Exam Bundle

This observation would validate a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. It would check 'A help-desk test user can reset an assigned device but cannot edit security policies.' after 'Create the narrowest Intune RBAC role with only required remote-action permissions.'. It does not establish success for the stated scenario; the needed evidence is 'Only the assigned support accounts hold local admin access on test machines.'.

This observation would validate a different case: An executive wants email access blocked from unmanaged devices even when their passwords and MFA succeed. It would check 'A compliant test device accesses mail while an unmanaged test device is blocked.' after 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.'. It does not establish success for the stated scenario; the needed evidence is 'Only the assigned support accounts hold local admin access on test machines.'.

This observation would validate a different case: A company requires device risk severity from Defender for Endpoint to affect Conditional Access grants. It would check 'A high-risk test endpoint becomes noncompliant and fails the intended access policy.' after 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.'. It does not establish success for the stated scenario; the needed evidence is 'Only the assigned support accounts hold local admin access on test machines.'.

This observation would validate a different case: An Intune compliance policy for Android expects a Windows-only setting and shows unknown evaluations. It would check 'Android pilot devices evaluate their supported controls without irrelevant Windows errors.' after 'Assign platform-specific compliance settings only to supported operating systems.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot device contains both mandated emergency access and the intended managed members.'.

This observation would validate a different case: A PIN policy is applied but Windows Hello for Business enrollment fails on devices without a functional TPM. It would check 'An eligible pilot device provisions its Hello key and an ineligible device gets an actionable diagnostic.' after 'Diagnose supported hardware and Windows Hello provisioning requirements instead of weakening policy globally.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot device contains both mandated emergency access and the intended managed members.'.

This observation would validate a different case: A company uses corporate Windows endpoints but wants passwordless sign-in based on the user's biometric gesture, not network location. It would check 'User sign-in meets the intended authentication requirement without a shared password.' after 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot device contains both mandated emergency access and the intended managed members.'.

This action is appropriate for a different case: A company wants standard users to elevate one approved IT utility without granting permanent local administrator access. There, the targeted fix is 'Configure Intune Endpoint Privilege Management (EPM) elevation policies for that signed and approved app.' because just-in-time elevation narrows privilege compared with standing administrator membership. The current scenario instead requires 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.' and verification that an elevated test process creates an attributable report with application identity.

This action is appropriate for a different case: An EPM elevation rule matches any application with a loose name and unexpectedly grants admin privilege to an unapproved binary. There, the targeted fix is 'Tighten EPM rules to approved publisher, file, certificate or hash criteria as supported.' because broad elevation matches create avoidable privilege escalation paths. The current scenario instead requires 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.' and verification that an elevated test process creates an attributable report with application identity.

This action is appropriate for a different case: A technician decides to allow all unknown executables to elevate because many help desk elevation requests are pending. There, the targeted fix is 'Review EPM elevation requests and create narrow approved rules rather than blanket authorization.' because EPM is meant to reduce uncontrolled standing privilege. The current scenario instead requires 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.' and verification that an elevated test process creates an attributable report with application identity.

This action is appropriate for a different case: A report claims 100% compliance because it excludes devices that have not checked in for 30 days. There, the targeted fix is 'Include stale-device and missing-data treatment in compliance reporting definitions.' because selective omission can misstate fleet security health. The current scenario instead requires 'Export Intune app installation state per device and failure category.' and verification that the report lists each failed app installation and its relevant code.

This action is appropriate for a different case: An organization sees repeated unexpected restarts on one hardware model after a new driver rollout. There, the targeted fix is 'Correlate restart frequency with device model and driver deployment history.' because reliability changes should be investigated by cohort and change timing. The current scenario instead requires 'Export Intune app installation state per device and failure category.' and verification that the report lists each failed app installation and its relevant code.

This action is appropriate for a different case: A tenant has four months of Intune compliance history but executives want trend reporting without manually copying screenshots. There, the targeted fix is 'Use Intune reporting exports or supported Graph reporting endpoints and create a governed dashboard.' because historical trend analysis requires repeatable, appropriately scoped data extraction. The current scenario instead requires 'Export Intune app installation state per device and failure category.' and verification that the report lists each failed app installation and its relevant code.

This observation would validate a different case: An employee's Windows 365 Cloud PC is deleted accidentally and the team has no documented recovery plan. It would check 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.' after 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.'. It does not establish success for the stated scenario; the needed evidence is 'The signed-in employee cannot elevate without an authorized privilege mechanism.'.

This observation would validate a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. It would check 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.' after 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.'. It does not establish success for the stated scenario; the needed evidence is 'The signed-in employee cannot elevate without an authorized privilege mechanism.'.

This observation would validate a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. It would check 'OOBE finishes with essentials and remaining applications deploy after check-in.' after 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.'. It does not establish success for the stated scenario; the needed evidence is 'The signed-in employee cannot elevate without an authorized privilege mechanism.'.

This observation would validate a different case: A Windows update fails only on one device model after a firmware revision and the team considers blocking all tenant updates. It would check 'The affected model is paused for remediation while other cohorts continue patching.' after 'Use per-model diagnostics and staged targeting to isolate the compatibility defect.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices patch first and broader devices follow after a monitored validation window.'.

This observation would validate a different case: A fleet of Samsung Android corporate devices needs firmware updates but the ordinary app update policy changes only application packages. It would check 'The pilot Samsung device reports the intended firmware build after its FOTA policy.' after 'Plan supported Android OEM firmware-over-the-air (FOTA) deployment or configuration restrictions.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices patch first and broader devices follow after a monitored validation window.'.

