Exam Bundle

This action is appropriate for a different case: A remote kiosk is frozen after an application update and operations needs a controlled reboot, not a factory reset. There, the targeted fix is 'Use the Restart remote device action with authorization and user-impact assessment.' because restart and wipe have drastically different data effects. The current scenario instead requires 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.' and verification that the support case includes post-upgrade logs tied to the affected profile ID.

This action is appropriate for a different case: A support agent cannot tell why a single user's two iPhones receive different configuration policies. There, the targeted fix is 'Use the Intune user-focused Troubleshooting blade to inspect policies and assignments.' because per-user troubleshooting correlates device and app policy targeting. The current scenario instead requires 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.' and verification that the support case includes post-upgrade logs tied to the affected profile ID.

This action is appropriate for a different case: A compliance team wants device diagnostics from a stolen laptop but the device has been offline for weeks. There, the targeted fix is 'Report remote collection status accurately and use available last-seen telemetry rather than claiming successful capture.' because remote actions require device connectivity and cannot guarantee results from offline endpoints. The current scenario instead requires 'Collect fresh diagnostics and correlate their timestamps with policy check-in and upgrade events.' and verification that the support case includes post-upgrade logs tied to the affected profile ID.

This observation would validate a different case: A macOS Mac enrolled through Company Portal fails to receive management after the user denies the required profile installation. It would check 'The Mac shows the management profile and responds to a scheduled check-in.' after 'Guide the user through supported macOS enrollment approval and verify the management profile.'. It does not establish success for the stated scenario; the needed evidence is 'A newly joined authorized Windows laptop appears as an Intune managed device after sign-in.'.

This observation would validate a different case: A bring-your-own Android user accidentally enrolls the whole phone instead of a separate work profile. It would check 'The new profile isolates work data and personal apps remain outside managed scope.' after 'Retire the inappropriate enrollment and re-enroll using approved personally owned work-profile setup.'. It does not establish success for the stated scenario; the needed evidence is 'A newly joined authorized Windows laptop appears as an Intune managed device after sign-in.'.

This observation would validate a different case: An enterprise wants to prevent employee-owned Windows devices from auto-enrolling into full management during personal account association. It would check 'Corporate devices enroll and the test personal Windows endpoint is denied full device enrollment.' after 'Set supported enrollment ownership and platform restrictions aligned with corporate enrollment policy.'. It does not establish success for the stated scenario; the needed evidence is 'A newly joined authorized Windows laptop appears as an Intune managed device after sign-in.'.

This observation would validate a different case: An application installation command prompts for interactive input and therefore times out under silent Intune deployment. It would check 'The installation completes in system context with no user prompt.' after 'Use a documented silent unattended install switch or repackage for managed deployment.'. It does not establish success for the stated scenario; the needed evidence is 'The test user receives their licensed settings after the machine install.'.

This observation would validate a different case: A mobile app installed on an iPad is removed by users despite being required for device compliance tasks. It would check 'The supervised test iPad retains the required app after sync and the policy reports success.' after 'Use appropriate required app assignment and supervised device restrictions where supported.'. It does not establish success for the stated scenario; the needed evidence is 'The test user receives their licensed settings after the machine install.'.

This observation would validate a different case: A packaged enterprise app supports both 32-bit and 64-bit installations, but the wrong architecture is installed on ARM-based devices. It would check 'Each test device receives a compatible binary and unsupported versions are excluded.' after 'Define valid architecture applicability or separate packages according to supported platform.'. It does not establish success for the stated scenario; the needed evidence is 'The test user receives their licensed settings after the machine install.'.

This action is appropriate for a different case: An executive wants email access blocked from unmanaged devices even when their passwords and MFA succeed. There, the targeted fix is 'Create an Entra Conditional Access policy requiring compliant devices for the defined application audience.' because identity authentication alone does not prove required endpoint compliance. The current scenario instead requires 'Review supported platform minimum OS versions and assignments within the Intune compliance policy.' and verification that supported test devices meet compliance while known outdated builds are flagged.

This action is appropriate for a different case: A compliant Windows device is blocked because a Conditional Access policy targets the wrong cloud app or includes a nested exclusion. There, the targeted fix is 'Review Conditional Access policy targeting and sign-in logs for the exact grant condition.' because policy scope and sign-in context determine whether compliant devices are admitted. The current scenario instead requires 'Review supported platform minimum OS versions and assignments within the Intune compliance policy.' and verification that supported test devices meet compliance while known outdated builds are flagged.

