Exam Bundle

This observation would validate a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. It would check 'The device restarts normally with its protected drive after authorized recovery.' after 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.'. It does not establish success for the stated scenario; the needed evidence is 'The infected pilot loses unauthorized network access while forensic evidence is preserved.'.

This observation would validate a different case: An ASR rule blocks a business-approved legacy app, and the service desk suggests turning off all ASR protections. It would check 'The approved app runs while unrelated ASR detections remain enforced.' after 'Create a tightly scoped policy exception or compatible application update after security review.'. It does not establish success for the stated scenario; the needed evidence is 'The infected pilot loses unauthorized network access while forensic evidence is preserved.'.

This observation would validate a different case: A fleet must enforce BitLocker encryption and escrow recovery keys in Microsoft Entra ID for help desk recovery. It would check 'A newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.' after 'Create an Intune disk encryption policy with appropriate escrow and recovery settings.'. It does not establish success for the stated scenario; the needed evidence is 'The infected pilot loses unauthorized network access while forensic evidence is preserved.'.

This action is appropriate for a different case: A personal iPhone with Outlook does not enroll in Intune MDM but must require an app PIN before company mail opens. There, the targeted fix is 'Configure Intune app protection policy with the required application PIN and reset behavior.' because app protection can enforce data access controls without MDM enrollment. The current scenario instead requires 'Use managed app configuration for the supported work browser and targeted identity.' and verification that the work browser opens the approved home page while personal browsing remains untouched.

This action is appropriate for a different case: A user with a personal phone signs into a protected Outlook app, but Conditional Access requires Intune-compliant device status that BYOD phones cannot meet. There, the targeted fix is 'Require an approved app protection policy in Conditional Access where supported instead of full device compliance.' because app-protection grant controls can serve supported unmanaged devices. The current scenario instead requires 'Use managed app configuration for the supported work browser and targeted identity.' and verification that the work browser opens the approved home page while personal browsing remains untouched.

This action is appropriate for a different case: A company permits personal app copy/paste but corporate app users must only paste into other protected work apps. There, the targeted fix is 'Configure Intune app data transfer restrictions using an allowed managed-app boundary.' because selective restrictions can preserve personal usability while preventing leakage. The current scenario instead requires 'Use managed app configuration for the supported work browser and targeted identity.' and verification that the work browser opens the approved home page while personal browsing remains untouched.

This action is appropriate for a different case: A Windows update ring has conflicting deferral settings with a feature update policy and machines move to a release that was not approved. There, the targeted fix is 'Inspect effective update policies and correct overlapping feature controls.' because multiple policy types influence Windows Update behavior. The current scenario instead requires 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.' and verification that after managed restart the pilot reports the new build and update-compliant state.

This action is appropriate for a different case: An iPhone fleet needs supervised operating-system updates with deferred installation schedules and the administrator uses a Windows update ring. There, the targeted fix is 'Configure supported iOS/iPadOS update settings using Intune Settings Catalog or Apple update management controls.' because Apple software update mechanisms differ from Windows Update for Business. The current scenario instead requires 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.' and verification that after managed restart the pilot reports the new build and update-compliant state.

This action is appropriate for a different case: An administrator wants to expedite one critical Windows quality patch but leave routine rollout rings unchanged. There, the targeted fix is 'Use an eligible expedited quality update policy with targeted monitoring.' because emergency quality updates can be accelerated without replacing general ring strategy. The current scenario instead requires 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.' and verification that after managed restart the pilot reports the new build and update-compliant state.

This observation would validate a different case: A KQL device query is returning no rows because the administrator copied a Log Analytics table name not available in Intune device query. It would check 'A corrected query returns the expected records from a controlled device sample.' after 'Use the device query supported schema and validate KQL syntax against its data model.'. It does not establish success for the stated scenario; the needed evidence is 'A test action is performed only on the exact approved device identity.'.

