Exam Bundle

This observation would validate a different case: An app catalog entry becomes available to the wrong security group and contractors download a licensed finance tool. It would check 'The finance test user can install the tool and contractor accounts cannot see it.' after 'Correct required/available assignment and group exclusions to enforce app entitlement.'. It does not establish success for the stated scenario; the needed evidence is 'A missing application fails detection and a correctly installed test app reports installed.'.

This observation would validate a different case: A mobile app installed on an iPad is removed by users despite being required for device compliance tasks. It would check 'The supervised test iPad retains the required app after sync and the policy reports success.' after 'Use appropriate required app assignment and supervised device restrictions where supported.'. It does not establish success for the stated scenario; the needed evidence is 'A missing application fails detection and a correctly installed test app reports installed.'.

This observation would validate a different case: An Intune app deployment succeeds in the device report, but the user cannot launch it because a required license assignment is missing. It would check 'A licensed pilot user launches the app and an unlicensed test gets a controlled denial.' after 'Verify application licensing and assigned user entitlement after confirming installation.'. It does not establish success for the stated scenario; the needed evidence is 'A missing application fails detection and a correctly installed test app reports installed.'.

This observation would validate a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. It would check 'The device remains protected until an explicitly approved decryption task completes.' after 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.'. It does not establish success for the stated scenario; the needed evidence is 'Reports show baseline compliance and separately track detected vulnerabilities.'.

This observation would validate a different case: A company combines Intune antivirus settings and security baseline policies with incompatible scan schedules. It would check 'Security reports show one applied scan schedule and no unresolved conflicts.' after 'Review assignment conflicts and configure one authoritative antivirus policy for the impacted setting.'. It does not establish success for the stated scenario; the needed evidence is 'Reports show baseline compliance and separately track detected vulnerabilities.'.

This observation would validate a different case: An ASR rule blocks a business-approved legacy app, and the service desk suggests turning off all ASR protections. It would check 'The approved app runs while unrelated ASR detections remain enforced.' after 'Create a tightly scoped policy exception or compatible application update after security review.'. It does not establish success for the stated scenario; the needed evidence is 'Reports show baseline compliance and separately track detected vulnerabilities.'.

This observation would validate a different case: A Windows configuration profile shows 'conflict' for password length because two profiles target the same device with different values. It would check 'The pilot reports one intended applied password policy and no setting conflict.' after 'Inspect per-setting status and revise overlapping profile assignments or definitions.'. It does not establish success for the stated scenario; the needed evidence is 'The enrolled corporate iPad connects automatically and no credential is displayed in instructions.'.

This observation would validate a different case: A HoloLens 2 headset is used for guided industrial work and must have management settings applied without modifying desktops. It would check 'An enrolled headset receives only its intended kiosk and enterprise configuration.' after 'Assign supported HoloLens device configuration policies to its dedicated managed group.'. It does not establish success for the stated scenario; the needed evidence is 'The enrolled corporate iPad connects automatically and no credential is displayed in instructions.'.

This observation would validate a different case: An administrator needs to deploy browser restrictions to Windows devices but wants to avoid conflict with an existing security baseline. It would check 'The test endpoint reports one effective value and no unresolved configuration conflict.' after 'Compare overlapping settings and select one authoritative assignment for each control.'. It does not establish success for the stated scenario; the needed evidence is 'The enrolled corporate iPad connects automatically and no credential is displayed in instructions.'.

This observation would validate a different case: A business wants to deploy an emergency Windows fix only to a device class that runs the affected application. It would check 'The vulnerable cohort receives the fix and unaffected endpoints remain on routine schedules.' after 'Assign the appropriate expedited quality policy to a verified at-risk group.'. It does not establish success for the stated scenario; the needed evidence is 'The noneligible pilot receives the current LCU and its restart need is communicated.'.

This observation would validate a different case: A Windows client has a pending update and the restart schedule interrupts clinical workstations during business hours. It would check 'Pilot workstations install updates and restart within the specified maintenance policy.' after 'Adjust appropriate Windows update ring active hours and restart deadline controls.'. It does not establish success for the stated scenario; the needed evidence is 'The noneligible pilot receives the current LCU and its restart need is communicated.'.

