Exam Bundle

This action is appropriate for a different case: A Microsoft Tunnel gateway is online but unenrolled Android users cannot start application-specific connections. There, the targeted fix is 'Check Tunnel for MAM application configuration, gateway status and supported client integration.' because gateway reachability does not guarantee a MAM policy correctly invokes it. The current scenario instead requires 'Publish and validate the appropriate CA trust chain before onboarding clients.' and verification that a test device authenticates to Wi-Fi and the server validates the full issued chain.

This action is appropriate for a different case: A managed catalog app requires a vendor-specific detection update after an upstream app build changes its install path. There, the targeted fix is 'Update the Enterprise App Catalog app assignment or detection configuration using supported lifecycle procedures.' because catalog availability doesn't remove the need to verify installed state. The current scenario instead requires 'Publish and validate the appropriate CA trust chain before onboarding clients.' and verification that a test device authenticates to Wi-Fi and the server validates the full issued chain.

This action is appropriate for a different case: A catalog application is assigned but its vendor's older custom package remains installed and causes detection confusion. There, the targeted fix is 'Review enterprise catalog deployment/detection and coordinate supersedence of the legacy app.' because conflicting installations should be controlled across package lifecycles. The current scenario instead requires 'Publish and validate the appropriate CA trust chain before onboarding clients.' and verification that a test device authenticates to Wi-Fi and the server validates the full issued chain.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'The protected work account receives the intended PIN requirement.'.

This observation would validate a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. It would check 'The corporate app receives its server address and the BYOD version does not.' after 'Use managed-device app configuration targeting appropriate device groups.'. It does not establish success for the stated scenario; the needed evidence is 'The protected work account receives the intended PIN requirement.'.

This observation would validate a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. It would check 'The work browser opens the approved home page while personal browsing remains untouched.' after 'Use managed app configuration for the supported work browser and targeted identity.'. It does not establish success for the stated scenario; the needed evidence is 'The protected work account receives the intended PIN requirement.'.

This action is appropriate for a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. There, the targeted fix is 'Create the narrowest Intune RBAC role with only required remote-action permissions.' because endpoint administration should separate limited support tasks from policy ownership. The current scenario instead requires 'Configure Intune scope tags and appropriate role scope group assignments.' and verification that each regional technician sees only authorized device records in the admin center.

This action is appropriate for a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. There, the targeted fix is 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.' because managed application trust differs from MDM device compliance trust. The current scenario instead requires 'Configure Intune scope tags and appropriate role scope group assignments.' and verification that each regional technician sees only authorized device records in the admin center.

This action is appropriate for a different case: A company adds a new Intune compliance policy but Conditional Access continues permitting devices without any policy. There, the targeted fix is 'Set an appropriate default behavior for devices lacking an assigned compliance policy and test Conditional Access integration.' because an unassessed device should not be silently considered compliant. The current scenario instead requires 'Configure Intune scope tags and appropriate role scope group assignments.' and verification that each regional technician sees only authorized device records in the admin center.

This action is appropriate for a different case: A security team needs a help desk role that can reset managed devices but cannot edit tenant-wide compliance policies. There, the targeted fix is 'Create the narrowest Intune RBAC role with only required remote-action permissions.' because endpoint administration should separate limited support tasks from policy ownership. The current scenario instead requires 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.' and verification that user sign-in meets the intended authentication requirement without a shared password.

This action is appropriate for a different case: A device is compromised and IT needs to rotate its Windows LAPS password before the normal interval. There, the targeted fix is 'Trigger an authorized Windows LAPS rotation and verify directory backup state.' because a compromised local admin secret must be invalidated rather than only hidden from support. The current scenario instead requires 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.' and verification that user sign-in meets the intended authentication requirement without a shared password.

This action is appropriate for a different case: A Windows local group policy replaces an emergency break-glass member by accident during rollout. There, the targeted fix is 'Choose group-membership update semantics that preserve required approved break-glass access.' because replacing all members can unintentionally remove essential recovery identities. The current scenario instead requires 'Configure supported Windows Hello for Business authentication policy with required device and identity prerequisites.' and verification that user sign-in meets the intended authentication requirement without a shared password.

