Q1 - Correct: B. Co-management with Configuration Manager and Intune Correct. Co-management lets Contoso keep Configuration Manager for existing Windows devices while gradually extending Intune capabilities. Mobile devices and Conditional Access can be enabled immediately without replacing the on-premises infrastructure. A. Incorrect. Cloud-only management would require migrating away from Configuration Manager entirely. Contoso wants to keep their existing on-premises infrastructure while adding cloud capabilities. C. Incorrect. An on-premises MDM doesn't provide the cloud-based Conditional Access or mobile device support Contoso needs. Co-management with Intune is the right path.

Q2 - Correct: B. It verifies the user's identity and confirms the device is registered, enabling Intune to target the correct device Correct. Microsoft Entra ID provides the identity infrastructure that Intune depends on. It authenticates the user, holds the device object, and enables Intune to associate policies with the right user and device identity. A. Incorrect. Intune stores and delivers configuration profiles. Microsoft Entra ID is responsible for identity : verifying who the user is and whether the device is authorized to receive policies. C. Incorrect. Microsoft Entra ID handles identity and authorization, not profile encryption. Intune manages the secure delivery of configuration policies to enrolled devices.

Q3 - Correct: C. Cloud-only management with Microsoft Intune Correct. Cloud-only management with Intune is the ideal fit for a new organization with no on-premises infrastructure. It provides full MDM capabilities across Windows, iOS, and Android from a single cloud-based console without requiring any on-premises components. A. Incorrect. Hybrid management requires on-premises Active Directory infrastructure, which Northwind Traders doesn't have. It's designed for organizations transitioning from on-premises to cloud, not for new cloud-first organizations. B. Incorrect. Co-management requires Configuration Manager to already be in place managing Windows devices. Northwind Traders has no existing on-premises management infrastructure to co-manage with.

Q4 - Correct: B. Remote device actions Correct. Intune's MDM capabilities include remote device actions such as remote wipe, retire, lock, and reset passcode. These actions can be triggered from the Intune admin center for any enrolled device, regardless of its current location. A. Incorrect. Configuration profiles push settings to devices but don't perform remote actions. Remote wipe is an MDM remote action that can be triggered on-demand from the Intune admin center. C. Incorrect. Compliance policies assess whether a device meets defined security requirements and can mark devices as noncompliant. They don't directly wipe a device : that requires a remote device action.

Q5 - Correct: B. Enable co-management and keep the software deployment workload in Configuration Manager Correct. Co-management lets you split workloads between Configuration Manager and Intune. Tailspin Toys can enable co-management to start using Intune features while leaving the software deployment workload with Configuration Manager, preserving existing deployment workflows. A. Incorrect. An immediate migration would disrupt existing Configuration Manager software deployments. Co-management allows Tailspin Toys to selectively move workloads to Intune while keeping software deployment in Configuration Manager. C. Incorrect. Adding a second on-premises MDM server would create management complexity and doesn't leverage the cloud-based capabilities of Intune. Co-management is the supported path for organizations already using Configuration Manager.

Q1 - Correct: B. The devices are automatically added to the Emergency-Devices group during the next membership evaluation Correct. Dynamic groups automatically re-evaluate membership when user or device attributes change. After Maria's department attribute is updated, her devices are added to the group during the next evaluation cycle. This automation eliminates manual group management. A. Incorrect. Dynamic groups evaluate membership automatically based on attribute changes. Manual intervention isn't required. C. Incorrect. Device re-enrollment isn't required when dynamic group membership changes. Membership is evaluated based on current attributes.

Q2 - Correct: C. Helpdesk Operator Correct. The Helpdesk Operator role (an Intune built-in RBAC role, not a Microsoft Entra ID role) is designed for support staff who need to perform device management tasks like remote wipe, restart, and disable devices without permissions to modify policies. This follows the principle of least privilege. A. Incorrect. The Intune Administrator role has full permissions to manage all Intune aspects, including creating and modifying policies. This exceeds the Helpdesk team's required permissions. B. Incorrect. The Cloud Device Administrator can manage device objects in Microsoft Entra ID, but lacks permissions for Intune actions like remote wipe or viewing the Intune device inventory.

Q3 - Correct: C. In Conditional Access policies by creating a policy that requires MFA for device registration Correct. To require MFA during device registration, create a Conditional Access policy that targets the 'Device registration' cloud app. This approach provides granular control over authentication requirements for registration activities. A. Incorrect. The 'Devices may be Microsoft Entra joined' setting controls whether devices can be joined (for Windows devices), not registered. MFA requirements are configured separately. B. Incorrect. The 'Users may register their devices' setting controls who can register devices, but doesn't provide options for requiring MFA. This setting only enables or disables registration.

Q4 - Correct: B. Microsoft Entra join Correct. Microsoft Entra join is the optimal choice for cloud-first organizations without on-premises Active Directory. It establishes device identity directly in Microsoft Entra ID, enables single sign-on to cloud resources, and provides full management through Intune. A. Incorrect. Microsoft Entra hybrid join requires on-premises Active Directory Domain Services (AD DS). Since Contoso Healthcare doesn't have on-premises AD DS, this option isn't viable. C. Incorrect. Microsoft Entra registration is designed for BYOD and personal device scenarios. For corporate-owned devices that need full management, Microsoft Entra join is the appropriate choice.

Q5 - Correct: B. Create dynamic user groups based on department attributes and dynamic device groups based on device ownership (corporate vs. personal) Correct. Dynamic user groups automatically organize users by attributes like department, while dynamic device groups distinguish corporate-owned from personal devices. This combination enables accurate policy targeting without manual management and ensures memberships update automatically as roles change or new devices enroll. A. Incorrect. Static groups require manual maintenance as staff join, leave, or change roles. This approach increases administrative overhead in a 500-employee organization. C. Incorrect. Managing groups by physical location requires continuous manual updates and doesn't align with cloud-first management. Device location changes frequently in healthcare, making this approach inefficient.

Q1 - Correct: A. Use Microsoft Entra join with automatic MDM enrollment so devices join Microsoft Entra ID during setup and enroll in Intune automatically. Microsoft Entra join combined with automatic MDM enrollment allows devices to join Microsoft Entra ID and enroll into Intune during OOBE by signing in with an organizational account. B. Hybrid join makes devices domain-joined and synced to Microsoft Entra ID but requires extra AD and Microsoft Entra Connect configuration. It doesn't provide automatic Intune enrollment during OOBE by default. C. Microsoft Entra ID registration is intended for personal devices and requires user action to enroll. It doesn't meet the automatic corporate provisioning requirement.

Q2 - Correct: A. The device is Microsoft Entra joined but not hybrid joined. Update the Conditional Access policy to accept Microsoft Entra joined devices. AzureAdJoined: YES indicates Microsoft Entra joined status, while DomainJoined: NO means it isn't domain-joined or hybrid joined. Either the device must be hybrid-joined or the policy must be adjusted. B. The device shows AzureAdJoined: YES and a DeviceId, so it's already registered. Running dsregcmd /join is unnecessary for this symptom. C. Company Portal affects Intune enrollment and compliance, but the immediate issue is that the device isn't domain-joined or hybrid joined as the policy requires.

Q3 - Correct: A. The Microsoft Entra Connect service connection point (SCP) is missing or misconfigured in on-premises AD, so devices can't discover the hybrid join configuration. Microsoft Entra hybrid join depends on an SCP in on-premises AD (created by Microsoft Entra Connect) so devices can find the tenant registration configuration. A missing or misconfigured SCP prevents hybrid registration. B. Intune auto-enrollment affects MDM enrollment, not the hybrid join process. Hybrid join depends on Microsoft Entra Connect and device SCP discovery. C. Windows Hello for Business isn't a prerequisite for Microsoft Entra hybrid join. Hybrid registration requires SCP, Microsoft Entra Connect sync, and network reachability to Azure endpoints.

Q4 - Correct: A. Verify the device has valid time sync and connectivity to Microsoft Entra ID endpoints. If needed, re-run dsregcmd /join or re-register the device. PRT acquisition requires correct device registration, time sync, and connectivity to Microsoft Entra ID. Re-registering the device or fixing connectivity often restores the PRT and SSO. B. Disabling and recreating accounts is disruptive and unrelated to device PRT issues. Troubleshooting should target device registration and connectivity first. C. Company Portal relates to Intune enrollment. PRT results from device and user authentication with Microsoft Entra ID and isn't fixed by removing Company Portal.