This observation would validate a different case: An administrator wants to expedite one critical Windows quality patch but leave routine rollout rings unchanged. It would check 'Affected devices report the designated quality update within the approved urgent deadline.' after 'Use an eligible expedited quality update policy with targeted monitoring.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot devices patch first and broader devices follow after a monitored validation window.'.

This observation would validate a different case: A subset of Windows devices is ineligible for hotpatch and fails the expected no-restart maintenance target. It would check 'The noneligible pilot receives the current LCU and its restart need is communicated.' after 'Use the standard cumulative update fallback and investigate eligibility rather than withholding security fixes.'. It does not establish success for the stated scenario; the needed evidence is 'The exported report identifies installed builds and outstanding restarts separately.'.

This observation would validate a different case: An organization plans Windows Autopatch but has not assigned devices to a supported Autopatch group and expects updates automatically. It would check 'A pilot device appears in the expected Autopatch report and follows its deployment schedule.' after 'Verify Autopatch prerequisites, device registration and managed update policy assignments.'. It does not establish success for the stated scenario; the needed evidence is 'The exported report identifies installed builds and outstanding restarts separately.'.

This observation would validate a different case: A fleet of Samsung Android corporate devices needs firmware updates but the ordinary app update policy changes only application packages. It would check 'The pilot Samsung device reports the intended firmware build after its FOTA policy.' after 'Plan supported Android OEM firmware-over-the-air (FOTA) deployment or configuration restrictions.'. It does not establish success for the stated scenario; the needed evidence is 'The exported report identifies installed builds and outstanding restarts separately.'.

This observation would validate a different case: A PIN policy is applied but Windows Hello for Business enrollment fails on devices without a functional TPM. It would check 'An eligible pilot device provisions its Hello key and an ineligible device gets an actionable diagnostic.' after 'Diagnose supported hardware and Windows Hello provisioning requirements instead of weakening policy globally.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot becomes compliant after encryption, and an unencrypted device past grace is blocked.'.

This observation would validate a different case: A compliant Windows device is blocked because a Conditional Access policy targets the wrong cloud app or includes a nested exclusion. It would check 'Logs identify the intended policy and the compliant pilot user gains authorized access.' after 'Review Conditional Access policy targeting and sign-in logs for the exact grant condition.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot becomes compliant after encryption, and an unencrypted device past grace is blocked.'.

This observation would validate a different case: A company adds a new Intune compliance policy but Conditional Access continues permitting devices without any policy. It would check 'A device with no applicable compliance evaluation is denied when the policy requires it.' after 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot becomes compliant after encryption, and an unencrypted device past grace is blocked.'.

This observation would validate a different case: A security team needs to audit which EPM-elevated executables employees actually run across a pilot fleet. It would check 'An elevated test process creates an attributable report with application identity.' after 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'A test device authenticates to Wi-Fi and the server validates the full issued chain.'.

This observation would validate a different case: An enterprise needs to deploy a commonly used third-party Windows app and does not want to maintain every vendor installer version manually. It would check 'A pilot app installs from the catalog and updates to an approved newer release.' after 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.'. It does not establish success for the stated scenario; the needed evidence is 'A test device authenticates to Wi-Fi and the server validates the full issued chain.'.

This observation would validate a different case: A help desk needs remote interactive assistance for users but employees should be able to grant consent to support sessions. It would check 'An assigned helper connects with user approval and the session is recorded.' after 'Configure Microsoft Intune Remote Help with approved roles, tenant configuration and consent behavior.'. It does not establish success for the stated scenario; the needed evidence is 'A test device authenticates to Wi-Fi and the server validates the full issued chain.'.

This action is appropriate for a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. There, the targeted fix is 'Check supervision and platform prerequisites before configuring Apple update enforcement.' because some Apple update commands require corporate supervision. The current scenario instead requires 'Inspect effective update policies and correct overlapping feature controls.' and verification that the corrected pilot remains on the approved target release through the test update cycle.

This action is appropriate for a different case: Windows clients are marked pending restart after the monthly cumulative patch, and compliance reports show older build versions. There, the targeted fix is 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.' because installed updates may require reboot to become fully effective. The current scenario instead requires 'Inspect effective update policies and correct overlapping feature controls.' and verification that the corrected pilot remains on the approved target release through the test update cycle.

This action is appropriate for a different case: A device receives a hotpatch month update but the team falsely claims it never needs another restart. There, the targeted fix is 'Explain and plan baseline cumulative updates that require reboot alongside hotpatch months.' because hotpatch cycles still include periodic baseline updates and restart requirements. The current scenario instead requires 'Inspect effective update policies and correct overlapping feature controls.' and verification that the corrected pilot remains on the approved target release through the test update cycle.

This action is appropriate for a different case: An organization wants automatic BitLocker device encryption during provisioning but users become local administrators without escrow verification. There, the targeted fix is 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.' because BitLocker policy needs coordinated provisioning and secure recovery. The current scenario instead requires 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' and verification that security reports show one applied scan schedule and no unresolved conflicts.

This action is appropriate for a different case: Windows Firewall is disabled locally by a privileged user each time the computer boots despite managed policy. There, the targeted fix is 'Investigate effective endpoint security policy and tamper-protection or configuration drift.' because a recurring local override may signal policy conflict or unauthorized changes. The current scenario instead requires 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' and verification that security reports show one applied scan schedule and no unresolved conflicts.

This action is appropriate for a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. There, the targeted fix is 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' because encryption management must preserve recovery information for authorized administrators. The current scenario instead requires 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' and verification that security reports show one applied scan schedule and no unresolved conflicts.