Exam Bundle

This observation would validate a different case: An employee accesses a protected work document through a third-party app that is not enrolled in the Intune app protection ecosystem. It would check 'The third-party app is denied and an approved supported app can open the document.' after 'Enforce Conditional Access and managed-app data transfer boundaries for unsupported clients.'. It does not establish success for the stated scenario; the needed evidence is 'The targeted app starts with the right corporate tenant and no manual text entry.'.

This observation would validate a different case: An administrator creates a strict app protection policy for Android and accidentally targets personal iPhones as well. It would check 'Android targets receive the rule and unrelated iOS users are unaffected.' after 'Use platform-specific app protection policies with precise assignment scopes.'. It does not establish success for the stated scenario; the needed evidence is 'The targeted app starts with the right corporate tenant and no manual text entry.'.

This observation would validate a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. It would check 'The protected supported app connects and an unprotected native app cannot access mail.' after 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.'. It does not establish success for the stated scenario; the needed evidence is 'The targeted app starts with the right corporate tenant and no manual text entry.'.

This action is appropriate for a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. There, the targeted fix is 'Use an authorized Wipe action on the verified device record with incident tracking.' because a full wipe is appropriate for a lost corporate endpoint when approved. The current scenario instead requires 'Distinguish queued retirement from confirmed device-side completion.' and verification that a test report tracks pending and completed states separately with last contact time.

This action is appropriate for a different case: An employee leaves and IT must remove organizational data from their personally owned phone without deleting family photos. There, the targeted fix is 'Select Retire or selective corporate data removal where supported, not full device wipe.' because bYOD offboarding should respect ownership and preserve personal data. The current scenario instead requires 'Distinguish queued retirement from confirmed device-side completion.' and verification that a test report tracks pending and completed states separately with last contact time.

This action is appropriate for a different case: A device query using KQL includes user identity details that junior support staff do not need. There, the targeted fix is 'Scope query permissions and output handling to least-privilege operational requirements.' because observability can expose sensitive endpoint metadata beyond the primary task. The current scenario instead requires 'Distinguish queued retirement from confirmed device-side completion.' and verification that a test report tracks pending and completed states separately with last contact time.

This observation would validate a different case: An employee's Windows 365 Cloud PC is deleted accidentally and the team has no documented recovery plan. It would check 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.' after 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.'. It does not establish success for the stated scenario; the needed evidence is 'After pilot reset the device returns to the expected managed ready state.'.

This observation would validate a different case: An Enrollment Status Page shows 'setup complete' before a required security application is installed on Windows devices. It would check 'The device does not complete gated setup until the designated security app succeeds.' after 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'After pilot reset the device returns to the expected managed ready state.'.

This observation would validate a different case: A finance employee's Cloud PC must be resized to handle a heavier workload without creating an unmanaged new endpoint. It would check 'After resize the Cloud PC reports the intended capacity and retains approved work data.' after 'Use the supported Windows 365 Cloud PC resize process with entitlement and user-data safeguards.'. It does not establish success for the stated scenario; the needed evidence is 'After pilot reset the device returns to the expected managed ready state.'.

This action is appropriate for a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. There, the targeted fix is 'Configure the correct managed-app configuration policy for the targeted identity.' because app configuration for managed apps differs from device-wide iOS configuration. The current scenario instead requires 'Plan per-identity app protection and access boundaries with separate Conditional Access scopes.' and verification that tests show each account can access only its authorized data in the protected app.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Plan per-identity app protection and access boundaries with separate Conditional Access scopes.' and verification that tests show each account can access only its authorized data in the protected app.

This action is appropriate for a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. There, the targeted fix is 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.' because selective restrictions can preserve personal usability while preventing leakage. The current scenario instead requires 'Plan per-identity app protection and access boundaries with separate Conditional Access scopes.' and verification that tests show each account can access only its authorized data in the protected app.