Q5 - Correct: A. Filter by deviceOwnership equals 'Company', operatingSystem equals 'Windows', and trustType equals 'AzureAD'. These three attributes accurately identify corporate-owned Windows devices that are Microsoft Entra joined. deviceOwnership distinguishes corporate from personal, operatingSystem identifies Windows, and trustType 'AzureAD' indicates Microsoft Entra joined. B. managedBy indicates enrollment status but doesn't specify join type or ownership. Device names aren't reliable filters since naming conventions vary. C. This might capture managed Windows 11 devices, but it doesn't distinguish between Microsoft Entra joined and hybrid joined devices, nor does it filter by corporate ownership.

Q6 - Correct: A. Deploy Windows Hello for Business with TPM 2.0 required. Cloud-only deployments don't use a trust type; TPM 2.0 provides the hardware-backed key storage. Correct. Key trust and certificate trust apply only to hybrid deployments that authenticate to on-premises Active Directory. In a cloud-only environment (no on-premises AD), Windows Hello for Business requires no trust type : you deploy WHfB and require TPM 2.0 for hardware-backed credential storage. B. Incorrect. Certificate trust requires an on-premises certificate authority and is a hybrid model. This organization is cloud-only with no on-premises AD or PKI. C. Incorrect. Key trust is a hybrid-only model that requires domain-controller certificates from a PKI, and software-based keystores don't meet the hardware-backed storage requirement. TPM 2.0 must be required.

Q1 - Correct: B. BYOD with Apple User Enrollment for a containerized work environment Correct. Apple User Enrollment creates a mathematically separated volume on the device, allowing Intune to manage corporate apps and data while keeping personal data completely private. The work profile can be removed without affecting personal content. A. Incorrect. Corporate-owned enrollment grants the organization full control over the device, including the ability to wipe all data. This doesn't protect the user's personal data and is inappropriate for personal devices. C. Incorrect. Supervised mode provides the highest level of management control and is intended for corporate-owned devices. It does not protect personal data and is not appropriate for BYOD scenarios.

Q2 - Correct: C. Windows Autopilot with deployment profiles Correct. Windows Autopilot uses device hardware IDs and deployment profiles to enable zero-touch provisioning. Devices automatically receive configuration during the out-of-the-box experience without IT intervention. A. Incorrect. User-driven enrollment via Settings requires manual steps from the user and IT staff. It does not provide zero-touch provisioning during the out-of-the-box experience. B. Incorrect. Group Policy-based enrollment requires devices to be domain-joined and does not enable zero-touch provisioning during initial device setup for cloud-managed scenarios.

Q3 - Correct: B. The device is blocked from enrollment at the policy level Correct. Enrollment restrictions apply before a device becomes managed. Platform version restrictions prevent unsupported devices from ever completing enrollment, acting as a foundational security gate. A. Incorrect. Enrollment restrictions apply before a device becomes managed. The device is blocked from enrolling entirely : it doesn't enroll and then become noncompliant. C. Incorrect. Compliance policies evaluate devices that are already enrolled. Enrollment restrictions prevent devices from enrolling in the first place when they don't meet platform version requirements.

Q4 - Correct: B. Enrollment device limit restriction Correct. Device limit restrictions control how many devices a user can enroll into the organization. These restrictions are part of enrollment restriction policies and apply across all enrollment scenarios regardless of device ownership. A. Incorrect. Conditional Access policies control access to resources based on conditions, not the number of devices a user can enroll into the organization. C. Incorrect. Device Configuration policies configure device settings after enrollment. They do not control the number of devices a user can enroll.

Q5 - Correct: B. Enrollment restrictions are blocking Android devices from enrolling Correct. When a user cannot enroll despite having a valid license and a supported platform, enrollment restrictions blocking that device type are the most common cause. Restrictions are evaluated before enrollment attempts proceed to configuration or compliance checks. A. Incorrect. While device compatibility is worth checking, the scenario states Android Enterprise enrollment is enabled and the user has a valid license. The more likely cause is a policy restriction rather than a platform limitation. C. Incorrect. While hitting a device limit would cause enrollment failure, the scenario doesn't indicate the user has existing enrolled devices. A blanket platform restriction is the more probable cause given no other details are provided.

Q1 - Correct: A. User-driven mode, so each employee completes setup by signing in with their organizational account during OOBE Correct. User-driven mode enables zero-touch provisioning. Devices are shipped directly to users who complete setup by signing in with their work account. The Autopilot service applies the deployment profile automatically during OOBE. B. Incorrect. Self-deploying mode is designed for shared or kiosk devices with no primary user. It requires TPM 2.0 device attestation and isn't appropriate for user-assigned laptops. C. Incorrect. Pre-provisioning reduces user-facing setup time but still requires IT staff to handle each device during the technician phase. The scenario specifies IT shouldn't touch each device.

Q2 - Correct: A. The device hasn't been registered with the Windows Autopilot service Correct. A device must be registered with the Autopilot service before OOBE begins so the service can recognize it and deliver the correct deployment profile. B. Incorrect. Autopilot deployment profiles are assigned to device groups, not user groups. If the device were registered, a default profile or group assignment would still allow profile delivery. C. Incorrect. The ESP tracks app and policy installation progress after profile delivery. It doesn't prevent the profile itself from being received.

Q3 - Correct: A. Whether the Autopilot deployment profile has the pre-provisioning option enabled Correct. Pre-provisioning requires the deployment profile to have the 'Allow pre-provisioning' setting enabled. Without this setting, the technician phase can't complete. This is the most common configuration oversight. B. Incorrect. Pre-provisioning requires TPM 2.0 for device attestation, not version 1.2. However, checking the profile configuration is the first troubleshooting step before investigating hardware. C. Incorrect. The technician phase runs before any user is associated with the device. User licensing doesn't affect the technician phase.

Q4 - Correct: A. Self-deploying mode Correct. Self-deploying mode provisions devices without any user interaction or credentials. It's designed for shared devices, kiosks, and digital signage where no user account is associated with the device. B. Incorrect. User-driven mode requires a user to sign in during OOBE. A shared device policy alone doesn't eliminate the user sign-in requirement during provisioning. C. Incorrect. Pre-provisioning still requires user interaction during the user phase. For fully automated, userless device configuration, self-deploying mode is the correct choice.

Q5 - Correct: A. The device hasn't been added to the dynamic group because group membership evaluation hasn't completed Correct. Dynamic group membership evaluation can take several minutes to hours after registration. If OOBE begins before the device is added to the group, the profile assignment isn't applied. Wait for group membership to sync before powering on the device. B. Incorrect. Windows Autopilot deployment profiles don't have a manual approval step. Once a profile is assigned to a group, it applies automatically to all devices in that group. C. Incorrect. The ESP tracks installation progress during OOBE but doesn't block profile delivery. The issue is that the profile was never assigned because the device wasn't yet a group member when OOBE ran.

Q1 - Correct: A. Device profile Correct. Device profiles apply settings to the device itself, so settings are enforced regardless of which user signs in. Since BitLocker is a device-level security setting, a device profile is the appropriate choice. B. Incorrect. User profiles apply settings based on the signed-in user and follow that user across devices. BitLocker encryption must be applied at the device level and shouldn't vary by user. C. Incorrect. Administrative templates configure specific policy settings (similar to Group Policy), but they don't determine whether settings are scoped to the device or user. For device-level enforcement regardless of user, a device profile is required.

Q2 - Correct: B. User profile Correct. User profiles apply settings based on the user identity and follow the user across multiple devices. This ensures sales representatives receive the same wireless configuration on any device they sign in to. A. Incorrect. Device profiles apply settings to the device regardless of the user. Since the requirement is that the wireless configuration follows the user across multiple devices, a user profile is the correct choice. C. Incorrect. Administrative templates configure specific settings but are typically device-scoped. They don't follow a user across multiple devices the way a user profile does.

Q3 - Correct: B. Device enrollment status and Intune connectivity Correct. Pending status typically means the device hasn't checked in with Intune to receive the profile. Verify that devices are properly enrolled, have network connectivity, and have synced recently. Offline or recently enrolled devices will show pending until the next sync. A. Incorrect. Platform compatibility issues typically result in an 'Error' status, not 'Pending.' Pending status indicates the device hasn't yet communicated with Intune to receive the profile. C. Incorrect. Assignment filter issues would cause the device to be excluded from the assignment entirely rather than show a pending status. Pending means the profile was assigned but not yet received by the device.

Q4 - Correct: A. Devices apply settings from both profiles Correct. Intune supports layering multiple profiles on the same device. Since the two profiles configure different settings (antivirus vs. wireless), there's no conflict and both profiles apply successfully. B. Incorrect. Intune doesn't prioritize profiles based on their content type. Both profiles are applied independently, and security settings don't take precedence over other configuration settings. C. Incorrect. Conflicts only occur when two profiles configure the same setting with different values. Since these profiles target different settings entirely, both apply without conflict.

