Exam Bundle

This observation would validate a different case: A support team uses Security Copilot to summarize device performance but mistakes an anomaly prediction for a completed repair. It would check 'After an approved fix, endpoint metrics improve and the recorded work item shows the change.' after 'Treat AI device performance analysis as a recommendation requiring verified action and measurable outcome.'. It does not establish success for the stated scenario; the needed evidence is 'Every actual assignment update is attributable to an approved request and measured result.'.

This observation would validate a different case: A custom compliance rule treats an unavailable service as compliant because its PowerShell check returns a default true value. It would check 'A simulated missing service yields the intended noncompliant result with diagnostic context.' after 'Implement a fail-safe discovery result and explicit error handling for missing data.'. It does not establish success for the stated scenario; the needed evidence is 'Every actual assignment update is attributable to an approved request and measured result.'.

This observation would validate a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. It would check 'The dry run rejects stale selections and records the updated approved device set.' after 'Add preflight freshness checks and compare identifiers before applying bulk changes.'. It does not establish success for the stated scenario; the needed evidence is 'Every actual assignment update is attributable to an approved request and measured result.'.

This observation would validate a different case: A Windows endpoint has encryption enabled but compliance reports failure because its recovery key has not been backed up. It would check 'After escrow repair the device reports both encryption and recovery readiness.' after 'Check BitLocker escrow and policy reporting rather than disabling the compliance requirement.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot endpoint reports active protection and the intended antivirus policy state.'.

This observation would validate a different case: A new ASR policy is planned for 40,000 devices but the operations team has not assessed false positives. It would check 'The report identifies impacted applications and the pilot block phase denies only unwanted behavior.' after 'Start with ASR audit mode and evaluate telemetry before changing selected rules to block.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot endpoint reports active protection and the intended antivirus policy state.'.

This observation would validate a different case: An organization wants automatic BitLocker device encryption during provisioning but users become local administrators without escrow verification. It would check 'The pilot encrypts successfully and a test recovery operation uses an approved escrowed key.' after 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot endpoint reports active protection and the intended antivirus policy state.'.

This observation would validate a different case: An administrator confuses Microsoft 365 Apps update channels with Windows OS feature update rings. It would check 'The Office client follows its app channel while the OS stays on its target version.' after 'Manage Microsoft 365 Apps channels separately from Windows device OS update policies.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot's reported version converges with its verified local build after sync.'.

This observation would validate a different case: An admin configures Delivery Optimization peers across the public internet when policy permits only same-subnet sharing. It would check 'The test client downloads content from allowed local peers and not prohibited external peers.' after 'Limit delivery group/peer scope to the approved network boundary.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot's reported version converges with its verified local build after sync.'.

This observation would validate a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. It would check 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.' after 'Check supervision and platform prerequisites before configuring Apple update enforcement.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot's reported version converges with its verified local build after sync.'.

This observation would validate a different case: An engineer schedules a remote wipe against a record identified only by a reused device display name. It would check 'A test action is performed only on the exact approved device identity.' after 'Require verified Intune managed device ID, serial and ownership before destructive actions.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot rotates successfully and the new recovery key is confirmed escrowed.'.

This observation would validate a different case: An Intune device record shows 'retire pending' yet security operations claims corporate data has been removed from an offline phone. It would check 'A test report tracks pending and completed states separately with last contact time.' after 'Distinguish queued retirement from confirmed device-side completion.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot rotates successfully and the new recovery key is confirmed escrowed.'.

This observation would validate a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. It would check 'The device is reset/marked appropriately and its management lifecycle is recorded.' after 'Use an authorized Wipe action on the verified device record with incident tracking.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot rotates successfully and the new recovery key is confirmed escrowed.'.

This observation would validate a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. It would check 'Cloud requests fail for the missing device and management records capture the requested data removal.' after 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.'. It does not establish success for the stated scenario; the needed evidence is 'Only the active security record is used for triage after stale-record verification.'.

This observation would validate a different case: A service desk user can retrieve BitLocker recovery keys for every subsidiary despite being responsible for one region. It would check 'A regional help desk user retrieves only permitted keys with audit records.' after 'Limit recovery key access and Intune/Entra role scope to authorized device populations.'. It does not establish success for the stated scenario; the needed evidence is 'Only the active security record is used for triage after stale-record verification.'.

This observation would validate a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. It would check 'The device restarts normally with its protected drive after authorized recovery.' after 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.'. It does not establish success for the stated scenario; the needed evidence is 'Only the active security record is used for triage after stale-record verification.'.

This action is appropriate for a different case: A custom compliance rule treats an unavailable service as compliant because its PowerShell check returns a default true value. There, the targeted fix is 'Implement a fail-safe discovery result and explicit error handling for missing data.' because unknown state should not automatically satisfy a security prerequisite. The current scenario instead requires 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.' and verification that a test workload recovers after throttling within the approved retry budget.

This action is appropriate for a different case: An organization wants a custom device compliance check for a specialized local service that Intune's standard compliance profile cannot directly assess. There, the targeted fix is 'Implement supported custom compliance discovery scripts and JSON rule evaluation on eligible platforms.' because custom compliance can evaluate additional signals with prescribed result formats. The current scenario instead requires 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.' and verification that a test workload recovers after throttling within the approved retry budget.

This action is appropriate for a different case: A security operations script stores an Intune app secret in a shared plain text PowerShell file. There, the targeted fix is 'Use supported secure credential or certificate-based authentication and restricted identity permissions.' because automation credentials require separate lifecycle protection from script source. The current scenario instead requires 'Implement bounded retry with Retry-After behavior and exponential backoff where appropriate.' and verification that a test workload recovers after throttling within the approved retry budget.