This observation would validate a different case: A field team reports enrollment failures only on outdated Android versions not supported by the corporate platform baseline. It would check 'Supported Android builds enroll and explicitly unsupported builds receive a governed rejection.' after 'Apply documented platform minimum-version enrollment restrictions and communicate upgrade requirements.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.'.

This observation would validate a different case: A device is registered in Windows Autopilot but not yet managed and a service desk mistakes the record for an enrolled Intune endpoint. It would check 'The portal separately shows the imported serial and its later enrolled management record.' after 'Distinguish the Autopilot inventory identity from a managedDevice enrollment record.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.'.

This observation would validate a different case: A device enrolls but its compliance policy never arrives because it is placed in an unexpectedly excluded dynamic group. It would check 'A corrected pilot membership receives compliance policies without enrolling again.' after 'Inspect target assignment groups, exclusions and device membership before deleting the enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'Pilot users enroll successfully and users outside the scope are not unexpectedly enrolled.'.

This action is appropriate for a different case: An iOS configuration update is queued but employees report it has not arrived despite healthy device enrollment. There, the targeted fix is 'Inspect profile assignment, latest device check-in and pending policy sync status.' because an enrolled device may be offline or awaiting policy processing. The current scenario instead requires 'Create separate specialty-device configuration profiles aligned to each platform.' and verification that each test device receives only its supported policy payload.

This action is appropriate for a different case: An organization needs a new ADMX-backed policy in Intune that is not yet included in its ordinary settings catalog. There, the targeted fix is 'Import the supported ADMX definition and publish the associated configuration settings.' because custom administrative templates require validated schema support and deployment targeting. The current scenario instead requires 'Create separate specialty-device configuration profiles aligned to each platform.' and verification that each test device receives only its supported policy payload.

This action is appropriate for a different case: An administrator needs to deploy browser restrictions to Windows devices but wants to avoid conflict with an existing security baseline. There, the targeted fix is 'Compare overlapping settings and select one authoritative assignment for each control.' because multiple policy sources can generate conflicting desired states. The current scenario instead requires 'Create separate specialty-device configuration profiles aligned to each platform.' and verification that each test device receives only its supported policy payload.

This observation would validate a different case: A branch requires traditional on-premises domain authentication for line-of-business software while also using cloud-based identity policies. It would check 'The Windows device reports both domain join and hybrid Entra registration after synchronization.' after 'Plan Microsoft Entra hybrid join with synchronized identity and valid domain connectivity.'. It does not establish success for the stated scenario; the needed evidence is 'Group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.'.

This observation would validate a different case: A device is marked registered but the organization requires joined identity for a Windows security baseline deployment. It would check 'The rebuilt test device reports the intended join type before the baseline is assigned.' after 'Transition the eligible Windows endpoint to the appropriate Microsoft Entra joined provisioning path.'. It does not establish success for the stated scenario; the needed evidence is 'Group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.'.

This observation would validate a different case: A device loses its Entra primary refresh token after a password reset and cloud application single sign-on stops functioning. It would check 'Sign-in succeeds with a refreshed valid token and the device keeps the expected join state.' after 'Inspect Entra sign-in/device diagnostics and refresh device authentication through supported steps.'. It does not establish success for the stated scenario; the needed evidence is 'Group membership excludes the BYOD test device while keeping eligible corporate Windows endpoints.'.

This observation would validate a different case: An Intune report contains sensitive employee device details and should be shared with executives who need only risk totals. It would check 'Executives see accurate fleet trends without individual employee identifiers.' after 'Aggregate or redact user-level data and apply report access restrictions.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies which metric and cohort account for the observed decline.'.

This observation would validate a different case: A device has a recurring local disk cache issue that support technicians fix manually every morning. It would check 'The detection identifies a failed test condition and remediation restores expected state.' after 'Deploy a supported Intune Remediations detection script plus narrowly scoped corrective script.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies which metric and cohort account for the observed decline.'.