This observation would validate a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. It would check 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.' after 'Check supervision and platform prerequisites before configuring Apple update enforcement.'. It does not establish success for the stated scenario; the needed evidence is 'The noneligible pilot receives the current LCU and its restart need is communicated.'.

This action is appropriate for a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. There, the targeted fix is 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.' because some Apple configuration controls depend on supervision and ownership. The current scenario instead requires 'Create and assign the platform-specific macOS FileVault and recovery-key configuration.' and verification that the Mac reports encryption status and the approved escrowed recovery information.

This action is appropriate for a different case: An organization needs a new ADMX-backed policy in Intune that is not yet included in its ordinary settings catalog. There, the targeted fix is 'Import the supported ADMX definition and publish the associated configuration settings.' because custom administrative templates require validated schema support and deployment targeting. The current scenario instead requires 'Create and assign the platform-specific macOS FileVault and recovery-key configuration.' and verification that the Mac reports encryption status and the approved escrowed recovery information.

This action is appropriate for a different case: A HoloLens 2 headset is used for guided industrial work and must have management settings applied without modifying desktops. There, the targeted fix is 'Assign supported HoloLens device configuration policies to its dedicated managed group.' because mixed-reality endpoints have platform-specific management settings. The current scenario instead requires 'Create and assign the platform-specific macOS FileVault and recovery-key configuration.' and verification that the Mac reports encryption status and the approved escrowed recovery information.

This observation would validate a different case: A remote user encounters incorrect tenant branding during first Windows sign-in despite the company owning the laptop. It would check 'The hardware shows the intended tenant identity and assigned profile at setup.' after 'Validate the Autopilot hardware registration tenant and assigned deployment profile.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot fleet reports the intended Windows 11 version and user applications remain functional.'.

This observation would validate a different case: An admin needs to deploy Cloud PCs to a different network without changing production provisioning policies for every existing user. It would check 'The pilot Cloud PCs use the new approved network while existing users remain on their prior policy.' after 'Create a tested dedicated Windows 365 provisioning policy for the new group and network.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot fleet reports the intended Windows 11 version and user applications remain functional.'.

This observation would validate a different case: An employee's Windows 365 Cloud PC is deleted accidentally and the team has no documented recovery plan. It would check 'A controlled restore retrieves the intended Cloud PC state without affecting another tenant.' after 'Use the supported Cloud PC restore or recovery capability within retention limits and document lifecycle safeguards.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot fleet reports the intended Windows 11 version and user applications remain functional.'.

This action is appropriate for a different case: A macOS Wi-Fi profile installs but certificate trust prompts interrupt seamless enterprise Wi-Fi authentication. There, the targeted fix is 'Configure the required trust and identity certificate payloads through supported management profiles.' because eAP configuration requires correct server trust and client identity material. The current scenario instead requires 'Import the supported ADMX definition and publish the associated configuration settings.' and verification that the policy applies to supported Windows pilot devices and reports an effective value.

This action is appropriate for a different case: A company wants one kiosk policy for Teams Rooms and Android scanners and finds platform targeting failures. There, the targeted fix is 'Create separate specialty-device configuration profiles aligned to each platform.' because specialized endpoint capabilities cannot be assumed interchangeable. The current scenario instead requires 'Import the supported ADMX definition and publish the associated configuration settings.' and verification that the policy applies to supported Windows pilot devices and reports an effective value.

This action is appropriate for a different case: A Mac needs FileVault configuration but the admin targets a Windows BitLocker settings catalog profile. There, the targeted fix is 'Create and assign the platform-specific macOS FileVault and recovery-key configuration.' because encryption controls differ by operating system and management channel. The current scenario instead requires 'Import the supported ADMX definition and publish the associated configuration settings.' and verification that the policy applies to supported Windows pilot devices and reports an effective value.

This observation would validate a different case: A network team needs to deploy Microsoft 365 Apps during Autopilot without downloading every language package during setup. It would check 'The pilot receives only the selected applications and languages.' after 'Use a tailored Office Deployment Tool configuration or Intune suite profile for required components.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk receives the app while a test BYOD work profile does not.'.

This observation would validate a different case: A company uses one Microsoft 365 Apps policy for every user but call-center users require a smaller set of Office applications. It would check 'Call-center pilots receive the approved subset and analysts receive their full suite.' after 'Create role-scoped Microsoft 365 Apps deployment packages or configurations.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk receives the app while a test BYOD work profile does not.'.

