Exam Bundle

This action is appropriate for a different case: A service desk user can retrieve BitLocker recovery keys for every subsidiary despite being responsible for one region. There, the targeted fix is 'Limit recovery key access and Intune/Entra role scope to authorized device populations.' because recovery secrets are highly sensitive and require least privilege. The current scenario instead requires 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.' and verification that a pilot endpoint reports active protection and the intended antivirus policy state.

This action is appropriate for a different case: A device firewall rule appears correctly assigned but does not take effect on machines using the public network profile. There, the targeted fix is 'Inspect the profile-specific rule settings and effective network category on the endpoint.' because a firewall rule can depend on the active domain/private/public context. The current scenario instead requires 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.' and verification that a pilot endpoint reports active protection and the intended antivirus policy state.

This action is appropriate for a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. There, the targeted fix is 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.' because firmware and TPM changes can affect boot trust and recovery without indicating absent encryption. The current scenario instead requires 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.' and verification that a pilot endpoint reports active protection and the intended antivirus policy state.

This observation would validate a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. It would check 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.' after 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.'. It does not establish success for the stated scenario; the needed evidence is 'Test logs show intended blocks while approved emergency access remains available.'.

This observation would validate a different case: A junior admin submits a destructive device configuration change that must be approved by another authorized administrator. It would check 'A protected change remains pending until an authorized independent approver approves it.' after 'Use Intune multi-admin approval for the protected change type.'. It does not establish success for the stated scenario; the needed evidence is 'Test logs show intended blocks while approved emergency access remains available.'.

This observation would validate a different case: A customer wants only a specific device support group to be local Administrators on Windows endpoints, not every cloud user. It would check 'Only the assigned support accounts hold local admin access on test machines.' after 'Configure the Windows local users and groups policy in Intune with supported membership settings.'. It does not establish success for the stated scenario; the needed evidence is 'Test logs show intended blocks while approved emergency access remains available.'.

This observation would validate a different case: An Android dedicated kiosk has no compliant way to authenticate a normal employee with a personal work identity during setup. It would check 'The device initializes in kiosk policy without requiring an employee's account credentials.' after 'Use the supported enrollment token and dedicated-device configuration rather than a user-driven sign-in flow.'. It does not establish success for the stated scenario; the needed evidence is 'The employee uses protected Outlook with company data restrictions and keeps personal settings unmanaged.'.

This observation would validate a different case: An enrollment error appears during iPad provisioning immediately after the Apple enrollment token was refreshed, but the profile assignment is missing. It would check 'The iPad receives its intended company enrollment profile during a clean setup.' after 'Check the token synchronization and automated enrollment profile mapping for the actual device.'. It does not establish success for the stated scenario; the needed evidence is 'The employee uses protected Outlook with company data restrictions and keeps personal settings unmanaged.'.

This observation would validate a different case: A mobile administrator tries to use the same Apple enrollment profile for personally owned and corporate supervised iPhones. It would check 'The personal device enrolls with user-appropriate controls while the corporate device is supervised.' after 'Create separate BYOD and corporate enrollment models with the appropriate privacy and supervision behavior.'. It does not establish success for the stated scenario; the needed evidence is 'The employee uses protected Outlook with company data restrictions and keeps personal settings unmanaged.'.

This observation would validate a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. It would check 'The work browser opens the approved home page while personal browsing remains untouched.' after 'Use managed app configuration for the supported work browser and targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'A protected document cannot be pasted into a personal chat app.'.

This observation would validate a different case: A personal iPad uses a supported app configuration setting delivered to managed applications even though no MDM device profile is installed. It would check 'The app gets its intended work URL while the personal device remains unenrolled.' after 'Configure the correct managed-app configuration policy for the targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'A protected document cannot be pasted into a personal chat app.'.

