Exam Bundle

This observation would validate a different case: A finance workstation must prevent unsolicited inbound file sharing even when a user changes Wi-Fi networks. It would check 'Unauthorized inbound file sharing is denied on public and private networks.' after 'Deploy a Windows Defender Firewall policy for the applicable network profiles.'. It does not establish success for the stated scenario; the needed evidence is 'The device restarts normally with its protected drive after authorized recovery.'.

This observation would validate a different case: Several managed Windows PCs have Intune profiles but do not appear as onboarded devices in Microsoft Defender for Endpoint. It would check 'The pilot appears active in Defender with expected device telemetry.' after 'Deploy supported Defender for Endpoint onboarding configuration to the targeted devices.'. It does not establish success for the stated scenario; the needed evidence is 'The device restarts normally with its protected drive after authorized recovery.'.

This observation would validate a different case: A company's endpoints are enrolled in Intune but Defender XDR shows duplicate security device entries after rebuilding laptops. It would check 'Only the active security record is used for triage after stale-record verification.' after 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.'. It does not establish success for the stated scenario; the needed evidence is 'The device restarts normally with its protected drive after authorized recovery.'.

This action is appropriate for a different case: An enterprise uses the new Microsoft Store for its Windows app distribution and still relies on retired legacy store integration. There, the targeted fix is 'Choose the supported Microsoft Store app deployment method within Intune.' because modern store integration replaces older Microsoft Store for Business workflows. The current scenario instead requires 'Use appropriate required app assignment and supervised device restrictions where supported.' and verification that the supervised test iPad retains the required app after sync and the policy reports success.

This action is appropriate for a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. There, the targeted fix is 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.' because critical setup software must match the timing of group membership evaluation. The current scenario instead requires 'Use appropriate required app assignment and supervised device restrictions where supported.' and verification that the supervised test iPad retains the required app after sync and the policy reports success.

This action is appropriate for a different case: A user opens Company Portal but does not see the approved optional line-of-business app because it was assigned to a device group as Required only. There, the targeted fix is 'Create a correct Available assignment to the eligible user population.' because company Portal visibility follows available assignment and identity targeting. The current scenario instead requires 'Use appropriate required app assignment and supervised device restrictions where supported.' and verification that the supervised test iPad retains the required app after sync and the policy reports success.

This observation would validate a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. It would check 'The app gets its intended work URL while the personal device remains unenrolled.' after 'Configure the correct managed-app configuration policy for the targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'An at-risk test device is blocked inside the managed app while an eligible device opens.'.

This observation would validate a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. It would check 'The work browser opens the approved home page while personal browsing remains untouched.' after 'Use managed app configuration for the supported work browser and targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'An at-risk test device is blocked inside the managed app while an eligible device opens.'.

This observation would validate a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. It would check 'The protected supported app connects and an unprotected native app cannot access mail.' after 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.'. It does not establish success for the stated scenario; the needed evidence is 'An at-risk test device is blocked inside the managed app while an eligible device opens.'.

This observation would validate a different case: A field team reports enrollment failures only on outdated Android versions not supported by the corporate platform baseline. It would check 'Supported Android builds enroll and explicitly unsupported builds receive a governed rejection.' after 'Apply documented platform minimum-version enrollment restrictions and communicate upgrade requirements.'. It does not establish success for the stated scenario; the needed evidence is 'A freshly reset tablet enrolls into kiosk mode and exposes only approved applications.'.

This observation would validate a different case: A pilot group should enroll Windows devices automatically while the rest of the tenant remains on an older management platform. It would check 'Pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.' after 'Limit automatic MDM enrollment scope to the approved pilot users.'. It does not establish success for the stated scenario; the needed evidence is 'A freshly reset tablet enrolls into kiosk mode and exposes only approved applications.'.