This observation would validate a different case: After a corporate app deployment, devices show inconsistent app install results but the dashboard aggregates only successful check-ins. It would check 'The report lists each failed app installation and its relevant code.' after 'Export Intune app installation state per device and failure category.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies which metric and cohort account for the observed decline.'.

This observation would validate a different case: A security team wants all managed Windows PCs to use up-to-date real-time malware protection without editing antivirus settings manually on each endpoint. It would check 'A pilot endpoint reports active protection and the intended antivirus policy state.' after 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.'. It does not establish success for the stated scenario; the needed evidence is 'A newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.'.

This observation would validate a different case: An EDR policy should isolate a compromised endpoint but the help desk confuses quarantine with full device wipe. It would check 'The infected pilot loses unauthorized network access while forensic evidence is preserved.' after 'Use appropriate Defender incident-response containment and coordinate with Intune management actions.'. It does not establish success for the stated scenario; the needed evidence is 'A newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.'.

This observation would validate a different case: A business requires separate security baseline configurations for kiosks and ordinary employee laptops. It would check 'The kiosk and laptop each receive their intended controls without cross-assignment.' after 'Create tailored Intune security baseline assignments for each device purpose and validate conflicts.'. It does not establish success for the stated scenario; the needed evidence is 'A newly encrypted pilot laptop reports BitLocker enabled and a protected recovery key exists in directory.'.

This action is appropriate for a different case: A compliance policy requires an OS version but most devices report noncompliant because the version constraint is misconfigured. There, the targeted fix is 'Review supported platform minimum OS versions and assignments within the Intune compliance policy.' because compliance evaluations depend on accurate policy thresholds and platform scope. The current scenario instead requires 'Restrict LAPS password retrieval permissions with approved RBAC and audit usage.' and verification that the ordinary user cannot retrieve the secret while an authorized operator can with logging.

This action is appropriate for a different case: An administrator incorrectly believes scope tags prevent users from receiving a deployed app assignment. There, the targeted fix is 'Distinguish administrator visibility restrictions from user and device assignment targeting.' because scope tags govern delegated admin views, not end-user targeting by themselves. The current scenario instead requires 'Restrict LAPS password retrieval permissions with approved RBAC and audit usage.' and verification that the ordinary user cannot retrieve the secret while an authorized operator can with logging.

This action is appropriate for a different case: A device operator is assigned Intune Administrator and can view every corporate profile although their job is only collecting diagnostics. There, the targeted fix is 'Replace broad tenant roles with appropriately scoped Intune RBAC diagnostic rights.' because least privilege lowers the impact of administrator compromise or error. The current scenario instead requires 'Restrict LAPS password retrieval permissions with approved RBAC and audit usage.' and verification that the ordinary user cannot retrieve the secret while an authorized operator can with logging.

This action is appropriate for a different case: A remote kiosk is frozen after an application update and operations needs a controlled reboot, not a factory reset. There, the targeted fix is 'Use the Restart remote device action with authorization and user-impact assessment.' because restart and wipe have drastically different data effects. The current scenario instead requires 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.' and verification that the support case includes post-upgrade logs tied to the affected profile ID.

This action is appropriate for a different case: A support agent cannot tell why a single user's two iPhones receive different configuration policies. There, the targeted fix is 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' because per-user troubleshooting correlates device and app policy targeting. The current scenario instead requires 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.' and verification that the support case includes post-upgrade logs tied to the affected profile ID.

This action is appropriate for a different case: A compliance team wants device diagnostics from a stolen laptop but the device has been offline for weeks. There, the targeted fix is 'Report remote collection status accurately and use available last-seen telemetry rather than claiming successful capture.' because remote actions require device connectivity and cannot guarantee results from offline endpoints. The current scenario instead requires 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.' and verification that the support case includes post-upgrade logs tied to the affected profile ID.