This observation would validate a different case: A Windows client has a pending update and the restart schedule interrupts clinical workstations during business hours. It would check 'Pilot workstations install updates and restart within the specified maintenance policy.' after 'Adjust appropriate Windows update ring active hours and restart deadline controls.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.'.

This observation would validate a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. It would check 'Pilot Macs report the approved OS version after the assigned update window.' after 'Deploy supported macOS software update policy through the Intune Settings Catalog.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.'.

This observation would validate a different case: Android work-profile devices must not be interrupted by a forced OS update during a defined maintenance freeze. It would check 'A pilot defers updates during the freeze and installs after the approved period.' after 'Use supported Android system-update policies or OEM configuration suited to the ownership mode.'. It does not establish success for the stated scenario; the needed evidence is 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.'.

This action is appropriate for a different case: A support team uses Security Copilot to summarize device performance but mistakes an anomaly prediction for a completed repair. There, the targeted fix is 'Treat AI device performance analysis as a recommendation requiring verified action and measurable outcome.' because prediction and actual endpoint remediation are separate workflow stages. The current scenario instead requires 'Minimize Graph output and restrict diagnostic log retention and access.' and verification that a sample execution records IDs and outcomes but omits restricted personal attributes.

This action is appropriate for a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. There, the targeted fix is 'Return the supported JSON schema without extra stdout content and validate the rules file.' because machine-readable output format is part of the custom compliance contract. The current scenario instead requires 'Minimize Graph output and restrict diagnostic log retention and access.' and verification that a sample execution records IDs and outcomes but omits restricted personal attributes.

This action is appropriate for a different case: A security operations script stores an Intune app secret in a shared plain text PowerShell file. There, the targeted fix is 'Use supported secure credential or certificate-based authentication and restricted identity permissions.' because automation credentials require separate lifecycle protection from script source. The current scenario instead requires 'Minimize Graph output and restrict diagnostic log retention and access.' and verification that a sample execution records IDs and outcomes but omits restricted personal attributes.

This action is appropriate for a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. There, the targeted fix is 'Package it as a supported Intune Win32 app and configure the required install command.' because Win32 app packaging supports installation of traditional desktop software with monitoring. The current scenario instead requires 'Check current Store availability and switch to a supported enterprise packaging source if licensed.' and verification that the replacement app package installs on pilot endpoints and no stale Store reference remains.

This action is appropriate for a different case: An app catalog entry becomes available to the wrong security group and contractors download a licensed finance tool. There, the targeted fix is 'Correct required/available assignment and group exclusions to enforce app entitlement.' because app visibility and installation rights depend on correct user/device targeting. The current scenario instead requires 'Check current Store availability and switch to a supported enterprise packaging source if licensed.' and verification that the replacement app package installs on pilot endpoints and no stale Store reference remains.

This action is appropriate for a different case: Apple Business Manager's Apps and Books token expires and new app assignments stop synchronizing. There, the targeted fix is 'Renew the managed Apps and Books location token and verify license sync.' because volume-purchased app distribution depends on a valid token relationship. The current scenario instead requires 'Check current Store availability and switch to a supported enterprise packaging source if licensed.' and verification that the replacement app package installs on pilot endpoints and no stale Store reference remains.

This action is appropriate for a different case: A warehouse owns Zebra rugged Android devices and wants scanner settings deployed without affecting ordinary employee phones. There, the targeted fix is 'Use supported Zebra/OEMConfig or specialty-device settings for targeted rugged-device groups.' because oEM features should be configured through compatible vendor management extensions. The current scenario instead requires 'Split assignments using trusted device attributes and supported filters or group membership.' and verification that the restriction appears only on warehouse devices in the test cohort.

This action is appropriate for a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. There, the targeted fix is 'Use Group Policy analytics to import and assess supported settings migration paths.' because analytics identifies candidate cloud-manageable settings before recreating GPOs. The current scenario instead requires 'Split assignments using trusted device attributes and supported filters or group membership.' and verification that the restriction appears only on warehouse devices in the test cohort.