This observation would validate a different case: A chain purchases Android handsets in bulk and wants zero-touch registration when users first power them on. It would check 'An eligible reseller-uploaded device automatically receives the intended Intune enrollment configuration.' after 'Integrate compatible Android zero-touch enrollment with Intune configuration assignments.'. It does not establish success for the stated scenario; the needed evidence is 'A freshly reset tablet enrolls into kiosk mode and exposes only approved applications.'.

This observation would validate a different case: An Android enterprise app is published through Managed Google Play but never appears in Intune available apps. It would check 'The selected Android app becomes assignable in Intune and installs on a pilot.' after 'Approve/sync the app in Managed Google Play and check connector status.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices report one approved Office installation and channel after cleanup.'.

This observation would validate a different case: Apple Business Manager's Apps and Books token expires and new app assignments stop synchronizing. It would check 'Current app licenses sync into Intune and a pilot install succeeds.' after 'Renew the managed Apps and Books location token and verify license sync.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices report one approved Office installation and channel after cleanup.'.

This observation would validate a different case: A Microsoft Store application has been delisted and a policy still targets its unavailable listing. It would check 'The replacement app package installs on pilot endpoints and no stale Store reference remains.' after 'Check current Store availability and switch to a supported enterprise packaging source if licensed.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices report one approved Office installation and channel after cleanup.'.

This observation would validate a different case: Two Android departments share a device group, but only warehouse devices should receive a barcode-scanning restriction. It would check 'The restriction appears only on warehouse devices in the test cohort.' after 'Split assignments using trusted device attributes and supported filters or group membership.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot proves the setting and later cohorts remain unchanged until promotion.'.

This observation would validate a different case: A mobile team pushes an Android Wi-Fi profile that references an enterprise certificate missing on the target devices. It would check 'A pilot Android device receives the certificate and connects to the secure SSID.' after 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot proves the setting and later cohorts remain unchanged until promotion.'.

This observation would validate a different case: Windows devices require a browser security setting available in the Intune settings catalog, but the admin creates an unrelated compliance rule. It would check 'The expected browser setting appears effective on targeted Windows pilot devices.' after 'Create a Windows device configuration profile using the supported settings catalog control.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot proves the setting and later cohorts remain unchanged until promotion.'.

This observation would validate a different case: A company-owned Android dedicated scanner needs restricted settings but the assigned profile exposes the complete Settings app. It would check 'The test scanner accesses its business app but not blocked system settings.' after 'Use a supported Android Enterprise dedicated-device restriction profile and approved kiosk configuration.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected template imports and a pilot setting can be created without schema errors.'.

This observation would validate a different case: An organization needs a new ADMX-backed policy in Intune that is not yet included in its ordinary settings catalog. It would check 'The policy applies to supported Windows pilot devices and reports an effective value.' after 'Import the supported ADMX definition and publish the associated configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected template imports and a pilot setting can be created without schema errors.'.

This observation would validate a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. It would check 'Supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.' after 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.'. It does not establish success for the stated scenario; the needed evidence is 'The corrected template imports and a pilot setting can be created without schema errors.'.

This action is appropriate for a different case: A Windows ADMX policy was imported with a duplicate namespace and now the administrative template cannot be saved. There, the targeted fix is 'Correct the imported ADMX metadata and related dependencies using supported Intune import rules.' because imported schemas must be syntactically and logically consistent. The current scenario instead requires 'Create a Windows device configuration profile using the supported settings catalog control.' and verification that the expected browser setting appears effective on targeted Windows pilot devices.

This action is appropriate for a different case: An iOS configuration update is queued but employees report it has not arrived despite healthy device enrollment. There, the targeted fix is 'Inspect profile assignment, latest device check-in and pending policy sync status.' because an enrolled device may be offline or awaiting policy processing. The current scenario instead requires 'Create a Windows device configuration profile using the supported settings catalog control.' and verification that the expected browser setting appears effective on targeted Windows pilot devices.