This observation would validate a different case: An Intune device record shows 'retire pending' yet security operations claims corporate data has been removed from an offline phone. It would check 'A test report tracks pending and completed states separately with last contact time.' after 'Distinguish queued retirement from confirmed device-side completion.'. It does not establish success for the stated scenario; the needed evidence is 'A test action is performed only on the exact approved device identity.'.

This observation would validate a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. It would check 'The intended cohort restarts and unaffected device records show no remote action.' after 'Use supported Intune bulk remote action with carefully verified group/device selection.'. It does not establish success for the stated scenario; the needed evidence is 'A test action is performed only on the exact approved device identity.'.

This action is appropriate for a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. There, the targeted fix is 'Use managed-device app configuration targeting appropriate device groups.' because corporate managed device settings should not be broadcast to personal installations. The current scenario instead requires 'Create an Intune app protection policy restricting transfer of organizational data to unmanaged apps.' and verification that a protected document cannot be pasted into a personal chat app.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Create an Intune app protection policy restricting transfer of organizational data to unmanaged apps.' and verification that a protected document cannot be pasted into a personal chat app.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Create an Intune app protection policy restricting transfer of organizational data to unmanaged apps.' and verification that a protected document cannot be pasted into a personal chat app.

This action is appropriate for a different case: Two Intune device configuration policies assign incompatible firewall settings, and the admin mistakenly blames device noncompliance. There, the targeted fix is 'Inspect Intune policy conflict and setting-level status before rewriting the compliance rules.' because configuration conflicts are distinct from compliance assessment failures. The current scenario instead requires 'Review Conditional Access policy targeting and sign-in logs for the exact grant condition.' and verification that logs identify the intended policy and the compliant pilot user gains authorized access.

This action is appropriate for a different case: A compliance policy requires an OS version but most devices report noncompliant because the version constraint is misconfigured. There, the targeted fix is 'Review supported platform minimum OS versions and assignments within the Intune compliance policy.' because compliance evaluations depend on accurate policy thresholds and platform scope. The current scenario instead requires 'Review Conditional Access policy targeting and sign-in logs for the exact grant condition.' and verification that logs identify the intended policy and the compliant pilot user gains authorized access.

This action is appropriate for a different case: An administrator incorrectly believes scope tags prevent users from receiving a deployed app assignment. There, the targeted fix is 'Distinguish administrator visibility restrictions from user and device assignment targeting.' because scope tags govern delegated admin views, not end-user targeting by themselves. The current scenario instead requires 'Review Conditional Access policy targeting and sign-in logs for the exact grant condition.' and verification that logs identify the intended policy and the compliant pilot user gains authorized access.

This action is appropriate for a different case: An Android dedicated kiosk has no compliant way to authenticate a normal employee with a personal work identity during setup. There, the targeted fix is 'Use the supported enrollment token and dedicated-device configuration rather than a user-driven sign-in flow.' because dedicated Android devices commonly enroll without user affinity. The current scenario instead requires 'Deploy Android Enterprise corporate-owned devices with work profile (COPE) enrollment.' and verification that a test phone allows personal apps outside work profile and protects work data inside it.

This action is appropriate for a different case: A device enrolls but its compliance policy never arrives because it is placed in an unexpectedly excluded dynamic group. There, the targeted fix is 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.' because enrollment success does not imply every policy is targeted. The current scenario instead requires 'Deploy Android Enterprise corporate-owned devices with work profile (COPE) enrollment.' and verification that a test phone allows personal apps outside work profile and protects work data inside it.

This action is appropriate for a different case: Apple Business Manager tokens expired and newly purchased iPhones stop appearing in assigned Intune enrollment profiles. There, the targeted fix is 'Renew the Apple device enrollment program token and verify the server assignment and sync.' because enrollment profile delivery depends on a valid business-manager token trust. The current scenario instead requires 'Deploy Android Enterprise corporate-owned devices with work profile (COPE) enrollment.' and verification that a test phone allows personal apps outside work profile and protects work data inside it.

This action is appropriate for a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. There, the targeted fix is 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.' because hardware-backed key sign-in reduces reliance on exposed reusable passwords. The current scenario instead requires 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.' and verification that a device with no applicable compliance evaluation is denied when the policy requires it.

