Exam Bundle

This action is appropriate for a different case: An organization wants automatic BitLocker device encryption during provisioning but users become local administrators without escrow verification. There, the targeted fix is 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.' because BitLocker policy needs coordinated provisioning and secure recovery. The current scenario instead requires 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' and verification that security reports show one applied scan schedule and no unresolved conflicts.

This action is appropriate for a different case: Windows Firewall is disabled locally by a privileged user each time the computer boots despite managed policy. There, the targeted fix is 'Investigate effective endpoint security policy and tamper-protection or configuration drift.' because a recurring local override may signal policy conflict or unauthorized changes. The current scenario instead requires 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' and verification that security reports show one applied scan schedule and no unresolved conflicts.

This action is appropriate for a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. There, the targeted fix is 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.' because encryption management must preserve recovery information for authorized administrators. The current scenario instead requires 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' and verification that security reports show one applied scan schedule and no unresolved conflicts.

This observation would validate a different case: A new Android Enterprise token is created but managed Google Play synchronization never completes. It would check 'A test managed application synchronizes into Intune and becomes assignable.' after 'Verify Android Enterprise connector binding and Google managed Play integration health.'. It does not establish success for the stated scenario; the needed evidence is 'After app removal the test device remains supervised and applicable MDM policy stays intact.'.

This observation would validate a different case: An employee with a personal Android phone needs protected Teams access without granting IT full device wipe privileges. It would check 'The user retains personal data and an admin can remove only the approved company-managed data.' after 'Use Android work-profile or app-protection management appropriate for personally owned devices.'. It does not establish success for the stated scenario; the needed evidence is 'After app removal the test device remains supervised and applicable MDM policy stays intact.'.

This observation would validate a different case: A user enrolls a second Windows machine and receives an Intune maximum device count failure. It would check 'The approved user can enroll a permitted number of devices and a quota-exceeding test remains rejected.' after 'Check enrollment device limits and approved user quota rather than deleting unrelated devices.'. It does not establish success for the stated scenario; the needed evidence is 'After app removal the test device remains supervised and applicable MDM policy stays intact.'.

This action is appropriate for a different case: A new Windows 365 user receives a provisioning failure because available license capacity is exhausted. There, the targeted fix is 'Verify supported Windows 365 licenses and provisioning policy assignments before repeating provisioning.' because capacity and entitlement errors cannot be repaired by changing Windows Defender policy. The current scenario instead requires 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' and verification that the approved eligible devices upgrade and blocked hardware shows a documented reason.

This action is appropriate for a different case: A Windows Backup restore is offered during new Windows device setup but organizational policy forbids unmanaged personal restore sources. There, the targeted fix is 'Configure Windows Backup and restore policy with approved organizational device settings.' because enterprise restore behavior should be controlled at enrollment and data-governance boundaries. The current scenario instead requires 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' and verification that the approved eligible devices upgrade and blocked hardware shows a documented reason.

This action is appropriate for a different case: An organization wants a simplified user-driven Windows 11 setup with a small set of key apps and scripts but no custom device imaging. There, the targeted fix is 'Choose Windows Autopilot device preparation with an appropriately assigned user-driven policy.' because device preparation has a simplified enrollment flow and limited OOBE application/script scope. The current scenario instead requires 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' and verification that the approved eligible devices upgrade and blocked hardware shows a documented reason.

This action is appropriate for a different case: A line-of-business app uses a dependency installer that requires a reboot before the main install can work. There, the targeted fix is 'Configure appropriate Intune dependency and restart handling for both packages.' because an incomplete reboot can leave prerequisite components unavailable. The current scenario instead requires 'Use Intune app installation reports and export scoped failure data for analysis.' and verification that the export identifies the affected app and model-specific failure counts.

