Exam Bundle

This action is appropriate for a different case: A custom compliance rule treats an unavailable service as compliant because its PowerShell check returns a default true value. There, the targeted fix is 'Implement a fail-safe discovery result and explicit error handling for missing data.' because unknown state should not automatically satisfy a security prerequisite. The current scenario instead requires 'Implement Graph pagination using the returned next-link sequence.' and verification that the script counts all expected inventory devices across multiple pages.

This action is appropriate for a different case: An organization wants a custom device compliance check for a specialized local service that Intune's standard compliance profile cannot directly assess. There, the targeted fix is 'Implement supported custom compliance discovery scripts and JSON rule evaluation on eligible platforms.' because custom compliance can evaluate additional signals with prescribed result formats. The current scenario instead requires 'Implement Graph pagination using the returned next-link sequence.' and verification that the script counts all expected inventory devices across multiple pages.

This action is appropriate for a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. There, the targeted fix is 'Return the supported JSON schema without extra stdout content and validate the rules file.' because machine-readable output format is part of the custom compliance contract. The current scenario instead requires 'Implement Graph pagination using the returned next-link sequence.' and verification that the script counts all expected inventory devices across multiple pages.

This observation would validate a different case: An enterprise needs to remove a vulnerable app version before assigning a patched replacement, avoiding two conflicting versions. It would check 'The test endpoint has only the approved current app version.' after 'Coordinate app supersedence or uninstall and replacement assignments with detection tests.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot user chooses whether to install the optional app from the approved portal.'.

This observation would validate a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. It would check 'The app installs before the employee is allowed to start regulated work.' after 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot user chooses whether to install the optional app from the approved portal.'.

This observation would validate a different case: A business application requires an older runtime library that is missing on new Windows endpoints. It would check 'A clean pilot installs the runtime before the business app starts.' after 'Configure the prerequisite runtime as an Intune Win32 app dependency.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot user chooses whether to install the optional app from the approved portal.'.

This observation would validate a different case: A compliance check requires BitLocker but a freshly enrolled Windows device has not finished encryption. It would check 'The pilot becomes compliant after encryption, and an unencrypted device past grace is blocked.' after 'Configure appropriate grace period and evaluate encryption deployment state before enforcing device access.'. It does not establish success for the stated scenario; the needed evidence is 'A device with no applicable compliance evaluation is denied when the policy requires it.'.

This observation would validate a different case: An administrator incorrectly believes scope tags prevent users from receiving a deployed app assignment. It would check 'A tagged device receives its correctly assigned application despite regional admin visibility limits.' after 'Distinguish administrator visibility restrictions from user and device assignment targeting.'. It does not establish success for the stated scenario; the needed evidence is 'A device with no applicable compliance evaluation is denied when the policy requires it.'.

This observation would validate a different case: A company uses corporate Windows endpoints but wants passwordless sign-in based on the user's biometric gesture, not network location. It would check 'User sign-in meets the intended authentication requirement without a shared password.' after 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'A device with no applicable compliance evaluation is denied when the policy requires it.'.

This action is appropriate for a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. There, the targeted fix is 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.' because endpoint data protection and cloud device trust require separate response actions. The current scenario instead requires 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.' and verification that the device remains protected until an explicitly approved decryption task completes.

This action is appropriate for a different case: A device receives two security baseline profiles that set conflicting Windows Defender options. There, the targeted fix is 'Compare baseline versions and overlapping settings, then consolidate authoritative policy assignments.' because security baselines are configurable templates that can conflict with other policies. The current scenario instead requires 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.' and verification that the device remains protected until an explicitly approved decryption task completes.

This action is appropriate for a different case: A corporate application fails because a security admin created an outbound firewall rule that blocks its authorized API endpoint. There, the targeted fix is 'Use a scoped firewall policy correction permitting only the required endpoint and protocol.' because least privilege balances necessary application connectivity with traffic restrictions. The current scenario instead requires 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.' and verification that the device remains protected until an explicitly approved decryption task completes.