Q5 - Correct: B. Group Policy analytics Correct. Group Policy analytics analyzes imported on-premises GPO settings and reports which ones are supported in Intune's cloud-based policies. This is essential for planning a GPO migration and identifying settings that require alternative approaches. A. Incorrect. The settings catalog lets you browse and configure available Intune settings, but it doesn't analyze your existing on-premises GPOs or identify which settings can be migrated. C. Incorrect. Device restriction templates configure specific device settings but don't analyze or evaluate existing Group Policy objects. They're a destination for some migrated settings, not a migration analysis tool.

Q1 - Correct: B. Endpoint Analytics Correct. Endpoint Analytics collects device telemetry and surfaces startup performance scores, boot time breakdowns, and app reliability data. It helps you identify which devices are affected and what factors (such as driver delays or startup apps) are contributing to slow startup. A. Incorrect. Compliance reports show whether devices meet policy requirements such as OS version or encryption. They don't provide startup performance data or help identify the root cause of slow boot times. C. Incorrect. Remediations are used to detect and fix known issues after they're identified. Endpoint Analytics is the right tool to first discover and understand the scope and cause of the startup performance problem.

Q2 - Correct: B. Two or more assigned profiles are configuring the same setting with different values Correct. A Conflict status means the device received multiple policies that configure the same setting with different values. Intune cannot reconcile the contradiction, so neither value is applied. You need to review overlapping profile assignments and resolve the conflicting settings. A. Incorrect. Devices that haven't synced would show a 'Pending' status, not 'Conflict'. Conflict indicates the device has received the policy but there's a contradiction in the applied settings. C. Incorrect. A platform mismatch typically results in the profile not being applicable to the device at all, rather than a Conflict status. Conflict specifically indicates competing settings from multiple applied policies.

Q3 - Correct: C. Remediations Correct. Remediations deploy a detection script to check device state and a remediation script to fix the issue when it's detected. This is the right tool for automatically correcting recurring configuration drift, such as a disabled Defender scan, without requiring user or admin intervention. A. Incorrect. Endpoint Analytics is a monitoring and insights tool. It can help you identify that a problem exists and measure its scope, but it doesn't execute detection or remediation scripts on devices. B. Incorrect. Compliance policies assess device state and can mark non-compliant devices or trigger Conditional Access. They don't run scripts to detect and automatically correct specific configuration issues like a disabled scan schedule.

Q4 - Correct: B. Devices > All devices → choose columns/filters → Export to CSV Correct. The Intune admin center doesn't provide a dedicated 'Device inventory' report under Reports. To produce an inventory-style export with device name, OS version, OS build, compliance state, and last check-in, open Devices > All devices, choose the columns and filters you need, and export the list to CSV. A. Incorrect. Devices > Monitor > Device compliance shows compliance state, not a full enrolled-device inventory with OS and check-in details. C. Incorrect. Endpoint Analytics provides performance and health scores, not an inventory list suitable for audit purposes.

Q5 - Correct: B. Use PowerShell with the Microsoft Graph API to query noncompliant devices and send a daily email Correct. PowerShell combined with the Microsoft Graph API can query the Intune device compliance endpoint, filter for noncompliant devices, format the results, and send an automated email : making the process repeatable, consistent, and free from manual portal work. A. Incorrect. Compliance policy notifications send alerts per device as noncompliance is detected, but they don't produce a consolidated daily list. The security team would receive individual alerts rather than a single daily report. C. Incorrect. Remediations run detection and remediation scripts on individual devices, not across the organization to aggregate compliance data. They aren't designed to query tenant-wide device state and generate reports.

Q1 - Correct: B. Finance: 90-day feature deferral; Marketing: 30-day deferral; Executives: 7-day security deferral with Hotpatch enabled, feature updates deferred Correct. This configuration addresses each group's specific needs: Finance gets lengthy deferral for legacy software compatibility, Marketing gets faster updates for feature adoption, and Executives get rapid security patching via Hotpatch while feature updates are deferred. A. Incorrect. A single ring with one deferral period cannot address the distinct requirements of Finance (long testing), Marketing (rapid features), and Executives (fast security, deferred features). You need separate rings with tailored deferral settings. C. Incorrect. A uniform 30-day deferral doesn't address Finance's need for extended testing, Marketing's need for faster access, or Executives' need for rapid security patches with deferred features.

Q2 - Correct: B. 450 devices Correct. Hotpatch requires Windows 11 Enterprise (met), a modern processor (met for all 500), Secure Boot enabled (met), and VBS enabled. The 50 devices with VBS disabled do not meet requirements, leaving 450 eligible devices. A. Incorrect. Not all 500 devices qualify. Hotpatch requires VBS to be enabled, and 50 devices have VBS disabled, making them ineligible. C. Incorrect. Most devices meet the Hotpatch prerequisites. Only the 50 devices with VBS disabled are ineligible : the remaining 450 qualify.

Q3 - Correct: B. Insufficient storage : guide users to free disk space to at least 10 GB Correct. Feature updates require 10-15 GB of free disk space, and 2 GB is far below that threshold. Freeing sufficient space resolves the issue for the affected devices. A. Incorrect. Network connectivity issues would affect devices more broadly and intermittently. The consistent pattern of the same 20 devices failing with low disk space points to a storage issue rather than a network issue. C. Incorrect. BIOS incompatibility issues typically produce different error codes and wouldn't consistently align with devices that have low disk space. The storage shortage is the clear root cause here.

Q4 - Correct: A. Manufacturing: LTSC; Standard: Current Channel; Research: Windows Insider (Preview) Channel Correct. LTSC gives manufacturing systems long-term stability with infrequent feature updates. Current Channel suits standard devices with regular feature releases. The Preview Channel gives the research team early access to new Windows features and APIs. B. Incorrect. LTSC is intended for devices that require minimal change, not general business use. Using LTSC for standard and research devices would prevent regular feature updates and deny the research team access to cutting-edge Windows capabilities. C. Incorrect. While manufacturing correctly uses LTSC, assigning the research department to Current Channel denies them early access to preview features. The research team's requirement specifically calls for the Preview Channel.

Q5 - Correct: C. Reset Correct. Reset removes all data including financial information, returns the device to a factory state, and prepares it for fresh enrollment and configuration. This is the most secure and appropriate lifecycle action for redeploying a device to a new employee. A. Incorrect. Retire removes company data and configuration but leaves personal data intact and doesn't fully prepare the device for a new user. It's intended for devices being decommissioned, not for redeployment. B. Incorrect. Wipe removes company-managed data but retains some personal data depending on configuration. For a complete, secure reset that fully prepares the device for a new employee, Reset is the appropriate action.

Q1 - Correct: A. Whether an Intune license is assigned to the user's account Correct. Microsoft Entra ID authentication can succeed even when the user has no Intune license. Without a license, enrollment finishes the sign-in but fails to register the device in Intune. B. Incorrect. Secure Boot affects compliance policy evaluation but isn't a prerequisite for enrollment. A device can enroll in Intune without Secure Boot enabled: it would simply be marked noncompliant if a policy requires it. C. Incorrect. Autopilot uses preconfigured service discovery and doesn't rely on DNS-based MDM enrollment URLs. A failed license assignment is a far more common cause of enrollment not appearing in the admin center.

Q2 - Correct: B. Two or more configuration profiles assigned to the device configure the same VPN setting with different values Correct. A Conflict status means multiple applicable profiles are attempting to set the same setting to different values and Intune can't determine which takes precedence. Review all profiles assigned to the affected device groups and remove or consolidate the conflicting settings. A. Incorrect. Platform incompatibility would cause the profile to show as 'Not applicable' for the device rather than 'Conflict.' Conflict specifically means the device received multiple policies that configure the same setting with contradictory values. C. Incorrect. A device that hasn't synced would show a 'Pending' status, not 'Conflict.' Conflict is reported after the device has received and evaluated the assigned policies.

Q3 - Correct: B. A Conditional Access policy is requiring device compliance as a condition for accessing Exchange Online Correct. When a Conditional Access policy requires compliant devices for accessing Exchange Online, any device marked noncompliant in Intune is blocked from that resource. The user needs to resolve the noncompliance issue (such as setting a PIN or enabling encryption) to regain access. A. Incorrect. An expired license would prevent device management and check-ins, but it's not the mechanism that blocks resource access. The described scenario: noncompliant device blocked from email: is a Conditional Access enforcement pattern. C. Incorrect. MDM enrollment tokens don't work this way for personal device scenarios. The device shows as enrolled and noncompliant: the access block is from Conditional Access evaluating the compliance state, not an enrollment issue.