This action is appropriate for a different case: An administrator incorrectly believes scope tags prevent users from receiving a deployed app assignment. There, the targeted fix is 'Distinguish administrator visibility restrictions from user and device assignment targeting.' because scope tags govern delegated admin views, not end-user targeting by themselves. The current scenario instead requires 'Review supported platform minimum OS versions and assignments within the Intune compliance policy.' and verification that supported test devices meet compliance while known outdated builds are flagged.

This observation would validate a different case: A business moves employees between Windows 365 Cloud PCs but misinterprets reprovisioning as a simple reboot. It would check 'A nonproduction reprovision creates the intended fresh image with documented user-data handling.' after 'Use the supported Cloud PC reprovisioning lifecycle only after confirming expected data impact.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot reports the intended deployment engine after device state is corrected.'.

This observation would validate a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. It would check 'OOBE finishes with essentials and remaining applications deploy after check-in.' after 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot reports the intended deployment engine after device state is corrected.'.

This observation would validate a different case: A Windows Backup restore is offered during new Windows device setup but organizational policy forbids unmanaged personal restore sources. It would check 'A pilot restores permitted settings while blocked personal restore content is not introduced.' after 'Configure Windows Backup and restore policy with approved organizational device settings.'. It does not establish success for the stated scenario; the needed evidence is 'A pilot reports the intended deployment engine after device state is corrected.'.

This action is appropriate for a different case: A device is compromised and IT needs to rotate its Windows LAPS password before the normal interval. There, the targeted fix is 'Trigger an authorized Windows LAPS rotation and verify directory backup state.' because a compromised local admin secret must be invalidated rather than only hidden from support. The current scenario instead requires 'Configure the Windows local users and groups policy in Intune with supported membership settings.' and verification that only the assigned support accounts hold local admin access on test machines.

This action is appropriate for a different case: A regional administrator accidentally modifies another unit's Windows 365 provisioning policy because their administrative rights are global. There, the targeted fix is 'Scope Windows 365 and Intune administrative roles to the intended administrative boundary.' because Cloud PC rights should follow the same minimum-access governance as physical devices. The current scenario instead requires 'Configure the Windows local users and groups policy in Intune with supported membership settings.' and verification that only the assigned support accounts hold local admin access on test machines.

This action is appropriate for a different case: A PIN policy is applied but Windows Hello for Business enrollment fails on devices without a functional TPM. There, the targeted fix is 'Diagnose supported hardware and Windows Hello provisioning requirements instead of weakening policy globally.' because credential provisioning depends on platform capabilities and tenant settings. The current scenario instead requires 'Configure the Windows local users and groups policy in Intune with supported membership settings.' and verification that only the assigned support accounts hold local admin access on test machines.

This action is appropriate for a different case: App Control for Business enforcement blocks an essential finance application after a vendor update changed its signing certificate. There, the targeted fix is 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.' because overly narrow allow rules can unintentionally block updated legitimate software. The current scenario instead requires 'Start with ASR audit mode and evaluate telemetry before changing selected rules to block.' and verification that the report identifies impacted applications and the pilot block phase denies only unwanted behavior.

This action is appropriate for a different case: Defender Antivirus is reporting passive mode on certain devices because another antivirus provider is installed. There, the targeted fix is 'Inspect provider coexistence and Defender operating mode before forcing duplicate antivirus engines.' because active and passive antivirus modes differ based on existing security software. The current scenario instead requires 'Start with ASR audit mode and evaluate telemetry before changing selected rules to block.' and verification that the report identifies impacted applications and the pilot block phase denies only unwanted behavior.

This action is appropriate for a different case: An organization wants to allow only trusted, signed business executables on Windows endpoints. There, the targeted fix is 'Configure App Control for Business policies in a suitable audited then enforced rollout.' because application control determines which binaries may execute, separate from simple malware scanning. The current scenario instead requires 'Start with ASR audit mode and evaluate telemetry before changing selected rules to block.' and verification that the report identifies impacted applications and the pilot block phase denies only unwanted behavior.

