Exam Bundle

This action is appropriate for a different case: A corporate application fails because a security admin created an outbound firewall rule that blocks its authorized API endpoint. There, the targeted fix is 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.' because least privilege balances necessary application connectivity with traffic restrictions. The current scenario instead requires 'Deploy supported Defender for Endpoint onboarding configuration to the targeted devices.' and verification that the pilot appears active in Defender with expected device telemetry.

This action is appropriate for a different case: A device firewall rule appears correctly assigned but does not take effect on machines using the public network profile. There, the targeted fix is 'Inspect the profile-specific rule settings and effective network category on the endpoint.' because a firewall rule can depend on the active domain/private/public context. The current scenario instead requires 'Deploy supported Defender for Endpoint onboarding configuration to the targeted devices.' and verification that the pilot appears active in Defender with expected device telemetry.

This action is appropriate for a different case: A business requires separate security baseline configurations for kiosks and ordinary employee laptops. There, the targeted fix is 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.' because endpoint risk and application compatibility differ by device role. The current scenario instead requires 'Deploy supported Defender for Endpoint onboarding configuration to the targeted devices.' and verification that the pilot appears active in Defender with expected device telemetry.

This action is appropriate for a different case: An employee wants their personally owned Windows laptop to access company mail without handing its full management to IT. There, the targeted fix is 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.' because device registration supports work access while preserving BYOD ownership boundaries. The current scenario instead requires 'Disable the compromised Entra device object and revoke relevant sessions according to incident policy.' and verification that the missing laptop no longer satisfies device access policy while permitted personal account workflows remain.

This action is appropriate for a different case: An Entra device registration does not show as compliant even though the user successfully authenticated to Microsoft 365. There, the targeted fix is 'Distinguish device identity registration from Intune enrollment and compliance policy evaluation.' because being registered is not evidence that a device satisfies managed compliance requirements. The current scenario instead requires 'Disable the compromised Entra device object and revoke relevant sessions according to incident policy.' and verification that the missing laptop no longer satisfies device access policy while permitted personal account workflows remain.

This action is appropriate for a different case: A device loses its Entra primary refresh token after a password reset and cloud application single sign-on stops functioning. There, the targeted fix is 'Inspect Entra sign-in/device diagnostics and refresh device authentication through supported steps.' because token and device identity failures should be isolated before reimaging. The current scenario instead requires 'Disable the compromised Entra device object and revoke relevant sessions according to incident policy.' and verification that the missing laptop no longer satisfies device access policy while permitted personal account workflows remain.

This observation would validate a different case: A security team needs to audit which EPM-elevated executables employees actually run across a pilot fleet. It would check 'An elevated test process creates an attributable report with application identity.' after 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices renew without breaking VPN or Wi-Fi authentication.'.

This observation would validate a different case: A catalog application is assigned but its vendor's older custom package remains installed and causes detection confusion. It would check 'The pilot reports one supported application installation with the desired detected version.' after 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices renew without breaking VPN or Wi-Fi authentication.'.

This observation would validate a different case: A Microsoft Tunnel gateway is online but unenrolled Android users cannot start application-specific connections. It would check 'The test protected application establishes an authorized tunnel and its status reports healthy.' after 'Check Tunnel for MAM application configuration, gateway status and supported client integration.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices renew without breaking VPN or Wi-Fi authentication.'.

This observation would validate a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. It would check 'A help-desk test user can reset an assigned device but cannot edit security policies.' after 'Create the narrowest Intune RBAC role with only required remote-action permissions.'. It does not establish success for the stated scenario; the needed evidence is 'The requester cannot self-approve and a second authorized approver is recorded.'.

This observation would validate a different case: A company uses corporate Windows endpoints but wants passwordless sign-in based on the user's biometric gesture, not network location. It would check 'User sign-in meets the intended authentication requirement without a shared password.' after 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'The requester cannot self-approve and a second authorized approver is recorded.'.