Q4 - Correct: B. The Intune Troubleshooting blade (Troubleshooting + support > Troubleshoot) Correct. The Troubleshooting blade lets you search for a specific user and see all their enrolled devices, assigned policies, app assignments, and evaluation results in one place. It's the fastest way to identify why a specific user or device isn't receiving an expected assignment. A. Incorrect. Endpoint Analytics provides performance and health metrics across the device fleet. It doesn't show per-user policy evaluation results or app assignment details for troubleshooting a specific user's issue. C. Incorrect. The Device compliance monitor shows compliance state across devices but doesn't provide per-user app assignment details or policy evaluation results. The Troubleshooting blade is purpose-built for this type of user-specific investigation.

Q5 - Correct: B. Deploy a Remediation script package that detects when the Windows Time service is disabled and automatically restarts and re-enables it Correct. A Remediation script package pairs a detection script that checks device state with a remediation script that fixes the issue. On a scheduled cadence, the package restores the Windows Time service whenever it's disabled, with no manual intervention. A. Incorrect. A compliance policy would flag the affected devices as noncompliant and potentially block access, but it doesn't fix the underlying issue. The service would remain disabled until an admin manually re-enables it on each device. C. Incorrect. Device restriction profiles can limit user actions but aren't well-suited to monitoring and correcting specific service states after the fact. A Remediation script is the right tool for detecting and fixing a recurring configuration drift issue.

Q1 - Correct: B. Create a Required assignment for the Sales group and an Available for enrolled devices assignment for the Marketing group. Correct. Required forces the install for Sales, while Available makes the same app visible in the Company Portal so Marketing users can install it on demand. A. A Required assignment installs the app automatically for everyone in the targeted groups, which doesn't give Marketing the option to skip it. C. Uninstall would actively remove the app from Marketing devices. Marketing users should be able to install it themselves, not have it removed.

Q2 - Correct: B. .intunewin Correct. The Microsoft Win32 Content Prep Tool wraps your installer and supporting files into an .intunewin package, which is the format Intune requires for Win32 app deployments. A. .appx is the format for modern Windows Store apps, not Win32 packages prepared for Intune. C. .msi is a standard Windows installer format, but Intune doesn't deploy raw .msi files for Win32 apps. You must first wrap the .msi in an .intunewin package.

Q3 - Correct: B. Open the Troubleshoot + support pane, search for the user, select the device, and review the Applications section. Correct. The Troubleshoot + support pane in the Intune admin center lets you drill into a specific user and device, identify failed apps, and trigger a sync or collect diagnostics : all without local device access. A. The Microsoft Defender portal surfaces security events, not Intune app installation diagnostics. C. Microsoft Entra sign-in logs show authentication events, not app installation results.

Q4 - Correct: B. The detection rule doesn't match what the installer actually placed on the device. Correct. Intune relies on the detection rule (file, registry, or MSI product code) to confirm a successful install. If the rule references the wrong path, key, or version, Intune reports Failed even when the installer succeeded. A. A user-initiated uninstall would normally be reflected after the next device check-in as a removal, not as an installation failure on a successful install. C. An offline device would report a Pending status, not Failed.

Q5 - Correct: C. Assign the app to a broad device group and use an assignment filter for device ownership = Corporate and OS version = Windows 11. Correct. Assignment filters let you refine targeting based on device properties without creating and maintaining many separate Microsoft Entra groups. A. Static groups require ongoing manual maintenance as devices are added or replaced and don't scale well. B. Over-targeting installs the app on devices that shouldn't have it, which violates the requirement to target only kiosks.

Q1 - Correct: B. Deploy Mobile Application Management (MAM) without enrollment by assigning an App Protection Policy to the user's corporate identity. MAM Without Enrollment (MAM-WE) applies App Protection Policies to the corporate identity inside supported apps without enrolling or managing the personal device. A. Full MDM enrollment gives IT control over the entire personal device, which is exactly what Contoso wants to avoid in a BYOD scenario. C. Blocking access prevents employees from working from their personal devices and doesn't meet the requirement to allow access in a controlled way.

Q2 - Correct: C. Set **Restrict cut, copy, and paste between other apps** to **Policy managed apps with paste in**. This setting allows data to be pasted *into* managed apps from any source while preventing corporate data from being copied *out* to unmanaged apps. A. Allowing any app removes the protection boundary and lets users paste corporate data into personal apps. B. Blocking all cut, copy, and paste hurts the user experience and prevents the desired inbound paste from personal apps.

Q3 - Correct: A. Because App Protection Policies target the corporate identity inside supported apps, not the physical device. APP travels with the user's Microsoft Entra ID account and is evaluated when the user signs into a supported app, so user group assignment is required. B. Device groups exist in Intune and are commonly used for other policy types, such as device configuration profiles. C. Speed isn't the reason. The assignment requirement is driven by how App Protection Policies evaluate user identity at app sign-in.

Q4 - Correct: B. Create a Microsoft Entra Conditional Access policy that requires an app protection policy for Exchange Online. Conditional Access enforces APP at sign-in by blocking native, unmanaged apps and requiring a supported, policy-managed client like Outlook. A. App PIN settings only affect managed apps. They have no effect on the native iOS Mail client. C. Offline grace periods only affect managed apps after they go offline; they don't prevent users from using native unmanaged apps.

Q5 - Correct: A. That the user is signing in with their corporate Microsoft Entra ID account, not a personal account. App Protection Policies only activate when the user signs in with the corporate identity targeted by the policy; personal accounts in the same app are ignored. B. MDM enrollment isn't required for App Protection Policies; MAM Without Enrollment is supported for BYOD scenarios. C. App Protection Policies must be assigned to user groups, not device groups, so a device group assignment wouldn't apply the policy.

Q1 - Correct: A. The new package has the same version number as the package already stored in Intune. For line-of-business apps, Intune extracts the version from each package and rejects updates when the version matches the version already stored, so the package must be genuinely newer. B. Line-of-business apps are updated by uploading a newer package, not through the Enterprise App Catalog. C. Required line-of-business apps continue to receive updates when a genuinely newer package is uploaded; the rejection is caused by a duplicate version.

Q2 - Correct: A. An app protection policy that includes data protection settings. App protection policies apply at the app layer, work on unenrolled devices, and include data protection settings that restrict actions such as copy and paste between managed and personal apps. B. Device compliance policies require device enrollment and don't control in-app data movement. C. Managed devices app configuration policies require enrollment and configure app settings, not data protection actions like copy and paste.

Q3 - Correct: A. Apply an assignment filter for managed devices when assigning the app to the group. Assignment filters refine a group's target by device properties such as OS version, manufacturer, or enrollment profile without creating new groups. B. Creating a group per OS version is hard to maintain; filters are designed exactly for this scenario. C. Changing the intent to Available doesn't restrict the assignment to a specific OS version and shifts the decision to users.

Q4 - Correct: A. App protection status under Apps > Monitor to see whether the required app protection policy is applied. App deployment and app protection are separate; an app can be Installed but still blocked from corporate data when the required app protection policy isn't applied. B. Discovered apps is an inventory report; it doesn't explain protection-related blocks on corporate data access. C. Application reliability tracks crashes and performance for desktop apps, not mobile app protection enforcement.

Q5 - Correct: A. Supersedence between the older and newer Win32 apps. Win32 supersedence lets a newer Win32 app update or replace an older Win32 app, which is the supported path for this exact scenario. B. An Available assignment doesn't replace the older app or move installed devices to the new version. C. Group assignment alone doesn't establish the relationship needed to update or replace the older app.

Q1 - Correct: B. Application Reliability report Correct. The Application Reliability report ranks applications by crash count and crash rate across your device fleet, letting you quickly see whether Teams is a top contributor and how many devices it affects. A. Startup Performance measures how long apps add to device boot time, not how often they crash during use. C. App Install Status focuses on whether apps installed successfully, not on runtime stability or crashes.

Q2 - Correct: C. Organizational Correct. Organizational reports provide broader summaries intended for managers and planners, which is the right fit for a monthly executive view of overall deployment success. A. Operational reports surface timely, targeted data for immediate action : like investigating an active failure : not high-level summaries for leadership. B. Specialist reports are custom analyses built on raw data exports, typically used for ad-hoc investigations rather than monthly executive summaries.

Q3 - Correct: B. The Connected User Experiences and Telemetry service must be enabled and running on each device. Correct. If the Connected User Experiences and Telemetry service is disabled by policy, devices can't upload telemetry and won't appear in Endpoint Analytics reports. A. Endpoint Analytics doesn't depend on Defender for Endpoint Plan 2. The basic Application Reliability and Startup Performance reports are included with standard Microsoft Intune licensing. C. Co-management is supported but not required. Intune-enrolled Windows devices on supported editions can contribute telemetry on their own.