This action is appropriate for a different case: A Windows Win32 app detection rule checks only a registry key that remains after uninstall, causing false positives. There, the targeted fix is 'Use a reliable detection strategy reflecting actual installed application state.' because stale registry artifacts can mislead installation reporting. The current scenario instead requires 'Use Intune app installation reports and export scoped failure data for analysis.' and verification that the export identifies the affected app and model-specific failure counts.

This action is appropriate for a different case: A user complains that an optional productivity tool installs on every corporate phone without consent. There, the targeted fix is 'Change the Intune app assignment from Required to Available where appropriate.' because required and available assignments create different deployment experiences. The current scenario instead requires 'Use Intune app installation reports and export scoped failure data for analysis.' and verification that the export identifies the affected app and model-specific failure counts.

This action is appropriate for a different case: A company adds a new Intune compliance policy but Conditional Access continues permitting devices without any policy. There, the targeted fix is 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.' because an unassessed device should not be silently considered compliant. The current scenario instead requires 'Deploy Windows LAPS policy through Intune and back up unique device passwords to the approved directory.' and verification that two pilot PCs have different protected LAPS secrets and scheduled rotation is recorded.

This action is appropriate for a different case: A company requires device risk severity from Defender for Endpoint to affect Conditional Access grants. There, the targeted fix is 'Integrate Defender device risk signals into Intune compliance and enforce the result through Entra Conditional Access.' because device risk can contribute to compliance decisions before app access. The current scenario instead requires 'Deploy Windows LAPS policy through Intune and back up unique device passwords to the approved directory.' and verification that two pilot PCs have different protected LAPS secrets and scheduled rotation is recorded.

This action is appropriate for a different case: A company uses corporate Windows endpoints but wants passwordless sign-in based on the user's biometric gesture, not network location. There, the targeted fix is 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.' because a biometric gesture unlocks a local cryptographic credential rather than substituting for authorization. The current scenario instead requires 'Deploy Windows LAPS policy through Intune and back up unique device passwords to the approved directory.' and verification that two pilot PCs have different protected LAPS secrets and scheduled rotation is recorded.

This observation would validate a different case: A Windows device fails the feature update because of a safeguard hold while security fixes install normally. It would check 'The blocked feature update shows its precise hold while quality updates continue.' after 'Investigate feature-update safeguard reporting and compatibility evidence, not the monthly update ring.'. It does not establish success for the stated scenario; the needed evidence is 'After managed restart the pilot reports the new build and update-compliant state.'.

This observation would validate a different case: A user wants to apply hotpatch on any Windows 11 computer with no regard for supported edition or baseline. It would check 'An eligible pilot receives hotpatch while an ineligible PC takes the normal cumulative update path.' after 'Check hotpatch eligibility, supported OS/architecture and necessary baseline state before enabling policy.'. It does not establish success for the stated scenario; the needed evidence is 'After managed restart the pilot reports the new build and update-compliant state.'.

This observation would validate a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. It would check 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.' after 'Check supervision and platform prerequisites before configuring Apple update enforcement.'. It does not establish success for the stated scenario; the needed evidence is 'After managed restart the pilot reports the new build and update-compliant state.'.

This action is appropriate for a different case: A laptop must arrive ready for an employee after technicians install time-consuming core apps in the warehouse before shipment. There, the targeted fix is 'Choose Windows Autopilot pre-provisioning with a technician phase and an appropriate user phase.' because pre-provisioning separates technician-side device readiness from later user personalization. The current scenario instead requires 'Review provisioning policy region and supported placement settings before creating new Cloud PCs.' and verification that a sample Cloud PC resides in the approved region and passes jurisdiction checks.

This action is appropriate for a different case: Autopilot setup stalls indefinitely because a Win32 application detection rule never reports installation success. There, the targeted fix is 'Inspect the Win32 detection rule and ESP app installation status before disabling enrollment security.' because a false installation state can block ESP even when binaries are present. The current scenario instead requires 'Review provisioning policy region and supported placement settings before creating new Cloud PCs.' and verification that a sample Cloud PC resides in the approved region and passes jurisdiction checks.

