Exam Bundle

This action is appropriate for a different case: A Windows local group policy replaces an emergency break-glass member by accident during rollout. There, the targeted fix is 'Choose group-membership update semantics that preserve required approved break-glass access.' because replacing all members can unintentionally remove essential recovery identities. The current scenario instead requires 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.' and verification that the protected app signs in with its applied policy while an unsupported client is denied.

This action is appropriate for a different case: Two subsidiaries use one Intune tenant and regional operators must not see each other's device records. There, the targeted fix is 'Configure Intune scope tags and appropriate role scope group assignments.' because scoped administration can restrict what assigned administrators can see or change. The current scenario instead requires 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.' and verification that the protected app signs in with its applied policy while an unsupported client is denied.

This action is appropriate for a different case: A PIN policy is applied but Windows Hello for Business enrollment fails on devices without a functional TPM. There, the targeted fix is 'Diagnose supported hardware and Windows Hello provisioning requirements instead of weakening policy globally.' because credential provisioning depends on platform capabilities and tenant settings. The current scenario instead requires 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.' and verification that the protected app signs in with its applied policy while an unsupported client is denied.

This observation would validate a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. It would check 'A help-desk test user can reset an assigned device but cannot edit security policies.' after 'Create the narrowest Intune RBAC role with only required remote-action permissions.'. It does not establish success for the stated scenario; the needed evidence is 'The conflicting assignments are resolved and the device reports consistent effective settings.'.

This observation would validate a different case: An administrator incorrectly believes scope tags prevent users from receiving a deployed app assignment. It would check 'A tagged device receives its correctly assigned application despite regional admin visibility limits.' after 'Distinguish administrator visibility restrictions from user and device assignment targeting.'. It does not establish success for the stated scenario; the needed evidence is 'The conflicting assignments are resolved and the device reports consistent effective settings.'.

This observation would validate a different case: A Windows local group policy replaces an emergency break-glass member by accident during rollout. It would check 'The pilot device contains both mandated emergency access and the intended managed members.' after 'Choose group-membership update semantics that preserve required approved break-glass access.'. It does not establish success for the stated scenario; the needed evidence is 'The conflicting assignments are resolved and the device reports consistent effective settings.'.

This observation would validate a different case: An organization sees repeated unexpected restarts on one hardware model after a new driver rollout. It would check 'The post-remediation model reports fewer unexpected restarts under comparable usage.' after 'Correlate restart frequency with device model and driver deployment history.'. It does not establish success for the stated scenario; the needed evidence is 'The score change is measured on comparable hardware and reversed after a pilot fix.'.

This observation would validate a different case: The Intune message center announces a change to a management service and the help desk wants to assess business impact. It would check 'An impact record identifies affected device groups and remediation owners for the announced change.' after 'Track service notifications against affected endpoint platforms, dependencies and owned runbooks.'. It does not establish success for the stated scenario; the needed evidence is 'The score change is measured on comparable hardware and reversed after a pilot fix.'.

This observation would validate a different case: A tenant's Intune service communications warn of a regional enrollment issue but support continues reinstalling Company Portal on every phone. It would check 'The incident is recorded as provider-side and new enrollment succeeds after recovery.' after 'Check Intune tenant status, service health and message center notifications first.'. It does not establish success for the stated scenario; the needed evidence is 'The score change is measured on comparable hardware and reversed after a pilot fix.'.

This observation would validate a different case: A security baseline uses an older configuration and the team wants to adopt a new recommended baseline version without breaking specialized apps. It would check 'A test group meets the new settings without loss of required business application behavior.' after 'Compare baseline versions and pilot the updated policy with compatibility tests.'. It does not establish success for the stated scenario; the needed evidence is 'The approved application executes and the untrusted test binary remains denied.'.

This observation would validate a different case: An organization wants automatic BitLocker device encryption during provisioning but users become local administrators without escrow verification. It would check 'The pilot encrypts successfully and a test recovery operation uses an approved escrowed key.' after 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.'. It does not establish success for the stated scenario; the needed evidence is 'The approved application executes and the untrusted test binary remains denied.'.

This observation would validate a different case: Windows Firewall is disabled locally by a privileged user each time the computer boots despite managed policy. It would check 'The managed firewall returns to the approved state and the override attempt is documented.' after 'Investigate effective endpoint security policy and tamper-protection or configuration drift.'. It does not establish success for the stated scenario; the needed evidence is 'The approved application executes and the untrusted test binary remains denied.'.