Q4 - Correct: A. Configure diagnostic settings to send Intune data to an Azure Monitor Log Analytics workspace and query with KQL. Correct. Sending Intune diagnostic data to a Log Analytics workspace lets you write Kusto queries that join app failure data with sign-in logs and other Azure sources to surface correlations the built-in reports can't show. B. Manual CSV joins don't scale, aren't repeatable, and can't easily incorporate live sign-in or network telemetry. Azure Monitor is the supported integration point. C. Endpoint Analytics anomaly detection (Intune Suite / Plan 2) surfaces device-experience anomalies but doesn't join Intune data with arbitrary Azure log sources.

Q5 - Correct: B. Reconfigure the application so it doesn't auto-launch at startup, and validate the boot-time improvement in Endpoint Analytics afterward. Correct. Removing unnecessary startup loading immediately reduces boot time across all affected devices. Re-checking Endpoint Analytics afterward confirms the improvement and proves the value of the change to stakeholders. A. Hardware refresh is expensive and unnecessary when the root cause is an avoidable startup load, not insufficient device capability. C. Disabling telemetry only hides the metric : it doesn't fix the underlying performance impact users experience.

Q1 - Correct: A. It provides prepackaged Win32 apps with preconfigured install and uninstall commands, detection rules, and requirements, so administrators don't have to build each package from scratch. Correct. The Enterprise App Catalog ships ready-to-deploy Win32 app packages where Intune prepopulates install/uninstall commands, restart behavior, detection rules, and requirements. That removes most of the manual packaging effort and accelerates app onboarding for common business applications. B. Incorrect. Catalog apps are still assigned through Intune using existing user or device groups (typically Microsoft Entra ID groups). The catalog reduces packaging effort : it doesn't change how assignments are scoped. C. Incorrect. Enterprise App Catalog apps are prepackaged Win32 applications targeted at managed Windows devices. They aren't a cross-platform deployment mechanism for Linux or macOS.

Q2 - Correct: A. Install and uninstall commands, restart behavior, detection rules, and requirements such as supported OS version and architecture. Correct. The catalog package supplies the deployment metadata Intune needs to install and verify a Win32 app : install/uninstall commands, restart behavior, detection rules, and requirement rules. You can still override these defaults when your environment needs it. B. Incorrect. Compliance policies, disk encryption, and Conditional Access are configured separately in Intune and Microsoft Entra ID. The catalog package only prepopulates the app's deployment settings, not tenant-wide security policies. C. Incorrect. Company Portal branding and support contact information are tenant-level Intune settings, not values supplied by an individual catalog app package. The catalog focuses on the technical deployment configuration.

Q3 - Correct: A. Open the app from the Enterprise App Catalog apps with updates view and use the guided update flow, which creates a new app with the latest package and configures a supersedence relationship with the existing app. Correct. For non-self-updating catalog apps, Intune surfaces available updates in the admin center and provides a guided flow that creates a new superseding app. This lets you track and assign the new version cleanly while replacing the older one through supersedence. B. Incorrect. Enterprise App Catalog apps aren't automatically updated just because a newer version appears in the catalog. An administrator must initiate the update : typically by creating a superseding app : except for self-updating apps where the vendor's own mechanism delivers the new version. C. Incorrect. Relying on end users to uninstall and reinstall apps is error-prone, inconsistent, and bypasses Intune's tracking. Supersedence is the supported way to transition devices to a newer catalog app version.

Q1 - Correct: B. Create an Endpoint detection and response policy in Intune for the Windows platform and set the client configuration package type to Auto from connector. An EDR policy with Auto from connector uses the active Intune-to-Defender service connection to retrieve and deploy the current onboarding package to Windows devices. A. Manual onboarding packages are intended for environments where automatic retrieval isn't available; with the service connection enabled, an EDR policy can retrieve the package automatically. C. Antivirus policies configure Defender Antivirus settings; they don't onboard devices to Defender. Onboarding requires an EDR policy or onboarding package.

Q2 - Correct: C. In the Microsoft Intune admin center on the policy status pages, which report policy conflicts when different policies apply different values for the same setting. Intune reports profile status, device status, and policy conflicts on the policy status pages when security baselines and endpoint security policies disagree on the same setting. A. The Defender portal Advanced features page configures tenant-level Defender capabilities and doesn't show Intune policy conflicts. B. The local Windows Security app shows the effective state of the device but doesn't surface Intune policy conflicts between baselines and endpoint security policies.

Q3 - Correct: A. The incident's correlated alerts, affected assets, evidence, and attack story view. The incident view in the Microsoft Defender portal correlates alerts, affected assets, evidence, and the attack story so analysts can quickly answer triage questions about scope, impact, and activity. B. Antivirus exclusions show what Defender Antivirus skips during scans and don't describe the scope or activity of an active incident. C. The EDR Onboarding Status tab tracks whether devices are onboarded to Defender, not the details of an active incident.

Q4 - Correct: A. Endpoint security > Attack surface reduction, with Microsoft Defender Antivirus as the primary antivirus on Windows devices. Attack surface reduction rules are deployed from the Endpoint security > Attack surface reduction node and require Windows devices that use Microsoft Defender Antivirus as the primary antivirus. B. Attack surface reduction rules are configured through the Endpoint security node in Intune, not administrative templates, and don't require an on-premises domain join. C. Firewall policies don't configure attack surface reduction rules, and a third-party primary antivirus prevents attack surface reduction from operating fully.

Q5 - Correct: C. Assign an owner, add tags such as Privileged user and Needs escalation, summarize triage findings in comments, and notify the appropriate response team. The recommended escalation workflow is to assign an owner, tag the incident, summarize findings, update status, and notify the responsible team so the next responder has full context. A. High-severity activity involving privileged accounts and lateral movement should never be closed as informational without investigation; it warrants escalation. B. Destructive actions before triage can disrupt the business and destroy investigative evidence; triage and containment come before broad remediation.

Q1 - Correct: A. Endpoint security disk encryption policy that uses TPM-only startup authentication and stores recovery keys in Microsoft Entra ID. Correct. TPM-only startup authentication supports silent encryption because the user isn't prompted at boot, and storing keys in Microsoft Entra ID gives administrators a recoverable path before encryption begins. B. TPM plus PIN forces user interaction at every startup, which conflicts with a silent enablement goal even if it does increase startup protection. C. Disabling escrow leaves the organization without a managed recovery path and isn't required (or recommended) for silent encryption.

Q2 - Correct: B. Trigger the BitLocker key rotation remote action on the device in Intune. Correct. Rotating the recovery password after disclosure ensures the value the technician just read can't be reused to unlock the device, and the new key is escrowed back to Microsoft Entra ID. A. Deleting the device record removes management and inventory data : it doesn't rotate or invalidate the BitLocker recovery password and creates many other problems. C. Emailing the recovery password broadens disclosure and creates a persistent copy outside the managed key store : the opposite of what should happen after a recovery event.

Q3 - Correct: C. Assign a built-in helpdesk role (or a custom role that grants only the BitLocker key read permission) scoped to the devices the team supports. Correct. Built-in helpdesk roles or a custom role with just `microsoft.directory/bitlockerKeys/key/read` grant only what's needed, preserve individual audit trails, and can be scoped to a specific device set. A. Global Administrator grants far more access than is needed to read recovery keys and violates least-privilege guidance. B. Shared credentials defeat auditing : every key read should be traceable to an individual administrator.

Q4 - Correct: B. First query `DeviceTvmSecureConfigurationAssessmentKB` for BitLocker/Encryption-related configurations, then join those IDs to `DeviceTvmSecureConfigurationAssessment` filtered to `IsApplicable == true`, and prioritize by `ConfigurationImpact` and compliance. Correct. The two-step pattern discovers current encryption-related configurations from the knowledge base and joins them to per-device assessment results, producing a risk-prioritized view that survives configuration changes. A. Hard-coded IDs break when configuration identifiers change or new encryption controls are added. The recommended pattern discovers IDs from the knowledge base first. C. The Intune encryption report validates policy assignment and BitLocker state, but it doesn't replace the security-operations hunting view in Microsoft Defender that surfaces failed controls and stale telemetry.

Q5 - Correct: B. Save BitLocker recovery information to Microsoft Entra ID and require that recovery information is stored before BitLocker starts. Correct. Combining recovery information escrow to Microsoft Entra ID with the requirement that storage succeeds before encryption begins guarantees a recoverable key exists in the tenant the moment encryption starts. A. Disabling escrow removes the recovery path entirely : devices might encrypt, but you'd have no managed key if recovery is needed. C. Startup authentication protects the boot path but doesn't store a recoverable key. A PIN that only the user knows isn't a managed recovery method.