This action is appropriate for a different case: A security tool must be automatically installed on every company laptop and should not be treated as user-optional. There, the targeted fix is 'Assign the application as Required to the verified corporate device group.' because mandatory controls need device-wide automatic assignment. The current scenario instead requires 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.' and verification that the app installs before the employee is allowed to start regulated work.

This action is appropriate for a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. There, the targeted fix is 'Separate machine installation from appropriate user-specific license or configuration deployment.' because install context and app entitlement can be independently scoped. The current scenario instead requires 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.' and verification that the app installs before the employee is allowed to start regulated work.

This action is appropriate for a different case: A mobile app installed on an iPad is removed by users despite being required for device compliance tasks. There, the targeted fix is 'Use appropriate required app assignment and supervised device restrictions where supported.' because critical corporate apps require supported installation and device-control policies. The current scenario instead requires 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.' and verification that the app installs before the employee is allowed to start regulated work.

This observation would validate a different case: An organization wants to pin devices to a specific Windows 11 release while allowing security quality updates. It would check 'Pilot devices remain on the chosen feature release while receiving normal security updates.' after 'Create an Intune Windows feature update policy targeting the required supported version.'. It does not establish success for the stated scenario; the needed evidence is 'The licensed test user receives a Cloud PC while unlicensed requests remain blocked.'.

This observation would validate a different case: A Windows Backup restore is offered during new Windows device setup but organizational policy forbids unmanaged personal restore sources. It would check 'A pilot restores permitted settings while blocked personal restore content is not introduced.' after 'Configure Windows Backup and restore policy with approved organizational device settings.'. It does not establish success for the stated scenario; the needed evidence is 'The licensed test user receives a Cloud PC while unlicensed requests remain blocked.'.

This observation would validate a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. It would check 'The approved eligible devices upgrade and blocked hardware shows a documented reason.' after 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.'. It does not establish success for the stated scenario; the needed evidence is 'The licensed test user receives a Cloud PC while unlicensed requests remain blocked.'.

This observation would validate a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. It would check 'The protected app signs in with its applied policy while an unsupported client is denied.' after 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.'. It does not establish success for the stated scenario; the needed evidence is 'Two pilot PCs have different protected LAPS secrets and scheduled rotation is recorded.'.

This observation would validate a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. It would check 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.' after 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.'. It does not establish success for the stated scenario; the needed evidence is 'Two pilot PCs have different protected LAPS secrets and scheduled rotation is recorded.'.

This observation would validate a different case: A PIN policy is applied but Windows Hello for Business enrollment fails on devices without a functional TPM. It would check 'An eligible pilot device provisions its Hello key and an ineligible device gets an actionable diagnostic.' after 'Diagnose supported hardware and Windows Hello provisioning requirements instead of weakening policy globally.'. It does not establish success for the stated scenario; the needed evidence is 'Two pilot PCs have different protected LAPS secrets and scheduled rotation is recorded.'.

This action is appropriate for a different case: A company's endpoints are enrolled in Intune but Defender XDR shows duplicate security device entries after rebuilding laptops. There, the targeted fix is 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.' because the same physical endpoint can have multiple lifecycle records across systems. The current scenario instead requires 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.' and verification that the pilot encrypts successfully and a test recovery operation uses an approved escrowed key.

This action is appropriate for a different case: A company combines Intune antivirus settings and security baseline policies with incompatible scan schedules. There, the targeted fix is 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.' because duplicate management intent can create inconsistent endpoint protection. The current scenario instead requires 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.' and verification that the pilot encrypts successfully and a test recovery operation uses an approved escrowed key.

