responsible. It would check 'The report identifies which metric and cohort account for the observed decline.' after 'Decompose Endpoint Analytics scores by dimension and inspect corresponding device groups.'. It does not establish success for the stated scenario; the needed evidence is 'The report lists each failed app installation and its relevant code.'.

This observation would validate a different case: A corporate Wi-Fi system rejects Cloud PKI client certificates because the RADIUS server does not trust the new intermediate CA. It would check 'A test device authenticates to Wi-Fi and the server validates the full issued chain.' after 'Publish and validate the appropriate CA trust chain before onboarding clients.'. It does not establish success for the stated scenario; the needed evidence is 'A version-stratified comparison isolates the impacted model and verifies improvement after remediation.'.

This observation would validate a different case: A catalog application is assigned but its vendor's older custom package remains installed and causes detection confusion. It would check 'The pilot reports one supported application installation with the desired detected version.' after 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.'. It does not establish success for the stated scenario; the needed evidence is 'A version-stratified comparison isolates the impacted model and verifies improvement after remediation.'.

This observation would validate a different case: Advanced Analytics recommends a configuration change that could affect every endpoint, but the operations team plans immediate mass deployment. It would check 'The pilot exhibits improved metrics before rollout to later cohorts is approved.' after 'Validate the recommendation on a staged group before broad policy assignment.'. It does not establish success for the stated scenario; the needed evidence is 'A version-stratified comparison isolates the impacted model and verifies improvement after remediation.'.