Q1 - Correct: B. Configure the ASR rule in Audit mode for a pilot group and review reported events before enforcing it. Audit mode shows what the rule would block without affecting users, so admins can identify needed exclusions before moving to Block. A. Starting in Block mode risks disrupting line-of-business apps before impact is known. C. Broad exclusions and immediate Block mode bypass the recommended pilot-and-audit deployment pattern.

Q2 - Correct: B. Defender's endpoint integration for cloud discovery. Defender's endpoint integration discovers cloud app usage directly from managed endpoints, including remote devices not behind the corporate network. A. Snapshot reports give a point-in-time view from logs you upload manually : they don't cover remote endpoints continuously. C. An on-premises SWG only sees traffic that traverses it, missing remote users.

Q3 - Correct: A. A proactive remediation script package with detection and remediation scripts. Proactive remediations run a detection script on a schedule and run the remediation script automatically when the detection finds the issue. B. ASR rules block behaviors associated with attacks; they don't detect or fix arbitrary registry values. C. Compliance policies report on state but don't change device configuration to remediate the issue.

Q1 - Correct: A. A device configuration profile (or Endpoint Security disk encryption policy) that actively configures BitLocker on the device. Compliance policies only verify state. A configuration profile or Endpoint Security disk encryption policy is required to actively enforce BitLocker so the device can self-heal back into compliance. B. Adding another compliance policy still only checks state: it never configures BitLocker on the device, so the noncompliance persists. C. Conditional Access enforces *access* based on compliance status, but it doesn't configure BitLocker or remediate the underlying setting.

Q2 - Correct: A. An assignment filter that evaluates device properties (such as device name or OS) at assignment time. Assignment filters let you include or exclude devices based on properties like device name, OS version, or manufacturer without creating additional Microsoft Entra groups. B. Dynamic groups can work, but the scenario explicitly asks to avoid creating a new group; assignment filters address this exact use case. C. Scope tags control which Intune admins can see or edit a policy; they don't change which devices the policy targets.

Q3 - Correct: A. The device is reported as **In grace period**, which is still a noncompliant state, and standard Conditional Access policies requiring compliance will block access by default. Grace period is technically a noncompliant state. Unless a Conditional Access policy explicitly allows the **Require device to be in grace period** control, access is blocked. B. Intune never falsely reports a device as Compliant during a grace period: the device is still considered noncompliant. C. Retire is a separate, manually configured action and isn't triggered by a standard grace-period schedule.

Q4 - Correct: A. Intune Remediations using a detection script and a remediation PowerShell script. Intune Remediations (formerly Proactive Remediations) run detection and remediation scripts on a schedule, making them ideal for custom, scripted fixes such as missing registry keys. B. A compliance policy can only check state: it can't create the missing registry key. C. Conditional Access controls access to resources; it doesn't modify the device or fix missing registry keys.

Q5 - Correct: A. Generate and export compliance reports from Reports > Device compliance in the Microsoft Intune admin center. The compliance monitoring dashboards and exportable reports provide tenant-wide point-in-time evidence of device health, suitable for audit packages. B. Per-device browsing doesn't scale, isn't exportable, and typically violates least-privilege auditing practices. C. Microsoft Entra sign-in logs show authentication events, not the configured state of BitLocker or Defender on each device.

Q1 - Correct: B. The Subject Alternative Name (SAN) must include the IP address or FQDN that devices use to reach the server. Correct. The certificate copied to `/etc/mstunnel/private/site.pfx` (or the matching PEM files) must include the public IP or FQDN devices connect to in its SAN, or the TLS handshake fails. A. Self-signed certificates aren't supported for Tunnel server identity. The server presents a TLS certificate that clients validate, so it needs a chain devices trust. C. Any certificate from a CA the connecting devices trust is acceptable : there's no requirement that it comes from a Microsoft-issued CA.

Q2 - Correct: B. An Intune Plan 2 license (or Intune Suite add-on) covering the users, plus app configuration and app protection policies on Edge that enable Tunnel on app launch. Correct. Tunnel for MAM is licensed under Intune Plan 2 / Intune Suite, and on Android it requires the Microsoft Defender app configuration policy, the Edge app config policy with the StrictTunnelMode and TunnelAvailable keys, and an Edge app protection policy that starts the Tunnel connection on app launch. A. Tunnel for MAM is specifically for unenrolled devices : that's the scenario it solves. Requiring enrollment would defeat the purpose. C. Tunnel authenticates users through Microsoft Entra ID : SSH isn't part of the connection flow on client devices.

Q3 - Correct: B. Per-app VPN only, scoped to the LOB app (and other apps such as Edge) that integrate the Tunnel for MAM iOS SDK. Correct. On iOS, Tunnel for MAM is per-app only. The VPN applies to apps that integrate the SDK and have the right app configuration / app protection policies assigned. A. Tunnel for MAM on iOS doesn't support device-wide VPN : coverage is limited to apps that integrate the Tunnel for MAM iOS SDK. C. Always-on VPN requires device enrollment and isn't part of the MAM-only Tunnel experience on iOS.

Q4 - Correct: B. Reinstall Microsoft Tunnel (`sudo mst-cli uninstall` followed by `sudo ./mstunnel-setup`) so the agent re-registers with Intune. Correct. The known cause is that the Tunnel agent lost its enrollment registration with Intune while the server component kept working. Reinstalling re-enrolls the agent and restores the admin center health view. A. Restarting the server doesn't re-enroll the Tunnel agent with Intune, which is the root cause when the server reports healthy locally but Intune shows it offline. C. Deleting the site impacts every device assigned to it and doesn't fix an agent registration problem on a single server.

Q5 - Correct: B. In the server configuration, enable the **Disable UDP connections** option (supported when devices use the Microsoft Defender Tunnel client). Correct. The server configuration includes a **Disable UDP connections** toggle intended for TCP-only environments where the Microsoft Defender Tunnel client is used. A. Stopping the agent breaks management and reporting for the Tunnel server : it isn't how you switch the client transport to TCP-only. C. Split tunneling routes traffic by destination, not by transport protocol. Also, `0.0.0.0` isn't supported in split-tunneling rules.

Q1 - Correct: B. 6 Correct. Microsoft Cloud PKI allows a maximum of six CAs per Intune tenant, counting root CAs, issuing CAs, and Bring Your Own CA (BYOCA) instances combined. A. Incorrect. The tenant limit is higher than two. Cloud PKI allows up to six CAs across root, issuing, and Bring Your Own CA (BYOCA) instances combined. C. Incorrect. Ten exceeds the tenant limit. Cloud PKI caps the total CA count at six per Intune tenant.

Q2 - Correct: B. The trusted certificate profiles for the root CA and issuing CA weren't deployed before the SCEP profile. Correct. Devices must receive and install the trust chain before the SCEP profile arrives. If the SCEP profile is delivered first, the device has no basis to trust the issued certificate and will reject it. Always deploy trusted certificate profiles before deploying SCEP profiles. A. Incorrect. Validity period doesn't determine whether a device accepts a certificate. The issue is almost always that the device doesn't yet trust the CA chain. C. Incorrect. The renewal threshold only affects when renewal triggers : it doesn't affect initial issuance or whether the device accepts the certificate.

Q3 - Correct: B. On the device itself; it never leaves the device Correct. A fundamental security property of SCEP enrollment is that the device generates the private key locally and submits only the public key in the certificate signing request (CSR). The private key is never transmitted to any server. A. Incorrect. The SCEP service receives the certificate signing request (CSR) and the public key, but never the private key. The private key is generated and stays on the device. C. Incorrect. The issuing CA only signs the public key contained in the CSR : it never generates or holds the device's private key.

Q4 - Correct: B. Increase the renewal threshold to 40% and shorten the validity period to 180 days to extend the renewal window. Correct. For devices that check in infrequently, a higher renewal threshold combined with a shorter validity period creates a longer absolute renewal window. For example, a 40% threshold on a 180-day certificate starts renewal 72 days before expiry: giving the device more time to connect and renew before the certificate expires. A. Incorrect. Longer validity weakens security and doesn't fix the underlying problem : devices still won't renew if they're offline when the renewal threshold triggers. C. Incorrect. Manual revocation and reissue doesn't scale and defeats the automation Cloud PKI is designed to provide. Tune the validity and renewal threshold so devices renew automatically.

Q5 - Correct: B. `certmgr.msc` or `certutil -store My` run on the device Correct. Certificate Manager (`certmgr.msc`) and the `certutil -store My` command-line tool run locally on the Windows device and show the actual certificate, including its subject, SAN values, and issuer chain. A. Incorrect. The dashboard shows certificate metadata reported by Intune, but you can't inspect the full certificate (subject, SAN, issuer chain) from the admin center. C. Incorrect. Sign-in logs surface authentication outcomes : they don't show certificate subject or SAN content on the device.