This observation would validate a different case: A regional administrator accidentally modifies another unit's Windows 365 provisioning policy because their administrative rights are global. It would check 'The regional admin can view local Cloud PCs but cannot change the other unit's policy.' after 'Scope Windows 365 and Intune administrative roles to the intended administrative boundary.'. It does not establish success for the stated scenario; the needed evidence is 'The requester cannot self-approve and a second authorized approver is recorded.'.

This action is appropriate for a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. There, the targeted fix is 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.' because capacity and entitlement errors cannot be repaired by changing Windows Defender policy. The current scenario instead requires 'Configure Windows Autopilot user-driven deployment with a suitable assigned profile and enrollment prerequisites.' and verification that a remote employee signs in at OOBE and reaches the managed desktop with required configuration.

This action is appropriate for a different case: An organization wants to pin devices to a specific Windows 11 release while allowing security quality updates. There, the targeted fix is 'Create an Intune Windows feature update policy targeting the required supported version.' because feature update version targeting is distinct from monthly quality update cadence. The current scenario instead requires 'Configure Windows Autopilot user-driven deployment with a suitable assigned profile and enrollment prerequisites.' and verification that a remote employee signs in at OOBE and reaches the managed desktop with required configuration.

This action is appropriate for a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. There, the targeted fix is 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.' because hybrid enrollment depends on reachable domain services at the required stage. The current scenario instead requires 'Configure Windows Autopilot user-driven deployment with a suitable assigned profile and enrollment prerequisites.' and verification that a remote employee signs in at OOBE and reaches the managed desktop with required configuration.

This observation would validate a different case: A Mac configuration profile is marked succeeded but the security restriction is absent on one OS release. It would check 'Supported macOS pilots enforce the control while incompatible versions are explicitly documented.' after 'Validate macOS version support and applicable payload settings before broad rollout.'. It does not establish success for the stated scenario; the needed evidence is 'The policy applies to supported Windows pilot devices and reports an effective value.'.

This observation would validate a different case: A Teams Rooms device should receive meeting-room configuration without a user signing into Company Portal. It would check 'A newly provisioned room device gets its assigned policies and is centrally visible.' after 'Use supported Teams Rooms specialized-device enrollment and configuration targeting.'. It does not establish success for the stated scenario; the needed evidence is 'The policy applies to supported Windows pilot devices and reports an effective value.'.

This observation would validate a different case: A mobile team pushes an Android Wi-Fi profile that references an enterprise certificate missing on the target devices. It would check 'A pilot Android device receives the certificate and connects to the secure SSID.' after 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.'. It does not establish success for the stated scenario; the needed evidence is 'The policy applies to supported Windows pilot devices and reports an effective value.'.

This action is appropriate for a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. There, the targeted fix is 'Separate machine installation from appropriate user-specific license or configuration deployment.' because install context and app entitlement can be independently scoped. The current scenario instead requires 'Configure Intune app supersedence with the intended replacement and uninstall behavior.' and verification that a pilot device runs the new VPN client and the retired version is removed as planned.

This action is appropriate for a different case: An Intune app deployment succeeds in the device report, but the user cannot launch it because a required license assignment is missing. There, the targeted fix is 'Verify application licensing and assigned user entitlement after confirming installation.' because installed files do not necessarily confer an application-use license. The current scenario instead requires 'Configure Intune app supersedence with the intended replacement and uninstall behavior.' and verification that a pilot device runs the new VPN client and the retired version is removed as planned.

This action is appropriate for a different case: An internal line-of-business Windows app uses an MSI package and needs quiet installation across managed PCs. There, the targeted fix is 'Deploy the application using the appropriate Intune LOB/Win32 app packaging approach.' because install format and management needs determine the supported deployment method. The current scenario instead requires 'Configure Intune app supersedence with the intended replacement and uninstall behavior.' and verification that a pilot device runs the new VPN client and the retired version is removed as planned.

This action is appropriate for a different case: An organization wants to pin devices to a specific Windows 11 release while allowing security quality updates. There, the targeted fix is 'Create an Intune Windows feature update policy targeting the required supported version.' because feature update version targeting is distinct from monthly quality update cadence. The current scenario instead requires 'Use a supported Windows Autopilot self-deploying profile on eligible hardware.' and verification that the kiosk reaches its managed configuration without binding to a named employee.

