Exam Bundle

This observation would validate a different case: An administrator applies iOS device restrictions to personal iPhones that cannot support supervised-only controls. It would check 'Supervised corporate iPhones receive the setting and personal devices are managed only within allowed capabilities.' after 'Use an enrollment-appropriate iOS configuration profile and supervised settings only where supported.'. It does not establish success for the stated scenario; the needed evidence is 'Each test device receives only its supported policy payload.'.

This observation would validate a different case: A macOS Wi-Fi profile installs but certificate trust prompts interrupt seamless enterprise Wi-Fi authentication. It would check 'A Mac connects without an untrusted certificate warning under approved policy.' after 'Configure the required trust and identity certificate payloads through supported management profiles.'. It does not establish success for the stated scenario; the needed evidence is 'Each test device receives only its supported policy payload.'.

This observation would validate a different case: An administrator assigns a corporate VPN profile to every iOS device but wants it only on devices with a supported OS version. It would check 'The eligible iOS pilot gets the VPN and the unsupported version is excluded.' after 'Use appropriate Intune assignment filters alongside group targeting.'. It does not establish success for the stated scenario; the needed evidence is 'Each test device receives only its supported policy payload.'.

This observation would validate a different case: A regional administrator accidentally modifies another unit's Windows 365 provisioning policy because their administrative rights are global. It would check 'The regional admin can view local Cloud PCs but cannot change the other unit's policy.' after 'Scope Windows 365 and Intune administrative roles to the intended administrative boundary.'. It does not establish success for the stated scenario; the needed evidence is 'A protected change remains pending until an authorized independent approver approves it.'.

This observation would validate a different case: An organization wants Windows Hello for Business sign-in with keys backed by device hardware rather than reusable passwords. It would check 'A test user completes protected biometric or PIN sign-in and reaches approved enterprise resources.' after 'Deploy Windows Hello for Business using appropriate Intune settings and supported authentication trust.'. It does not establish success for the stated scenario; the needed evidence is 'A protected change remains pending until an authorized independent approver approves it.'.

This observation would validate a different case: A bring-your-own iOS user needs app data protection but the admin applies a device compliance requirement without managing the device. It would check 'The protected app signs in with its applied policy while an unsupported client is denied.' after 'Use an app-protection-based Conditional Access requirement appropriate for supported mobile clients.'. It does not establish success for the stated scenario; the needed evidence is 'A protected change remains pending until an authorized independent approver approves it.'.

This observation would validate a different case: A field laptop is lost and the business wants to remove sensitive records while also preventing cloud access by its device identity. It would check 'Cloud requests fail for the missing device and management records capture the requested data removal.' after 'Coordinate approved Intune wipe/retire with Entra device disablement and session revocation.'. It does not establish success for the stated scenario; the needed evidence is 'A regional help desk user retrieves only permitted keys with audit records.'.

This observation would validate a different case: An admin wants to enforce App Control on all endpoints at once without understanding what legitimate binaries would be blocked. It would check 'The reviewed audit log shows impacted signed apps and the staged block policy works.' after 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'A regional help desk user retrieves only permitted keys with audit records.'.

This observation would validate a different case: A company's endpoints are enrolled in Intune but Defender XDR shows duplicate security device entries after rebuilding laptops. It would check 'Only the active security record is used for triage after stale-record verification.' after 'Correlate Defender device identity, Entra identity and Intune managed device records during cleanup.'. It does not establish success for the stated scenario; the needed evidence is 'A regional help desk user retrieves only permitted keys with audit records.'.

This observation would validate a different case: A remote user encounters incorrect tenant branding during first Windows sign-in despite the company owning the laptop. It would check 'The hardware shows the intended tenant identity and assigned profile at setup.' after 'Validate the Autopilot hardware registration tenant and assigned deployment profile.'. It does not establish success for the stated scenario; the needed evidence is 'The device does not complete gated setup until the designated security app succeeds.'.

This observation would validate a different case: A service desk wants to reset a problematic Autopilot-managed Windows laptop while preserving its approved management state. It would check 'After pilot reset the device returns to the expected managed ready state.' after 'Choose a supported Windows Autopilot reset or reprovisioning action suited to the deployment model.'. It does not establish success for the stated scenario; the needed evidence is 'The device does not complete gated setup until the designated security app succeeds.'.