Q1 - Correct: A. App-only access with application permissions (for example, `DeviceManagementManagedDevices.Read.All`). Correct. Unattended automation should use app-only access with application permissions so the service can run without a signed-in user. Application permissions are the supported pattern for app-only Intune Graph access. B. Delegated permissions require an interactive user sign-in, which doesn't fit unattended automation in an Azure Function. C. Microsoft Graph never permits anonymous access to Intune data. Every call must be authenticated.

Q2 - Correct: B. A managed identity (when the hosting service supports it) : no app secret has to be stored or rotated. Correct. For Azure Functions, Azure Automation, and similar Azure-hosted workloads, a managed identity is the recommended option because there's no secret to store, leak, or rotate. A. Long-lived client secrets stored in code or plain environment variables are the weakest option : they expire silently and risk being leaked. Use a managed identity, federated credentials, or a certificate from Key Vault. C. Embedding any user's credentials in a script is a serious security anti-pattern and isn't compatible with app-only Graph automation.

Q3 - Correct: B. Only when the script content changes or the assignment changes : scripts run once by default and don't rerun automatically otherwise. Correct. Intune PowerShell scripts run once by default. The IME reruns them only when the script content is updated or the assignment changes. The IME does retry failed runs up to three times. A. The IME checks for new or changed scripts every hour, but a successfully run script doesn't rerun on the same schedule. C. Script execution isn't tied to user sign-in events for already-successful scripts.

Q4 - Correct: B. `/deviceManagement/configurationPolicies` : the endpoint for Settings Catalog policies. Correct. Settings Catalog policies are managed via `deviceManagement/configurationPolicies`. The legacy `deviceConfigurations` endpoint is reserved for template-based profiles. A. `deviceManagement/deviceConfigurations` is the legacy template-based endpoint. It should be used only to manage existing legacy profiles, not for new Settings Catalog policies. C. `managedDevices` exposes device inventory and per-device operations, not policy definitions.

Q5 - Correct: B. `GET /deviceManagement/managedDevices?$filter=complianceState ne 'compliant'` Correct. Filtering `managedDevices` with `complianceState ne 'compliant'` returns the set of noncompliant devices directly from Graph, which is the most efficient way to drive a remediation workflow. A. Listing compliance policies doesn't tell you which devices are noncompliant : that's per-device state, not policy definitions. C. User license lookup doesn't return device compliance state : Intune compliance lives on the device object, not on the user object.

Q1 - Correct: B. Generate an incident summary that organizes the attack overview, timeline, affected assets, and recommended actions, then ask follow-up questions to scope the investigation. Security Copilot's incident summary gives analysts a faster starting point by consolidating the key incident details, and natural-language follow-up questions help narrow the investigation without switching between every alert and entity page. A. Guided response recommendations are investigation guidance. High-impact actions such as isolating production devices should be validated in Defender and follow the organization's incident response process before execution. C. Copilot is designed to accelerate investigation, not replace analyst judgment. Analysts use Copilot output as investigation support and then validate important findings before taking high-impact response actions.

Q2 - Correct: A. Use Copilot to compare the two devices and identify differences in group membership, assigned policies, filters, and device attributes. Device comparison in Copilot for Intune highlights similarities and differences across hardware, compliance, assignments, and group membership, which helps move from "this device is broken" to a concrete list of differences to investigate. B. Copilot doesn't make broad assignment changes on its own, and reassigning a profile to every device would bypass targeting, filters, and pilot testing rather than diagnose the actual cause. C. Promptbooks are repeatable security investigation workflows. A VPN assignment issue is an Intune configuration troubleshooting task, not a security incident.

Q3 - Correct: C. It gives both teams a shared view of device state and risk so operations can focus on reliability and policy health while security focuses on high-risk threats and incident response. Shared context such as device state, compliance posture, and recommendation history helps security and operations teams coordinate without conflicting priorities. A. AI doesn't shift accountability for security incidents to operations. Security teams still own high-risk threats and incident response. B. AI reduces routine sorting and analysis but doesn't eliminate manual investigation. Administrators still validate findings and handle exceptions.

Q4 - Correct: B. Treat the repeated alerts as a signal that an Intune policy or security control might need to change, and use device entity insights and advanced hunting to confirm the scope before adjusting policy. Defender insights guide endpoint decisions. Repeated alerts across the same device group often point to a missing or weak control that should be addressed through Intune policy after the scope is confirmed. A. Compliance state alone doesn't reflect active risk. A device can be compliant and still be involved in incidents that require investigation or policy changes. C. Reimaging is a high-impact action that should be reserved for confirmed compromise. Administrators first investigate using device entity insights and advanced hunting to understand the scope and root cause.

Q5 - Correct: C. Advanced hunting, optionally launched from an entity using the Go hunt action. Advanced hunting is a query-based tool that lets analysts explore up to 30 days of raw data to find devices that ran a file, contacted a domain, or showed related activity. The Go hunt action scopes the query to a selected entity. A. Secure Score measures overall security posture and surfaces recommended improvement actions. It doesn't query historical device activity for a specific file. B. Threat analytics highlights active threats, campaigns, and exposed assets, but it doesn't run targeted queries against raw device activity data.

Q1 - Correct: B. Device Query (Microsoft Intune Suite / Device Query add-on). Correct. Device Query lets you run real-time KQL queries against a single Windows device from the Intune admin center. It requires the Intune Suite or the Device Query add-on license. A. The Startup performance dashboard aggregates data across the fleet : it isn't a live, per-device KQL investigation tool. C. App reliability ranks apps by crash and hang counts across devices. It isn't a live, per-device investigation tool.

Q2 - Correct: A. Return `0` when no remediation is required and a nonzero value when the remediation script should run. Correct. Intune Remediations interprets the detection script's exit code: `0` means healthy (no action), nonzero triggers the remediation script. B. Intune evaluates the detection script's exit code, not its stdout. A script that always exits `0` never triggers remediation. C. PowerShell scripts surface their result to Intune through the exit code, not a boolean return value.

Q3 - Correct: B. Pilot the package against a small group with varied hardware and update states, validate detection and remediation behavior, then expand. Correct. The recommended pattern is to pilot the package on a representative group, validate that detection fires only on affected devices and remediation succeeds, then expand the assignment. A. Pushing a remediation tenant-wide on day one risks side effects on hardware or configuration variants you didn't anticipate. The recommended approach is to pilot first. C. Remediations are designed to run automatically on a schedule against assigned devices. Treating them as one-off manual actions misses the point of the feature.

Q4 - Correct: B. The User experience score : focus on the devices with the lowest scores first. Correct. The User experience score summarizes startup, app reliability, and device health into one indicator. Devices with the lowest scores are the most likely to drive support costs. A. Installed app inventory tells you what's deployed, not which devices are degrading the user experience. C. License assignment doesn't reflect device performance or reliability.

Q5 - Correct: B. Re-check Endpoint Analytics metrics after the change, compare against the previous baseline, and document the outcome : repeating for any regressions. Correct. The structured remediation loop is: pilot → apply → re-check Endpoint Analytics metrics → compare to baseline → document. This confirms the improvement and catches regressions before broader rollout. A. Removing the change blindly defeats the purpose of the recommendation and discards the improvement you set out to make. C. Disabling telemetry blinds you to whether the change worked and prevents detection of future regressions.

Q1 - Correct: A. The Compliance reports category, which provides per-device and per-policy compliance state for all enrolled devices. Correct. The Compliance reports section in the Intune admin center surfaces device-level and policy-level compliance states, making it the direct source for identifying non-compliant devices and the specific policies they're failing. B. Incorrect. Endpoint analytics focuses on device experience metrics such as startup time and application crash rates : not on policy compliance state against a security baseline. C. Incorrect. Windows Update for Business reports focus on update rings and deployment status, not on security baseline policy compliance. The Compliance reports category is the right choice.

Q2 - Correct: A. Apply OS platform, department group, compliance status, and last-check-in date filters to the compliance report, then save the configuration as a named saved view. Correct. Intune's report filter panel lets you stack multiple criteria (platform, group membership, status, date range). Saving the result as a named view means the filters are reapplied automatically on return visits, eliminating manual re-entry each week. B. Incorrect. Manual weekly exports with offline sorting is error-prone and time-consuming. The saved view feature in the Intune admin center is designed specifically to preserve filter combinations for recurring review. C. Incorrect. Creating a separate compliance policy changes your enforcement configuration, not just your reporting view. Saved views filter existing report data without modifying device policy assignments.