This action is appropriate for a different case: Advanced Analytics recommends a configuration change that could affect every endpoint, but the operations team plans immediate mass deployment. There, the targeted fix is 'Validate the recommendation on a staged group before broad policy assignment.' because an insight is decision support, not authorization for uncontrolled changes. The current scenario instead requires 'Verify add-on entitlement and feature availability before creating a critical dependency.' and verification that the pilot environment can open and use the licensed feature while an unlicensed environment reports its limitation.

This action is appropriate for a different case: An endpoint team wants proactive insight into hardware performance regressions across a large fleet, beyond basic inventory. There, the targeted fix is 'Enable eligible Intune Advanced Analytics capabilities and review supported anomaly or risk insights.' because advanced analytics can surface patterns for deeper investigation and remediation decisions. The current scenario instead requires 'Verify add-on entitlement and feature availability before creating a critical dependency.' and verification that the pilot environment can open and use the licensed feature while an unlicensed environment reports its limitation.

This action is appropriate for a different case: A corporate Wi-Fi system rejects Cloud PKI client certificates because the RADIUS server does not trust the new intermediate CA. There, the targeted fix is 'Publish and validate the appropriate CA trust chain before onboarding clients.' because certificate issuance alone does not create relying-party trust. The current scenario instead requires 'Verify add-on entitlement and feature availability before creating a critical dependency.' and verification that the pilot environment can open and use the licensed feature while an unlicensed environment reports its limitation.

This action is appropriate for a different case: A user reports that their BitLocker recovery password might have been copied into a public ticket. There, the targeted fix is 'Initiate an authorized BitLocker recovery-key rotation and verify the new protected escrow entry.' because a leaked recovery secret must be invalidated while maintaining recoverability. The current scenario instead requires 'Invoke the supported local administrator password rotation remote action.' and verification that the directory records a new LAPS password and prior credentials fail.

This action is appropriate for a different case: An admin needs a live inventory query across managed Windows endpoints to find a vulnerable application version. There, the targeted fix is 'Use the supported Intune device query with valid KQL and an appropriate scope.' because Intune device query can answer targeted state questions without collecting all device images. The current scenario instead requires 'Invoke the supported local administrator password rotation remote action.' and verification that the directory records a new LAPS password and prior credentials fail.

This action is appropriate for a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. There, the targeted fix is 'Use an authorized Wipe action on the verified device record with incident tracking.' because a full wipe is appropriate for a lost corporate endpoint when approved. The current scenario instead requires 'Invoke the supported local administrator password rotation remote action.' and verification that the directory records a new LAPS password and prior credentials fail.

This observation would validate a different case: An enterprise uses Mobile Application Management on unenrolled phones and needs protected access to private web apps. It would check 'A protected app accesses its allowed internal endpoint while other personal apps cannot use the tunnel.' after 'Evaluate Microsoft Tunnel for MAM with the required gateway, app policy and tenant prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'The dashboard reports an explainable endpoint performance anomaly for a known test cohort.'.

This observation would validate a different case: A security team needs to audit which EPM-elevated executables employees actually run across a pilot fleet. It would check 'An elevated test process creates an attributable report with application identity.' after 'Use EPM reporting and elevated-action monitoring with controlled access to telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'The dashboard reports an explainable endpoint performance anomaly for a known test cohort.'.

This observation would validate a different case: A Microsoft Tunnel gateway is online but unenrolled Android users cannot start application-specific connections. It would check 'The test protected application establishes an authorized tunnel and its status reports healthy.' after 'Check Tunnel for MAM application configuration, gateway status and supported client integration.'. It does not establish success for the stated scenario; the needed evidence is 'The dashboard reports an explainable endpoint performance anomaly for a known test cohort.'.

This observation would validate a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. It would check 'Cloud requests fail for the missing device and management records capture the requested data removal.' after 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.'. It does not establish success for the stated scenario; the needed evidence is 'After escrow repair the device reports both encryption and recovery readiness.'.

This observation would validate a different case: A security team wants all managed Windows PCs to use up-to-date real-time malware protection without editing antivirus settings manually on each endpoint. It would check 'A pilot endpoint reports active protection and the intended antivirus policy state.' after 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.'. It does not establish success for the stated scenario; the needed evidence is 'After escrow repair the device reports both encryption and recovery readiness.'.

This observation would validate a different case: A company combines Intune antivirus settings and security baseline policies with incompatible scan schedules. It would check 'Security reports show one applied scan schedule and no unresolved conflicts.' after 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.'. It does not establish success for the stated scenario; the needed evidence is 'After escrow repair the device reports both encryption and recovery readiness.'.

This action is appropriate for a different case: A custom compliance rule treats an unavailable service as compliant because its PowerShell check returns a default true value. There, the targeted fix is 'Implement a fail-safe discovery result and explicit error handling for missing data.' because unknown state should not automatically satisfy a security prerequisite. The current scenario instead requires 'Implement Graph pagination using the returned next-link sequence.' and verification that the script counts all expected inventory devices across multiple pages.

This action is appropriate for a different case: An organization wants a custom device compliance check for a specialized local service that Intune's standard compliance profile cannot directly assess. There, the targeted fix is 'Implement supported custom compliance discovery scripts and JSON rule evaluation on eligible platforms.' because custom compliance can evaluate additional signals with prescribed result formats. The current scenario instead requires 'Implement Graph pagination using the returned next-link sequence.' and verification that the script counts all expected inventory devices across multiple pages.

This action is appropriate for a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. There, the targeted fix is 'Return the supported JSON schema without extra stdout content and validate the rules file.' because machine-readable output format is part of the custom compliance contract. The current scenario instead requires 'Implement Graph pagination using the returned next-link sequence.' and verification that the script counts all expected inventory devices across multiple pages.