This observation would validate a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. It would check 'An off-network pilot completes the chosen supported join workflow without domain dependency failure.' after 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.'. It does not establish success for the stated scenario; the needed evidence is 'The device does not complete gated setup until the designated security app succeeds.'.

This action is appropriate for a different case: Windows laptops remain on an unsupported Windows 10 release while hardware meets the organization’s Windows 11 requirements. There, the targeted fix is 'Plan an eligible Windows 11 upgrade using Intune feature update policies and readiness checks.' because controlled feature updates can target supported release upgrades without rebuilding devices. The current scenario instead requires 'Choose Windows Autopilot device preparation with an appropriately assigned user-driven policy.' and verification that the pilot shows deployment progress and installs its selected required apps without maintaining an image.

This action is appropriate for a different case: A Windows 11 feature update is repeatedly offered to PCs failing a hardware readiness safeguard. There, the targeted fix is 'Use Windows upgrade readiness and safeguard diagnostics before bypassing update controls.' because compatibility holds should be investigated rather than treated as arbitrary policy failures. The current scenario instead requires 'Choose Windows Autopilot device preparation with an appropriately assigned user-driven policy.' and verification that the pilot shows deployment progress and installs its selected required apps without maintaining an image.

This action is appropriate for a different case: A field device is configured for hybrid join though it never has a reliable route to domain controllers during the first boot. There, the targeted fix is 'Select an appropriate cloud-native Entra join deployment or plan validated domain connectivity.' because hybrid enrollment depends on reachable domain services at the required stage. The current scenario instead requires 'Choose Windows Autopilot device preparation with an appropriately assigned user-driven policy.' and verification that the pilot shows deployment progress and installs its selected required apps without maintaining an image.

This observation would validate a different case: A corporate iPhone user removes Company Portal and expects the supervised automated enrollment state to disappear. It would check 'After app removal the test device remains supervised and applicable MDM policy stays intact.' after 'Explain and manage corporate supervision through Apple automated enrollment rather than app removal.'. It does not establish success for the stated scenario; the needed evidence is 'Corporate devices enroll and the test personal Windows endpoint is denied full device enrollment.'.

This observation would validate a different case: Company-owned Windows laptops are Entra joined but none appear in Intune after first sign-in because automatic MDM enrollment is not enabled. It would check 'A newly joined authorized Windows laptop appears as an Intune managed device after sign-in.' after 'Configure Microsoft Intune MDM user scope and required automatic enrollment prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'Corporate devices enroll and the test personal Windows endpoint is denied full device enrollment.'.

This observation would validate a different case: A company permits personal apps on its corporate Android phones but wants firm separation of employee and enterprise data. It would check 'A test phone allows personal apps outside work profile and protects work data inside it.' after 'Deploy Android Enterprise corporate-owned devices with work profile (COPE) enrollment.'. It does not establish success for the stated scenario; the needed evidence is 'Corporate devices enroll and the test personal Windows endpoint is denied full device enrollment.'.

This observation would validate a different case: A device receives a hotpatch month update but the team falsely claims it never needs another restart. It would check 'The maintenance schedule shows baseline reboots and hotpatch months are documented separately.' after 'Explain and plan baseline cumulative updates that require reboot alongside hotpatch months.'. It does not establish success for the stated scenario; the needed evidence is 'Targeted Cloud PCs show the approved monthly update version in reports.'.

This observation would validate a different case: Windows clients are marked pending restart after the monthly cumulative patch, and compliance reports show older build versions. It would check 'After managed restart the pilot reports the new build and update-compliant state.' after 'Schedule restarts through approved Intune update policy rather than repeatedly reassigning patches.'. It does not establish success for the stated scenario; the needed evidence is 'Targeted Cloud PCs show the approved monthly update version in reports.'.

This observation would validate a different case: An administrator attempts to force update installation on iOS devices that lack required supervision for a chosen policy. It would check 'The eligible supervised pilot updates and an unsupported BYOD device is not falsely reported as enforced.' after 'Check supervision and platform prerequisites before configuring Apple update enforcement.'. It does not establish success for the stated scenario; the needed evidence is 'Targeted Cloud PCs show the approved monthly update version in reports.'.