This action is appropriate for a different case: A business moves employees between Windows 365 Cloud PCs but misinterprets reprovisioning as a simple reboot. There, the targeted fix is 'Use the supported Cloud PC reprovisioning lifecycle only after confirming expected data impact.' because reprovisioning can replace managed virtual devices and may not preserve local state. The current scenario instead requires 'Use a supported Windows Autopilot self-deploying profile on eligible hardware.' and verification that the kiosk reaches its managed configuration without binding to a named employee.

This action is appropriate for a different case: An admin needs to deploy Cloud PCs to a different network without changing production provisioning policies for every existing user. There, the targeted fix is 'Create a tested dedicated Windows 365 provisioning policy for the new group and network.' because policy scoping can separate target cohorts without uncontrolled tenant-wide migration. The current scenario instead requires 'Use a supported Windows Autopilot self-deploying profile on eligible hardware.' and verification that the kiosk reaches its managed configuration without binding to a named employee.

This action is appropriate for a different case: A Mac needs FileVault configuration but the admin targets a Windows BitLocker settings catalog profile. There, the targeted fix is 'Create and assign the platform-specific macOS FileVault and recovery-key configuration.' because encryption controls differ by operating system and management channel. The current scenario instead requires 'Validate macOS version support and applicable payload settings before broad rollout.' and verification that supported macOS pilots enforce the control while incompatible versions are explicitly documented.

This action is appropriate for a different case: A device configuration profile is changed but its rollout has no staged group, causing an immediate company-wide restriction. There, the targeted fix is 'Apply controlled phased assignments and monitored pilot rings for Intune settings.' because ring-based deployment reduces the scope of configuration defects. The current scenario instead requires 'Validate macOS version support and applicable payload settings before broad rollout.' and verification that supported macOS pilots enforce the control while incompatible versions are explicitly documented.

This action is appropriate for a different case: An administrator needs to deploy browser restrictions to Windows devices but wants to avoid conflict with an existing security baseline. There, the targeted fix is 'Compare overlapping settings and select one authoritative assignment for each control.' because multiple policy sources can generate conflicting desired states. The current scenario instead requires 'Validate macOS version support and applicable payload settings before broad rollout.' and verification that supported macOS pilots enforce the control while incompatible versions are explicitly documented.

This observation would validate a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. It would check 'Pilot Macs report the approved OS version after the assigned update window.' after 'Deploy supported macOS software update policy through the Intune Settings Catalog.'. It does not establish success for the stated scenario; the needed evidence is 'Branch WAN download volume falls while clients still verify and install authorized updates.'.

This observation would validate a different case: A Windows client has a pending update and the restart schedule interrupts clinical workstations during business hours. It would check 'Pilot workstations install updates and restart within the specified maintenance policy.' after 'Adjust appropriate Windows update ring active hours and restart deadline controls.'. It does not establish success for the stated scenario; the needed evidence is 'Branch WAN download volume falls while clients still verify and install authorized updates.'.

This observation would validate a different case: A Windows device fails the feature update because of a safeguard hold while security fixes install normally. It would check 'The blocked feature update shows its precise hold while quality updates continue.' after 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.'. It does not establish success for the stated scenario; the needed evidence is 'Branch WAN download volume falls while clients still verify and install authorized updates.'.

This observation would validate a different case: A device firewall rule appears correctly assigned but does not take effect on machines using the public network profile. It would check 'The pilot blocks the intended port when the connection is classified public.' after 'Inspect the profile-specific rule settings and effective network category on the endpoint.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows the required secure value without outstanding setting conflicts.'.

This observation would validate a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. It would check 'Cloud requests fail for the missing device and management records capture the requested data removal.' after 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows the required secure value without outstanding setting conflicts.'.

This observation would validate a different case: An admin wants to enforce App Control on all endpoints at once without understanding what legitimate binaries would be blocked. It would check 'The reviewed audit log shows impacted signed apps and the staged block policy works.' after 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot shows the required secure value without outstanding setting conflicts.'.