This observation would validate a different case: A company wants managed iOS and Android apps to receive a company tenant identifier without requiring users to type it every launch. It would check 'The targeted app starts with the right corporate tenant and no manual text entry.' after 'Use supported app configuration policies for managed apps or devices according to enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'A protected document cannot be pasted into a personal chat app.'.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Apply supported app protection device-health conditions for BYOD apps.' and verification that an at-risk test device is blocked inside the managed app while an eligible device opens.

This action is appropriate for a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. There, the targeted fix is 'Use managed-device app configuration targeting appropriate device groups.' because corporate managed device settings should not be broadcast to personal installations. The current scenario instead requires 'Apply supported app protection device-health conditions for BYOD apps.' and verification that an at-risk test device is blocked inside the managed app while an eligible device opens.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Apply supported app protection device-health conditions for BYOD apps.' and verification that an at-risk test device is blocked inside the managed app while an eligible device opens.

This observation would validate a different case: A pilot group should enroll Windows devices automatically while the rest of the tenant remains on an older management platform. It would check 'Pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.' after 'Limit automatic MDM enrollment scope to the approved pilot users.'. It does not establish success for the stated scenario; the needed evidence is 'The iPad receives its intended company enrollment profile during a clean setup.'.

This observation would validate a different case: Windows enrollment fails after Autopilot because the assigned user lacks the required Intune license. It would check 'The next supported enrollment attempt succeeds without an unlicensed bypass.' after 'Assign and verify the correct eligible Intune entitlement for the affected user.'. It does not establish success for the stated scenario; the needed evidence is 'The iPad receives its intended company enrollment profile during a clean setup.'.

This observation would validate a different case: An employee with a personal Android phone needs protected Teams access without granting IT full device wipe privileges. It would check 'The user retains personal data and an admin can remove only the approved company-managed data.' after 'Use Android work-profile or app-protection management appropriate for personally owned devices.'. It does not establish success for the stated scenario; the needed evidence is 'The iPad receives its intended company enrollment profile during a clean setup.'.

This action is appropriate for a different case: An app needs a per-user license and is assigned to a system-context install even when its configuration should be applied in user context. There, the targeted fix is 'Separate machine installation from appropriate user-specific license or configuration deployment.' because install context and app entitlement can be independently scoped. The current scenario instead requires 'Package it as a supported Intune Win32 app and configure the required install command.' and verification that a targeted Windows device installs the accounting app silently and Intune reports success.

This action is appropriate for a different case: An enterprise uses the new Microsoft Store for its Windows app distribution and still relies on retired legacy store integration. There, the targeted fix is 'Choose the supported Microsoft Store app deployment method within Intune.' because modern store integration replaces older Microsoft Store for Business workflows. The current scenario instead requires 'Package it as a supported Intune Win32 app and configure the required install command.' and verification that a targeted Windows device installs the accounting app silently and Intune reports success.

This action is appropriate for a different case: An enterprise needs to remove a vulnerable app version before assigning a patched replacement, avoiding two conflicting versions. There, the targeted fix is 'Coordinate app supersedence or uninstall and replacement assignments with detection tests.' because lifecycle transitions should not leave multiple incompatible releases. The current scenario instead requires 'Package it as a supported Intune Win32 app and configure the required install command.' and verification that a targeted Windows device installs the accounting app silently and Intune reports success.

This observation would validate a different case: A Teams Rooms device must run its supported collaboration client but the admin deploys a normal desktop Office suite installer to it. It would check 'The room console receives the approved client version without unsupported Office installation.' after 'Use the supported Teams Rooms app servicing and specialized device management path.'. It does not establish success for the stated scenario; the needed evidence is 'Office updates complete under the chosen bandwidth and channel policy.'.

This observation would validate a different case: An application installation command prompts for interactive input and therefore times out under silent Intune deployment. It would check 'The installation completes in system context with no user prompt.' after 'Use a documented silent unattended install switch or repackage for managed deployment.'. It does not establish success for the stated scenario; the needed evidence is 'Office updates complete under the chosen bandwidth and channel policy.'.