This observation would validate a different case: The security team notices Windows 365 Cloud PCs receive updates far later than physical laptops. It would check 'Targeted Cloud PCs show the approved monthly update version in reports.' after 'Check Cloud PC update policy assignment and Windows Autopatch/Intune targeting.'. It does not establish success for the stated scenario; the needed evidence is 'The maintenance schedule shows baseline reboots and hotpatch months are documented separately.'.

This observation would validate a different case: An Intune report says an update was assigned but users claim it is installed; the team has no deployment status evidence. It would check 'The pilot's report matches installed build and documents its restart status.' after 'Review Windows update deployment and per-device installation reports, including pending restart state.'. It does not establish success for the stated scenario; the needed evidence is 'The maintenance schedule shows baseline reboots and hotpatch months are documented separately.'.

This observation would validate a different case: An iPhone fleet needs supervised operating-system updates with deferred installation schedules and the administrator uses a Windows update ring. It would check 'A supervised pilot receives the targeted Apple OS update on its intended schedule.' after 'Configure supported iOS/iPadOS update settings using Intune Settings Catalog or Apple update management controls.'. It does not establish success for the stated scenario; the needed evidence is 'The maintenance schedule shows baseline reboots and hotpatch months are documented separately.'.

This observation would validate a different case: A Graph automation exceeds Intune service request limits and receives HTTP 429 responses. It would check 'A test workload recovers after throttling within the approved retry budget.' after 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.'. It does not establish success for the stated scenario; the needed evidence is 'After an approved fix, endpoint metrics improve and the recorded work item shows the change.'.

This observation would validate a different case: A tenant needs to find stale Intune managed devices and export their names using automation without granting a developer full global administrator rights. It would check 'The script returns only approved inventory fields and cannot delete device records.' after 'Use Microsoft Graph with scoped application or delegated permissions and paginated queries.'. It does not establish success for the stated scenario; the needed evidence is 'After an approved fix, endpoint metrics improve and the recorded work item shows the change.'.

This observation would validate a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. It would check 'The dry run rejects stale selections and records the updated approved device set.' after 'Add preflight freshness checks and compare identifiers before applying bulk changes.'. It does not establish success for the stated scenario; the needed evidence is 'After an approved fix, endpoint metrics improve and the recorded work item shows the change.'.

This action is appropriate for a different case: A contractor loses the company laptop and IT must prevent continued device-based cloud access without deleting the contractor's unrelated personal account. There, the targeted fix is 'Disable the compromised Entra device object and revoke relevant sessions according to incident policy.' because revoking device trust is distinct from indiscriminately deleting an identity. The current scenario instead requires 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.' and verification that the device registers for work access without appearing as a fully corporate-managed endpoint.

This action is appropriate for a different case: A security group uses a device display-name prefix to decide privileged access, and users can influence the machine name. There, the targeted fix is 'Base privileged targeting on controlled device properties and separate authorization, not an untrusted name.' because a mutable name string alone is a weak proof of managed device trust. The current scenario instead requires 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.' and verification that the device registers for work access without appearing as a fully corporate-managed endpoint.

This action is appropriate for a different case: An administrator wants to restrict a sensitive app to devices that are company-managed and mistakenly assumes Entra join guarantees security compliance. There, the targeted fix is 'Combine appropriate managed device identity with evaluated Intune compliance and Conditional Access requirements.' because identity ownership and actual security posture are separate trust signals. The current scenario instead requires 'Use Microsoft Entra device registration and appropriate application-level controls instead of full corporate join.' and verification that the device registers for work access without appearing as a fully corporate-managed endpoint.

This observation would validate a different case: A sales organization wants newly provisioned laptops automatically assigned to an Entra device group based on their operating system. It would check 'A test Windows device joins the intended group and a test macOS device does not.' after 'Create a dynamic device membership rule using supported operating system properties.'. It does not establish success for the stated scenario; the needed evidence is 'The updated attributes place the endpoint in the group without a standing manual workaround.'.