Q3 - Correct: A. Use the Microsoft Graph API with a scheduled Azure Automation runbook to export the compliance report data monthly, format it, and send it via an email connector such as Logic Apps or Power Automate. Correct. The Microsoft Graph API exposes Intune report data programmatically. An Azure Automation runbook scheduled monthly can pull the data, and a Logic Apps or Power Automate flow can format and deliver it to the compliance officer's email : without requiring portal access. B. Incorrect. Granting admin access violates least-privilege and still requires the officer to log into the portal. The requirement is for automated delivery to their email without portal access. C. Incorrect. Diagnostic settings to an event hub stream raw log data in near real-time for SIEM ingestion : they don't generate formatted monthly PDFs or send email. An automated export via Graph API and a workflow tool is the correct approach.

Q1 - Correct: A. Assign the built-in Help Desk Operator role to a Seattle-IT security group, set Scope (Groups) to All Seattle Users, and set Scope (Tags) to a Seattle-Scope scope tag applied to Seattle-only objects. Correct. The Help Desk Operator role provides only the device-action permissions needed (such as passcode reset and reboot). Scope (Groups) restricts which devices and users the admins can target, and Scope (Tags) restricts which Intune objects they can see : so New York configuration profiles remain hidden. B. Incorrect. Global Administrator grants tenant-wide permissions, which violates least-privilege and would let the Seattle team see and modify New York objects. Direct assignment also makes the access hard to manage at scale. C. Incorrect. Read access on all profiles would still expose New York configurations to the Seattle team. Direct assignment to individual user accounts also doesn't scale and complicates auditing of who has admin access.

Q2 - Correct: A. The Default scope tag was not removed from the policy, so admins whose role assignments include the Default tag can still see the object. Correct. Every Intune object automatically receives the Default scope tag. To hide an object from admins who only have the Default tag, you must explicitly remove the Default tag and leave only the restricted custom tag (such as Executive-IT). B. Incorrect. Scope tag changes apply immediately to subsequent admin center loads : there's no separate sign-out requirement. The visibility is controlled by which tags exist on the object, not by session state. C. Incorrect. Scope tags apply to most Intune objects, including compliance policies, configuration profiles, and apps. The visibility issue here is caused by the Default tag still being present on the object.

Q3 - Correct: A. Send AuditLogs to a Log Analytics workspace for KQL-based alerting on delete operations, and also archive AuditLogs to a storage account for long-term retention. Correct. Log Analytics enables KQL queries and Azure Monitor alert rules that can detect high-risk operations such as Delete DeviceCompliancePolicy. A storage account destination provides cheap, long-term cold storage to satisfy multi-year compliance retention. B. Incorrect. Manual CSV export doesn't provide automated alerting on delete operations and depends on someone remembering to export each week, which doesn't meet a continuous monitoring or guaranteed retention requirement. C. Incorrect. Streaming to an event hub is appropriate for SIEM integration, but it shifts both detection and retention responsibility entirely to the SIEM. For a Microsoft-native answer that explicitly meets both alerting and retention requirements, Log Analytics plus a storage account is the recommended pattern.

Q1 - Correct: A. Review the Microsoft 365 Service Health dashboard in the admin center to determine whether an active Intune service incident is affecting device synchronization. Correct. Because Intune is a cloud SaaS solution, an active Microsoft service incident can cause widespread device sync failures that look like local configuration problems. Checking service health first avoids wasting time troubleshooting a misconfiguration when the root cause is a platform outage. B. Incorrect. Wiping devices is a destructive action that won't resolve a service-side outage and will cause more data loss. Service health should always be checked first before taking any remediation action on devices. C. Incorrect. Not every widespread failure is a Microsoft infrastructure issue: the cause could be a local network problem, a policy misconfiguration, or a certificate expiry. You should check the Service Health dashboard to confirm whether there's an active incident before opening a support ticket.

Q2 - Correct: A. Create an Intune notification message template, then configure a compliance policy with an action for noncompliance that triggers the email notification when the threshold is reached. Correct. Intune's compliance policy actions for noncompliance support sending email notifications, and notification message templates let you customize the recipient list and message body. This provides automated, policy-driven email alerts scoped to compliance state changes. B. Incorrect. Manual daily reviews don't provide automated alerting and are likely to miss threshold crossings that happen between review cycles. Compliance policy notification actions automate this without human intervention. C. Incorrect. Diagnostic settings to a storage account are designed for audit log archiving and long-term retention, not real-time compliance threshold alerting. Intune compliance policy notification actions are the correct built-in mechanism.

Q3 - Correct: A. Review the Intune audit logs filtered to the previous change window to see which administrative actions were performed, then cross-reference those changes with your documented operational baseline. Correct. Intune audit logs record every administrative action with a timestamp, actor, and affected resource. Filtering to the change window and comparing against a documented baseline lets you quickly pinpoint which recent change likely caused the enrollment failures, without guessing. B. Incorrect. Re-applying policies without first identifying the root cause could overwrite a correct configuration or introduce a second change, making the incident harder to diagnose. Reviewing audit logs is a non-destructive first step. C. Incorrect. Relying on verbal recall is error-prone and slow. Intune audit logs provide an authoritative, timestamped record of all admin actions that is far faster and more reliable than reconstructing changes from memory.

Q1 - Correct: B. Endpoint Privilege Management Correct. Endpoint Privilege Management enables Zero Trust by allowing users to run as standard users while still elevating specific approved applications under admin-defined policy. A. Remote Help provides secure remote assistance from support staff but doesn't grant on-demand elevation rights to end users for approved apps. C. Advanced Analytics provides reporting and proactive insights on device health, but doesn't control privilege elevation.

Q2 - Correct: C. The Microsoft Intune Suite is a set of premium add-on capabilities that extends core Intune for advanced endpoint management scenarios. Correct. The Suite layers on top of core Intune to add advanced capabilities such as Remote Help, Endpoint Privilege Management, and Advanced Analytics. A. The Suite doesn't replace core Intune. Core Intune capabilities such as device enrollment, compliance, and configuration profiles remain unchanged. B. Suite components are fully integrated with core Intune and are managed from the same Intune admin center.

Q3 - Correct: B. License the individual add-on standalone, or start a free trial for that capability. Correct. Intune Suite add-ons can be licensed individually, and free trials let organizations evaluate a capability before purchasing. A. Purchasing the full Suite to disable features is more expensive than necessary when only one add-on is needed. C. Suite add-ons are premium capabilities and aren't added to core Intune. Organizations that need them must license them separately or as part of the Suite.

Q1 - Correct: B. Helper and sharer Correct. The helper is the support agent who provides assistance, and the sharer is the user receiving help and sharing their screen. A. Administrators configure Remote Help and assign permissions, but they aren't the two participants in the session itself. There's no separate auditor role. C. Owner and guest aren't Remote Help roles. Remote Help uses helper, sharer, and administrator roles.

Q2 - Correct: B. By using Intune role-based access control (RBAC) to assign Remote Help roles to Microsoft Entra ID groups. Correct. Remote Help permissions are assigned through Intune RBAC, scoped to Microsoft Entra ID groups of helpers. A. Remote Help permissions aren't managed through local group membership on the device. C. Granting Global Administrator is over-privileged and unnecessary. Remote Help uses scoped Intune RBAC roles.

Q3 - Correct: B. The sharer sees a consent prompt and must approve the level of access : view-only or full control : before the helper proceeds. Correct. Remote Help requires explicit sharer consent before each session, and the sharer chooses whether to allow view-only or full control. A. Remote Help doesn't grant silent control. The sharer must explicitly consent before any view or control action. C. Phone authorization isn't required. Consent is built into the Remote Help session prompt presented to the sharer.

Q1 - Correct: A. Microsoft Intune Suite Advanced Analytics, including end-user experience scores and anomaly detection. Correct. Advanced Analytics surfaces real-time device health, experience scores, and anomalies that static compliance reports don't reveal. B. Standard compliance reporting only tells you whether a device passes binary checks : it doesn't surface experience or anomaly signals. C. Sign-in logs help with identity events but don't measure device performance or anomalies.

Q2 - Correct: B. So device compliance signals from Intune and threat signals from Defender flow together for unified posture and risk visibility. Correct. Integration bridges IT and security operations, combining Intune's static checks with Defender's dynamic threat analysis. A. Defender doesn't replace Intune policies. The two are complementary : Intune enforces configuration and compliance, Defender provides dynamic threat signals. C. End-user threat visibility isn't the goal of the integration. The goal is unified posture and risk for admins and security.

Q3 - Correct: C. Use anomaly and risk signals to drive risk-based Conditional Access that adapts in real time to changing device state. Correct. Risk-based Conditional Access uses dynamic signals to apply appropriate controls : for example, requiring stronger authentication or limiting access when device risk increases. A. A static compliance policy doesn't take advantage of dynamic risk signals. Advanced Analytics enables more adaptive decisions. B. Blocking on every anomaly is too disruptive. Risk-based policy applies appropriate controls proportional to the risk level.