This observation would validate a different case: A user requests a local antivirus exception for a downloaded installer without validating its publisher or hash. It would check 'The approved signed installer runs without a general exclusions directory.' after 'Verify software provenance and route any exclusion request through approved security policy.'. It does not establish success for the stated scenario; the needed evidence is 'The legitimate workload succeeds while a controlled test file outside the narrow exclusion is scanned.'.

This observation would validate a different case: App Control for Business enforcement blocks an essential finance application after a vendor update changed its signing certificate. It would check 'The approved application executes and the untrusted test binary remains denied.' after 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.'. It does not establish success for the stated scenario; the needed evidence is 'The legitimate workload succeeds while a controlled test file outside the narrow exclusion is scanned.'.

This observation would validate a different case: An attacker uses Office macros to launch credential theft from a managed Windows laptop. It would check 'A controlled macro-based process launch is blocked without harming approved documents.' after 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.'. It does not establish success for the stated scenario; the needed evidence is 'The legitimate workload succeeds while a controlled test file outside the narrow exclusion is scanned.'.

This action is appropriate for a different case: An organization-owned Android device has a managed app requiring a kiosk server address only on corporate hardware. There, the targeted fix is 'Use managed-device app configuration targeting appropriate device groups.' because corporate managed device settings should not be broadcast to personal installations. The current scenario instead requires 'Enforce Conditional Access and managed-app data transfer boundaries for unsupported clients.' and verification that the third-party app is denied and an approved supported app can open the document.

This action is appropriate for a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. There, the targeted fix is 'Create an Intune app configuration policy using supported managed app configuration settings.' because app configuration can deliver managed settings through a governed assignment. The current scenario instead requires 'Enforce Conditional Access and managed-app data transfer boundaries for unsupported clients.' and verification that the third-party app is denied and an approved supported app can open the document.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Enforce Conditional Access and managed-app data transfer boundaries for unsupported clients.' and verification that the third-party app is denied and an approved supported app can open the document.

This observation would validate a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. It would check 'The device restarts normally with its protected drive after authorized recovery.' after 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.'. It does not establish success for the stated scenario; the needed evidence is 'An analyst confirms affected device IDs and approves narrowly scoped containment with audit evidence.'.

This observation would validate a different case: An admin wants to enforce App Control on all endpoints at once without understanding what legitimate binaries would be blocked. It would check 'The reviewed audit log shows impacted signed apps and the staged block policy works.' after 'Use an audit-first App Control for Business deployment and refine policy from resulting telemetry.'. It does not establish success for the stated scenario; the needed evidence is 'An analyst confirms affected device IDs and approves narrowly scoped containment with audit evidence.'.

This observation would validate a different case: An administrator removes a BitLocker encryption policy and assumes the already encrypted drives instantly decrypt. It would check 'The device remains protected until an explicitly approved decryption task completes.' after 'Track device encryption state separately from policy assignment and use approved decryption workflow if required.'. It does not establish success for the stated scenario; the needed evidence is 'An analyst confirms affected device IDs and approves narrowly scoped containment with audit evidence.'.

This observation would validate a different case: A scheduled remediation needs to run on a small pilot set during evening hours, not across all corporate laptops. It would check 'The script runs only on targeted devices during the intended test schedule.' after 'Configure supported scheduling and scoped assignments for the remediation package.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies the conflicting setting and its assignments on affected devices.'.

This observation would validate a different case: A policy configuration conflict generates hundreds of alerts for the same device every hour. It would check 'A controlled conflict produces one traceable case rather than duplicate unbounded tickets.' after 'Deduplicate alert events and define actionable thresholds with correlation IDs.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies the conflicting setting and its assignments on affected devices.'.

This observation would validate a different case: An Intune report contains sensitive employee device details and should be shared with executives who need only risk totals. It would check 'Executives see accurate fleet trends without individual employee identifiers.' after 'Aggregate or redact user-level data and apply report access restrictions.'. It does not establish success for the stated scenario; the needed evidence is 'The report identifies the conflicting setting and its assignments on affected devices.'.