This action is appropriate for a different case: An organization wants standardized endpoint detection and response policies rather than installing separate scripts on every workstation. There, the targeted fix is 'Deploy Intune EDR endpoint security policies with supported Defender integration.' because central EDR configuration reduces onboarding and policy drift. The current scenario instead requires 'Configure managed encryption and recovery key backup with supported ownership and user privilege settings.' and verification that the pilot encrypts successfully and a test recovery operation uses an approved escrowed key.

This observation would validate a different case: A PowerShell cleanup script mistakenly removes device records because it matches display name instead of a stable managed device identifier. It would check 'A dry run reports exact intended IDs and no unrelated records are removed.' after 'Resolve and validate unique Intune managedDevice IDs before mutation calls.'. It does not establish success for the stated scenario; the needed evidence is 'The staged policy matches the security requirement and produces no unreviewed conflicts.'.

This observation would validate a different case: A Change Review Agent recommends approving a proposed Intune policy that would affect a high-risk executive device group. It would check 'The reviewer sees the target change and records an explicit decision, not automatic deployment.' after 'Inspect the multi-admin approval request and agent impact findings before approving.'. It does not establish success for the stated scenario; the needed evidence is 'The staged policy matches the security requirement and produces no unreviewed conflicts.'.

This observation would validate a different case: A security operations script stores an Intune app secret in a shared plain text PowerShell file. It would check 'The repository contains no reusable secret and the task authenticates through approved credentials.' after 'Use supported secure credential or certificate-based authentication and restricted identity permissions.'. It does not establish success for the stated scenario; the needed evidence is 'The staged policy matches the security requirement and produces no unreviewed conflicts.'.

This observation would validate a different case: A technician decides to allow all unknown executables to elevate because many help desk elevation requests are pending. It would check 'The pilot's approved software elevates while unknown programs still require review.' after 'Review EPM elevation requests and create narrow approved rules rather than blanket authorization.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot exhibits improved metrics before rollout to later cohorts is approved.'.

This observation would validate a different case: An analytics dashboard shows severe startup time regression on a model whose drivers changed last week. It would check 'A version-stratified comparison isolates the impacted model and verifies improvement after remediation.' after 'Correlate Advanced Analytics/Endpoint Analytics data with driver versions and recent deployment changes.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot exhibits improved metrics before rollout to later cohorts is approved.'.

This observation would validate a different case: An enterprise needs to deploy a commonly used third-party Windows app and does not want to maintain every vendor installer version manually. It would check 'A pilot app installs from the catalog and updates to an approved newer release.' after 'Evaluate Intune Enterprise App Catalog for the supported app and managed updates.'. It does not establish success for the stated scenario; the needed evidence is 'The pilot exhibits improved metrics before rollout to later cohorts is approved.'.

This action is appropriate for a different case: A custom compliance PowerShell script prints debugging prose before JSON output and Intune cannot parse the device evaluation. There, the targeted fix is 'Return the supported JSON schema without extra stdout content and validate the rules file.' because machine-readable output format is part of the custom compliance contract. The current scenario instead requires 'Distinguish transport errors from valid empty results and retry within a bounded policy.' and verification that a transient simulated failure is reported or recovered without returning false zero devices.

This action is appropriate for a different case: An administrator wants to extend device compliance using PowerShell but the custom script is assigned to unsupported macOS targets. There, the targeted fix is 'Scope custom compliance discovery to supported device platforms and policy prerequisites.' because a valid script on Windows need not be a valid macOS compliance mechanism. The current scenario instead requires 'Distinguish transport errors from valid empty results and retry within a bounded policy.' and verification that a transient simulated failure is reported or recovered without returning false zero devices.

This action is appropriate for a different case: A Policy Configuration Agent proposes settings from a natural-language security standard without identifying policy conflicts. There, the targeted fix is 'Review proposed settings and existing Intune assignments before creating the new configuration.' because generated policy recommendations should be assessed for platform support and conflict. The current scenario instead requires 'Distinguish transport errors from valid empty results and retry within a bounded policy.' and verification that a transient simulated failure is reported or recovered without returning false zero devices.