This action is appropriate for a different case: A macOS Wi-Fi profile installs but certificate trust prompts interrupt seamless enterprise Wi-Fi authentication. There, the targeted fix is 'Configure the required trust and identity certificate payloads through supported management profiles.' because eAP configuration requires correct server trust and client identity material. The current scenario instead requires 'Split assignments using trusted device attributes and supported filters or group membership.' and verification that the restriction appears only on warehouse devices in the test cohort.

This action is appropriate for a different case: A custom compliance rule treats an unavailable service as compliant because its PowerShell check returns a default true value. There, the targeted fix is 'Implement a fail-safe discovery result and explicit error handling for missing data.' because unknown state should not automatically satisfy a security prerequisite. The current scenario instead requires 'Add dry-run mode, explicit change approval, logging and post-change verification.' and verification that every actual assignment update is attributable to an approved request and measured result.

This action is appropriate for a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. There, the targeted fix is 'Add preflight freshness checks and compare identifiers before applying bulk changes.' because inventory drift between read and write can alter the intended target list. The current scenario instead requires 'Add dry-run mode, explicit change approval, logging and post-change verification.' and verification that every actual assignment update is attributable to an approved request and measured result.

This action is appropriate for a different case: A Change Review Agent recommends approving a proposed Intune policy that would affect a high-risk executive device group. There, the targeted fix is 'Inspect the multi-admin approval request and agent impact findings before approving.' because approval accountability remains with authorized human administrators. The current scenario instead requires 'Add dry-run mode, explicit change approval, logging and post-change verification.' and verification that every actual assignment update is attributable to an approved request and measured result.

This observation would validate a different case: An admin needs to deploy Cloud PCs to a different network without changing production provisioning policies for every existing user. It would check 'The pilot Cloud PCs use the new approved network while existing users remain on their prior policy.' after 'Create a tested dedicated Windows 365 provisioning policy for the new group and network.'. It does not establish success for the stated scenario; the needed evidence is 'The next clean test device presents the organization-branded enrollment flow.'.

This observation would validate a different case: Windows laptops remain on an unsupported Windows 10 release while hardware meets the organization’s Windows 11 requirements. It would check 'A pilot fleet reports the intended Windows 11 version and user applications remain functional.' after 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.'. It does not establish success for the stated scenario; the needed evidence is 'The next clean test device presents the organization-branded enrollment flow.'.

This observation would validate a different case: A Windows 365 Cloud PC image contains an old line-of-business client and every new device inherits the obsolete version. It would check 'A new pilot Cloud PC starts with the approved application release.' after 'Update and validate the governed Cloud PC image or approved provisioning app deployment pipeline.'. It does not establish success for the stated scenario; the needed evidence is 'The next clean test device presents the organization-branded enrollment flow.'.

This observation would validate a different case: A support team uses Security Copilot to summarize device performance but mistakes an anomaly prediction for a completed repair. It would check 'After an approved fix, endpoint metrics improve and the recorded work item shows the change.' after 'Treat AI device performance analysis as a recommendation requiring verified action and measurable outcome.'. It does not establish success for the stated scenario; the needed evidence is 'Every actual assignment update is attributable to an approved request and measured result.'.

This observation would validate a different case: A custom compliance rule treats an unavailable service as compliant because its PowerShell check returns a default true value. It would check 'A simulated missing service yields the intended noncompliant result with diagnostic context.' after 'Implement a fail-safe discovery result and explicit error handling for missing data.'. It does not establish success for the stated scenario; the needed evidence is 'Every actual assignment update is attributable to an approved request and measured result.'.

This observation would validate a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. It would check 'The dry run rejects stale selections and records the updated approved device set.' after 'Add preflight freshness checks and compare identifiers before applying bulk changes.'. It does not establish success for the stated scenario; the needed evidence is 'Every actual assignment update is attributable to an approved request and measured result.'.