This action is appropriate for a different case: A Windows Autopilot profile targets the correct device group but the enrollment flow shows a generic consumer setup. There, the targeted fix is 'Check device registration, sync, and Autopilot profile assignment status before reset attempts.' because a profile must be available for the device identity during OOBE. The current scenario instead requires 'Review provisioning policy region and supported placement settings before creating new Cloud PCs.' and verification that a sample Cloud PC resides in the approved region and passes jurisdiction checks.

This observation would validate a different case: A catalog application is assigned but its vendor's older custom package remains installed and causes detection confusion. It would check 'The pilot reports one supported application installation with the desired detected version.' after 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.'. It does not establish success for the stated scenario; the needed evidence is 'An assigned helper connects with user approval and the session is recorded.'.

This observation would validate a different case: A corporate Wi-Fi system rejects Cloud PKI client certificates because the RADIUS server does not trust the new intermediate CA. It would check 'A test device authenticates to Wi-Fi and the server validates the full issued chain.' after 'Publish and validate the appropriate CA trust chain before onboarding clients.'. It does not establish success for the stated scenario; the needed evidence is 'An assigned helper connects with user approval and the session is recorded.'.

This observation would validate a different case: An EPM elevation rule matches any application with a loose name and unexpectedly grants admin privilege to an unapproved binary. It would check 'The approved executable elevates and a same-named unsigned test binary is denied.' after 'Tighten EPM rules to approved publisher, file, certificate or hash criteria as supported.'. It does not establish success for the stated scenario; the needed evidence is 'An assigned helper connects with user approval and the session is recorded.'.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'The updated compatible app receives and enforces the intended policy.'.

This observation would validate a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. It would check 'The app gets its intended work URL while the personal device remains unenrolled.' after 'Configure the correct managed-app configuration policy for the targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'The updated compatible app receives and enforces the intended policy.'.

This observation would validate a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. It would check 'The protected app removes corporate documents but the user's personal content remains.' after 'Trigger selective corporate app data wipe for the managed identity where supported.'. It does not establish success for the stated scenario; the needed evidence is 'The updated compatible app receives and enforces the intended policy.'.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Configure supported app protection backup restrictions for organization data.' and verification that a device backup excludes protected work app content while personal backup continues.

This action is appropriate for a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. There, the targeted fix is 'Configure the correct managed-app configuration policy for the targeted identity.' because app configuration for managed apps differs from device-wide iOS configuration. The current scenario instead requires 'Configure supported app protection backup restrictions for organization data.' and verification that a device backup excludes protected work app content while personal backup continues.

This action is appropriate for a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. There, the targeted fix is 'Use managed-device app configuration targeting appropriate device groups.' because corporate managed device settings should not be broadcast to personal installations. The current scenario instead requires 'Configure supported app protection backup restrictions for organization data.' and verification that a device backup excludes protected work app content while personal backup continues.

This observation would validate a different case: An employee accesses a protected work document through a third-party app that is not enrolled in the Intune app protection ecosystem. It would check 'The third-party app is denied and an approved supported app can open the document.' after 'Enforce Conditional Access and managed-app data transfer boundaries for unsupported clients.'. It does not establish success for the stated scenario; the needed evidence is 'The targeted app starts with the right corporate tenant and no manual text entry.'.

This observation would validate a different case: An administrator creates a strict app protection policy for Android and accidentally targets personal iPhones as well. It would check 'Android targets receive the rule and unrelated iOS users are unaffected.' after 'Use platform-specific app protection policies with precise assignment scopes.'. It does not establish success for the stated scenario; the needed evidence is 'The targeted app starts with the right corporate tenant and no manual text entry.'.

This observation would validate a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. It would check 'The protected supported app connects and an unprotected native app cannot access mail.' after 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.'. It does not establish success for the stated scenario; the needed evidence is 'The targeted app starts with the right corporate tenant and no manual text entry.'.