This action is appropriate for a different case: Windows accessibility settings must stay usable, but a security configuration profile unintentionally disables all assistive technology. There, the targeted fix is 'Adjust only the conflicting setting within a scoped policy after accessibility testing.' because accessibility requirements should not be overridden by broad unvalidated restrictions. The current scenario instead requires 'Create a Windows device configuration profile using the supported settings catalog control.' and verification that the expected browser setting appears effective on targeted Windows pilot devices.

This observation would validate a different case: A tenant has four months of Intune compliance history but executives want trend reporting without manually copying screenshots. It would check 'A dashboard reproduces month-over-month compliant counts from recorded source exports.' after 'Use Intune reporting exports or supported Graph reporting endpoints and create a governed dashboard.'. It does not establish success for the stated scenario; the needed evidence is 'Post-reboot monitoring demonstrates whether the underlying issue actually stopped recurring.'.

This observation would validate a different case: An admin dashboard shows compliance percentages but hides the tenant's oldest policy evaluation timestamp. It would check 'Each sample device shows its latest status and actual last evaluation time.' after 'Expose freshness and evaluation-time metadata in monitoring reports.'. It does not establish success for the stated scenario; the needed evidence is 'Post-reboot monitoring demonstrates whether the underlying issue actually stopped recurring.'.

This observation would validate a different case: A policy configuration conflict generates hundreds of alerts for the same device every hour. It would check 'A controlled conflict produces one traceable case rather than duplicate unbounded tickets.' after 'Deduplicate alert events and define actionable thresholds with correlation IDs.'. It does not establish success for the stated scenario; the needed evidence is 'Post-reboot monitoring demonstrates whether the underlying issue actually stopped recurring.'.

This action is appropriate for a different case: An iOS configuration update is queued but employees report it has not arrived despite healthy device enrollment. There, the targeted fix is 'Inspect profile assignment, latest device check-in and pending policy sync status.' because an enrolled device may be offline or awaiting policy processing. The current scenario instead requires 'Deploy a supported managed Wi-Fi profile and secure credential/certificate provisioning.' and verification that the enrolled corporate iPad connects automatically and no credential is displayed in instructions.

This action is appropriate for a different case: A company wants one kiosk policy for Teams Rooms and Android scanners and finds platform targeting failures. There, the targeted fix is 'Create separate specialty-device configuration profiles aligned to each platform.' because specialized endpoint capabilities cannot be assumed interchangeable. The current scenario instead requires 'Deploy a supported managed Wi-Fi profile and secure credential/certificate provisioning.' and verification that the enrolled corporate iPad connects automatically and no credential is displayed in instructions.

This action is appropriate for a different case: A Windows configuration profile shows 'conflict' for password length because two profiles target the same device with different values. There, the targeted fix is 'Inspect per-setting status and revise overlapping profile assignments or definitions.' because conflicting targeted settings do not become resolved by changing the device name. The current scenario instead requires 'Deploy a supported managed Wi-Fi profile and secure credential/certificate provisioning.' and verification that the enrolled corporate iPad connects automatically and no credential is displayed in instructions.

This observation would validate a different case: A remote kiosk is frozen after an application update and operations needs a controlled reboot, not a factory reset. It would check 'The kiosk reboots and returns to service with its installed apps intact.' after 'Use the Restart remote device action with authorization and user-impact assessment.'. It does not establish success for the stated scenario; the needed evidence is 'The query returns only eligible devices with the vulnerable app version.'.

This observation would validate a different case: A Windows device reports stale Defender signatures despite an update request and no connectivity to the signature service. It would check 'Signature version advances after the correct network source becomes accessible.' after 'Check update action status and network/update-source health before repeatedly resending commands.'. It does not establish success for the stated scenario; the needed evidence is 'The query returns only eligible devices with the vulnerable app version.'.

This observation would validate a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. It would check 'A test action is performed only on the exact approved device identity.' after 'Require verified Intune managed device ID, serial and ownership before destructive actions.'. It does not establish success for the stated scenario; the needed evidence is 'The query returns only eligible devices with the vulnerable app version.'.