This action is appropriate for a different case: An Intune compliance policy for Android expects a Windows-only setting and shows unknown evaluations. There, the targeted fix is 'Assign platform-specific compliance settings only to supported operating systems.' because compliance criteria are not interchangeable across device platforms. The current scenario instead requires 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.' and verification that a device with no applicable compliance evaluation is denied when the policy requires it.

This action is appropriate for a different case: Two subsidiaries use one Intune tenant and regional operators must not see each other's device records. There, the targeted fix is 'Configure Intune scope tags and appropriate role scope group assignments.' because scoped administration can restrict what assigned administrators can see or change. The current scenario instead requires 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.' and verification that a device with no applicable compliance evaluation is denied when the policy requires it.

This action is appropriate for a different case: A company wants to deploy a Windows desktop accounting application packaged as an .exe with silent installation parameters. There, the targeted fix is 'Package it as a supported Intune Win32 app and configure the required install command.' because Win32 app packaging supports installation of traditional desktop software with monitoring. The current scenario instead requires 'Separate machine installation from appropriate user-specific license or configuration deployment.' and verification that the test user receives their licensed settings after the machine install.

This action is appropriate for a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. There, the targeted fix is 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.' because critical setup software must match the timing of group membership evaluation. The current scenario instead requires 'Separate machine installation from appropriate user-specific license or configuration deployment.' and verification that the test user receives their licensed settings after the machine install.

This action is appropriate for a different case: A Windows Win32 app detection rule checks only a registry key that remains after uninstall, causing false positives. There, the targeted fix is 'Use a reliable detection strategy reflecting actual installed application state.' because stale registry artifacts can mislead installation reporting. The current scenario instead requires 'Separate machine installation from appropriate user-specific license or configuration deployment.' and verification that the test user receives their licensed settings after the machine install.

This action is appropriate for a different case: An Autopilot enrollment failure exposes only a generic timeout and the administrator keeps wiping the laptop without collecting diagnostics. There, the targeted fix is 'Collect Autopilot deployment logs and Intune enrollment diagnostics before making another change.' because repeated resets without failure evidence can conceal enrollment and application problems. The current scenario instead requires 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.' and verification that the device does not complete gated setup until the designated security app succeeds.

This action is appropriate for a different case: A new laptop receives a random computer name but IT requires a predictable approved asset prefix during deployment. There, the targeted fix is 'Configure supported Windows Autopilot device-name template behavior on the applicable deployment profile.' because naming templates can apply standardized identifiers under supported Autopilot modes. The current scenario instead requires 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.' and verification that the device does not complete gated setup until the designated security app succeeds.

This action is appropriate for a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. There, the targeted fix is 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.' because device preparation deliberately limits setup app/script complexity for reliability. The current scenario instead requires 'Configure the ESP and required app blocking criteria appropriate for supported enrollment.' and verification that the device does not complete gated setup until the designated security app succeeds.

This action is appropriate for a different case: Windows Firewall is disabled locally by a privileged user each time the computer boots despite managed policy. There, the targeted fix is 'Investigate effective endpoint security policy and tamper-protection or configuration drift.' because a recurring local override may signal policy conflict or unauthorized changes. The current scenario instead requires 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.' and verification that the kiosk and laptop each receive their intended controls without cross-assignment.

This action is appropriate for a different case: A company's endpoints are enrolled in Intune but Defender XDR shows duplicate security device entries after rebuilding laptops. There, the targeted fix is 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.' because the same physical endpoint can have multiple lifecycle records across systems. The current scenario instead requires 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.' and verification that the kiosk and laptop each receive their intended controls without cross-assignment.

This action is appropriate for a different case: A user requests a local antivirus exception for a downloaded installer without validating its publisher or hash. There, the targeted fix is 'Verify software provenance and route any exclusion request through approved security policy.' because untrusted application exceptions can create a new malware execution path. The current scenario instead requires 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.' and verification that the kiosk and laptop each receive their intended controls without cross-assignment.