This observation would validate a different case: A corporate iPad should install a paid in-house app purchased through Apple Business Manager without personal Apple IDs. It would check 'A supervised iPad installs the licensed app under corporate management.' after 'Sync Apps and Books with Intune and assign the licensed application appropriately.'. It does not establish success for the stated scenario; the needed evidence is 'Office updates complete under the chosen bandwidth and channel policy.'.

This observation would validate a different case: A tenant needs to find stale Intune managed devices and export their names using automation without granting a developer full global administrator rights. It would check 'The script returns only approved inventory fields and cannot delete device records.' after 'Use Microsoft Graph with scoped application or delegated permissions and paginated queries.'. It does not establish success for the stated scenario; the needed evidence is 'The repository contains no reusable secret and the task authenticates through approved credentials.'.

This observation would validate a different case: A Policy Configuration Agent proposes settings from a natural-language security standard without identifying policy conflicts. It would check 'The staged policy matches the security requirement and produces no unreviewed conflicts.' after 'Review proposed settings and existing Intune assignments before creating the new configuration.'. It does not establish success for the stated scenario; the needed evidence is 'The repository contains no reusable secret and the task authenticates through approved credentials.'.

This observation would validate a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. It would check 'The dry run rejects stale selections and records the updated approved device set.' after 'Add preflight freshness checks and compare identifiers before applying bulk changes.'. It does not establish success for the stated scenario; the needed evidence is 'The repository contains no reusable secret and the task authenticates through approved credentials.'.

This observation would validate a different case: A help desk needs a newly assigned Windows compliance policy to take effect without waiting for normal device check-in. It would check 'The device checks in and reports its updated compliance state.' after 'Issue a supported Intune Sync remote action and verify policy evaluation.'. It does not establish success for the stated scenario; the needed evidence is 'The resulting report shows the effective assignment and exclusion causing the difference.'.

This observation would validate a different case: Hundreds of managed devices need a common remote restart after a validated firmware change. It would check 'The intended cohort restarts and unaffected device records show no remote action.' after 'Use supported Intune bulk remote action with carefully verified group/device selection.'. It does not establish success for the stated scenario; the needed evidence is 'The resulting report shows the effective assignment and exclusion causing the difference.'.

This observation would validate a different case: A mobile device enrollment is failing and the help desk needs actionable logs before wiping the phone. It would check 'The log bundle identifies the enrollment failure class for the affected device.' after 'Collect available Intune enrollment and device diagnostic logs for the specific record.'. It does not establish success for the stated scenario; the needed evidence is 'The resulting report shows the effective assignment and exclusion causing the difference.'.

This action is appropriate for a different case: A company wants one kiosk policy for Teams Rooms and Android scanners and finds platform targeting failures. There, the targeted fix is 'Create separate specialty-device configuration profiles aligned to each platform.' because specialized endpoint capabilities cannot be assumed interchangeable. The current scenario instead requires 'Configure the required trust and identity certificate payloads through supported management profiles.' and verification that a Mac connects without an untrusted certificate warning under approved policy.

This action is appropriate for a different case: A Teams Rooms device should receive meeting-room configuration without a user signing into Company Portal. There, the targeted fix is 'Use supported Teams Rooms specialized-device enrollment and configuration targeting.' because room equipment often has different setup and shared-use requirements from personal PCs. The current scenario instead requires 'Configure the required trust and identity certificate payloads through supported management profiles.' and verification that a Mac connects without an untrusted certificate warning under approved policy.

This action is appropriate for a different case: Two Android departments share a device group, but only warehouse devices should receive a barcode-scanning restriction. There, the targeted fix is 'Split assignments using trusted device attributes and supported filters or group membership.' because broad assignments can apply vendor-specific controls to the wrong devices. The current scenario instead requires 'Configure the required trust and identity certificate payloads through supported management profiles.' and verification that a Mac connects without an untrusted certificate warning under approved policy.