This observation would validate a different case: Enterprise users report duplicate Microsoft 365 Apps installations after both a Win32 Office package and an Intune suite deployment target the same computers. It would check 'Pilot devices report one approved Office installation and channel after cleanup.' after 'Choose one authoritative Microsoft 365 Apps deployment method and remove overlapping assignments.'. It does not establish success for the stated scenario; the needed evidence is 'The selected Android app becomes assignable in Intune and installs on a pilot.'.

This observation would validate a different case: Microsoft 365 Apps are installed with an undesired language despite an assigned corporate default. It would check 'The pilot Office UI and installed language packs match the approved configuration.' after 'Configure Microsoft 365 Apps language selections or deployment XML appropriately.'. It does not establish success for the stated scenario; the needed evidence is 'The selected Android app becomes assignable in Intune and installs on a pilot.'.

This observation would validate a different case: A company must deploy a business app immediately after device enrollment but its required assignment waits on a group that is populated only hours later. It would check 'The app installs before the employee is allowed to start regulated work.' after 'Design enrollment-time group targeting or use a supported setup-stage deployment approach.'. It does not establish success for the stated scenario; the needed evidence is 'The selected Android app becomes assignable in Intune and installs on a pilot.'.

This observation would validate a different case: A device preparation policy unexpectedly installs too many apps during initial setup and times out on slow branch links. It would check 'OOBE finishes with essentials and remaining applications deploy after check-in.' after 'Limit critical OOBE apps and move nonessential installations to post-enrollment deployments.'. It does not establish success for the stated scenario; the needed evidence is 'A sample Cloud PC resides in the approved region and passes jurisdiction checks.'.

This observation would validate a different case: Windows laptops remain on an unsupported Windows 10 release while hardware meets the organization’s Windows 11 requirements. It would check 'A pilot fleet reports the intended Windows 11 version and user applications remain functional.' after 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.'. It does not establish success for the stated scenario; the needed evidence is 'A sample Cloud PC resides in the approved region and passes jurisdiction checks.'.

This observation would validate a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. It would check 'The approved eligible devices upgrade and blocked hardware shows a documented reason.' after 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.'. It does not establish success for the stated scenario; the needed evidence is 'A sample Cloud PC resides in the approved region and passes jurisdiction checks.'.

This observation would validate a different case: A suspicious endpoint has increased Defender risk, and AI summarization recommends immediate deletion of all related devices. It would check 'An analyst confirms affected device IDs and approves narrowly scoped containment with audit evidence.' after 'Use supervised risk triage and human approval rather than executing destructive actions based solely on automated suggestions.'. It does not establish success for the stated scenario; the needed evidence is 'The reviewed audit log shows impacted signed apps and the staged block policy works.'.

This observation would validate a different case: A security team wants all managed Windows PCs to use up-to-date real-time malware protection without editing antivirus settings manually on each endpoint. It would check 'A pilot endpoint reports active protection and the intended antivirus policy state.' after 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.'. It does not establish success for the stated scenario; the needed evidence is 'The reviewed audit log shows impacted signed apps and the staged block policy works.'.

This observation would validate a different case: A user requests a local antivirus exception for a downloaded installer without validating its publisher or hash. It would check 'The approved signed installer runs without a general exclusions directory.' after 'Verify software provenance and route any exclusion request through approved security policy.'. It does not establish success for the stated scenario; the needed evidence is 'The reviewed audit log shows impacted signed apps and the staged block policy works.'.

This observation would validate a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. It would check 'Supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.' after 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.'. It does not establish success for the stated scenario; the needed evidence is 'Each test device receives only its supported policy payload.'.

This observation would validate a different case: A macOS Wi-Fi profile installs but certificate trust prompts interrupt seamless enterprise Wi-Fi authentication. It would check 'A Mac connects without an untrusted certificate warning under approved policy.' after 'Configure the required trust and identity certificate payloads through supported management profiles.'. It does not establish success for the stated scenario; the needed evidence is 'Each test device receives only its supported policy payload.'.

This observation would validate a different case: An administrator assigns a corporate VPN profile to every iOS device but wants it only on devices with a supported OS version. It would check 'The eligible iOS pilot gets the VPN and the unsupported version is excluded.' after 'Use appropriate Intune assignment filters alongside group targeting.'. It does not establish success for the stated scenario; the needed evidence is 'Each test device receives only its supported policy payload.'.