This observation would validate a different case: A shared meeting-room Windows device should not be associated with an individual employee for sign-in identity and assignment. It would check 'A test shared device is enrolled under the approved ownership workflow without a permanent user affinity.' after 'Plan an organization-owned shared device enrollment and appropriate Entra device identity.'. It does not establish success for the stated scenario; the needed evidence is 'The updated attributes place the endpoint in the group without a standing manual workaround.'.

This observation would validate a different case: An Entra-registered personal phone is replaced, but the old device remains in the account's list long after retirement. It would check 'The retired phone registration disappears without affecting the replacement device's sign-in.' after 'Use a verified stale registration cleanup process respecting user and enrollment ownership.'. It does not establish success for the stated scenario; the needed evidence is 'The updated attributes place the endpoint in the group without a standing manual workaround.'.

This observation would validate a different case: An administrator wants to restrict a sensitive app to devices that are company-managed and mistakenly assumes Entra join guarantees security compliance. It would check 'A joined noncompliant laptop is blocked, while a joined compliant one passes the test policy.' after 'Combine appropriate managed device identity with evaluated Intune compliance and Conditional Access requirements.'. It does not establish success for the stated scenario; the needed evidence is 'A designated enrollment account joins an allowed device and an unauthorized account remains blocked.'.

This observation would validate a different case: An Entra device registration does not show as compliant even though the user successfully authenticated to Microsoft 365. It would check 'The portal shows registration separately from management and compliance state after enrollment.' after 'Distinguish device identity registration from Intune enrollment and compliance policy evaluation.'. It does not establish success for the stated scenario; the needed evidence is 'A designated enrollment account joins an allowed device and an unauthorized account remains blocked.'.

This observation would validate a different case: A policy team needs device enrollment reports by manufacturer and model but groups devices only by their latest friendly names. It would check 'An inventory check classifies sampled devices accurately despite arbitrary renamed devices.' after 'Use stable provider-enumerated device properties and verified managed inventory data for reporting groups.'. It does not establish success for the stated scenario; the needed evidence is 'A designated enrollment account joins an allowed device and an unauthorized account remains blocked.'.

This observation would validate a different case: A Change Review Agent recommends approving a proposed Intune policy that would affect a high-risk executive device group. It would check 'The reviewer sees the target change and records an explicit decision, not automatic deployment.' after 'Inspect the multi-admin approval request and agent impact findings before approving.'. It does not establish success for the stated scenario; the needed evidence is 'A sample execution records IDs and outcomes but omits restricted personal attributes.'.

This observation would validate a different case: A security admin sees a Security Copilot agent suggest that 500 endpoints are stale and immediately prepares a bulk offboarding job. It would check 'The admin confirms affected IDs and only approved stale devices are offboarded.' after 'Review the Device Offboarding Agent evidence and require authorized admin approval before changes.'. It does not establish success for the stated scenario; the needed evidence is 'A sample execution records IDs and outcomes but omits restricted personal attributes.'.

This observation would validate a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. It would check 'The dry run rejects stale selections and records the updated approved device set.' after 'Add preflight freshness checks and compare identifiers before applying bulk changes.'. It does not establish success for the stated scenario; the needed evidence is 'A sample execution records IDs and outcomes but omits restricted personal attributes.'.

This observation would validate a different case: A tenant's Intune service communications warn of a regional enrollment issue but support continues reinstalling Company Portal on every phone. It would check 'The incident is recorded as provider-side and new enrollment succeeds after recovery.' after 'Check Intune tenant status, service health and message center notifications first.'. It does not establish success for the stated scenario; the needed evidence is 'An impact record identifies affected device groups and remediation owners for the announced change.'.

This observation would validate a different case: A company must track enrollment failures by platform and technician across branches to find a repeating setup problem. It would check 'A sample export groups failures accurately by OS and enrollment profile.' after 'Create scoped enrollment failure reports with platform, profile and error details.'. It does not establish success for the stated scenario; the needed evidence is 'An impact record identifies affected device groups and remediation owners for the announced change.'.

This observation would validate a different case: Application startup performance degrades after a new security agent version and teams argue using anecdotal complaints. It would check 'The score change is measured on comparable hardware and reversed after a pilot fix.' after 'Compare Endpoint Analytics app startup telemetry before and after the agent release.'. It does not establish success for the stated scenario; the needed evidence is 'An impact record identifies affected device groups and remediation owners for the announced change.'.