This observation would validate a different case: A packaged enterprise app supports both 32-bit and 64-bit installations, but the wrong architecture is installed on ARM-based devices. It would check 'Each test device receives a compatible binary and unsupported versions are excluded.' after 'Define valid architecture applicability or separate packages according to supported platform.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk receives the app while a test BYOD work profile does not.'.

This action is appropriate for a different case: The security team notices Windows 365 Cloud PCs receive updates far later than physical laptops. There, the targeted fix is 'Check Cloud PC update policy assignment and Windows Autopatch/Intune targeting.' because Cloud PCs are managed endpoints whose update policy must be explicitly effective. The current scenario instead requires 'Use per-model diagnostics and staged targeting to isolate the compatibility defect.' and verification that the affected model is paused for remediation while other cohorts continue patching.

This action is appropriate for a different case: A company wants Windows 11 monthly security updates delivered in predictable pilot and broad rings with different restart windows. There, the targeted fix is 'Configure Intune Windows update rings with staged assignments and appropriate deadlines.' because update rings manage cadence and user experience for eligible quality updates. The current scenario instead requires 'Use per-model diagnostics and staged targeting to isolate the compatibility defect.' and verification that the affected model is paused for remediation while other cohorts continue patching.

This action is appropriate for a different case: A subset of Windows devices is ineligible for hotpatch and fails the expected no-restart maintenance target. There, the targeted fix is 'Use the standard cumulative update fallback and investigate eligibility rather than withholding security fixes.' because ineligible devices should still receive supported security quality updates. The current scenario instead requires 'Use per-model diagnostics and staged targeting to isolate the compatibility defect.' and verification that the affected model is paused for remediation while other cohorts continue patching.

This action is appropriate for a different case: An employee with a personal Android phone needs protected Teams access without granting IT full device wipe privileges. There, the targeted fix is 'Use Android work-profile or app-protection management appropriate for personally owned devices.' because a personal device requires a narrower management boundary than fully managed corporate enrollment. The current scenario instead requires 'Integrate Apple Business Manager with Intune and apply automated device enrollment and supervision.' and verification that a reset corporate iPad automatically returns to managed setup with the expected restrictions.

This action is appropriate for a different case: An Android dedicated kiosk has no compliant way to authenticate a normal employee with a personal work identity during setup. There, the targeted fix is 'Use the supported enrollment token and dedicated-device configuration rather than a user-driven sign-in flow.' because dedicated Android devices commonly enroll without user affinity. The current scenario instead requires 'Integrate Apple Business Manager with Intune and apply automated device enrollment and supervision.' and verification that a reset corporate iPad automatically returns to managed setup with the expected restrictions.

This action is appropriate for a different case: Apple enrollment receives error messages after Intune certificate renewal because the technician created a new push certificate instead of renewing the existing one. There, the targeted fix is 'Restore or remediate the Apple MDM certificate identity using Microsoft's supported migration guidance.' because a mismatched push identity can require device re-enrollment and is not a harmless rename. The current scenario instead requires 'Integrate Apple Business Manager with Intune and apply automated device enrollment and supervision.' and verification that a reset corporate iPad automatically returns to managed setup with the expected restrictions.

This action is appropriate for a different case: A service desk user can retrieve BitLocker recovery keys for every subsidiary despite being responsible for one region. There, the targeted fix is 'Limit recovery key access and Intune/Entra role scope to authorized device populations.' because recovery secrets are highly sensitive and require least privilege. The current scenario instead requires 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.' and verification that a pilot endpoint reports active protection and the intended antivirus policy state.

This action is appropriate for a different case: A device firewall rule appears correctly assigned but does not take effect on machines using the public network profile. There, the targeted fix is 'Inspect the profile-specific rule settings and effective network category on the endpoint.' because a firewall rule can depend on the active domain/private/public context. The current scenario instead requires 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.' and verification that a pilot endpoint reports active protection and the intended antivirus policy state.

This action is appropriate for a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. There, the targeted fix is 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.' because firmware and TPM changes can affect boot trust and recovery without indicating absent encryption. The current scenario instead requires 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.' and verification that a pilot endpoint reports active protection and the intended antivirus policy state.