Free and Premium Microsoft AB-650 Dumps Questions Answers

Microsoft Entra ID Governance provides entitlement management through access packages, enabling organizations to automate access requests, approvals, assignments, and expiration.

Option A is correct because access packages support both required capabilities: self-service access requests with approval and automatic revocation when the approved assignment expires.

Administrators can create an access package containing the resources or groups that grant access to Agent1. They then configure an assignment policy that allows eligible contractors to request access.

On the policy ' s Requests settings, administrators can enable approval and designate the appropriate approvers. This ensures that contractors cannot receive access without authorization.

On the Lifecycle settings, administrators can configure access package assignments to expire after a specified number of days. Setting the duration to 30 days automatically ends the assignment at the end of the project.

Option B is incorrect because PIM primarily manages just-in-time privileged role and group access, rather than the complete self-service entitlement management process requested.

Option C is incorrect because Conditional Access evaluates access conditions but does not independently provide request approval and assignment expiration.

Option D is incorrect because recurring access reviews periodically assess existing access instead of providing the required initial request-and-approval workflow.

Therefore, an access package meets both requirements.

Microsoft References:

Microsoft Defender for Office 365 Plan 2 provides Automated Investigation and Response (AIR) capabilities to investigate malicious email messages and recommend or execute remediation actions.

Option D is correct because Microsoft explicitly identifies Soft delete as the only available remediation action when configuring automatic remediation for AIR message clusters.

By default, AIR remediation actions require approval from the Security Operations (SecOps) team. However, administrators can enable automatic remediation for selected message cluster types, allowing malicious messages to be remediated without manual approval.

Administrators can configure this feature in the Microsoft Defender portal by navigating to Settings → Email & collaboration → MDO automation settings.

The Message clusters section supports three categories:

Similar files

Similar URLs

Multiple similar attributes

Under Remediation action, administrators select Soft delete. AIR then automatically removes qualifying malicious messages from user mailboxes without requiring SecOps approval.

Soft deletion moves messages into the Recoverable Items structure, allowing recovery according to applicable mailbox retention settings.

Option A moves messages to Deleted Items, while Option B moves them to Junk Email. Neither is supported as the configurable automatic AIR remediation action.

Option C permanently removes messages and is not supported for this automatic remediation configuration.

Microsoft also specifies that clusters containing more than 10,000 messages require manual review rather than automatic remediation.

Therefore, Soft delete is the only correct option.

User1: 5; User2: 2

Microsoft Purview Data Loss Prevention policies identify sensitive information and enforce access restrictions according to configured rule conditions and actions.

The DLP rule in this scenario detects the IP Address sensitive information type at High confidence, requiring at least two instances.

Therefore, files containing fewer than two qualifying IP addresses do not match the condition. Supported files containing two or more qualifying IP addresses are subject to the configured restrictions.

The rule uses Restrict access or encrypt the content in Microsoft 365 locations, with Block everyone selected.

Microsoft documents that this action retains access for the content owner, last modifier, and primary site administrator. Consequently, User1, as Site1 owner, can access all five files.

User2 is a Visitor and does not receive those exemptions. Under the intended scenario, User2 can access File1.docx, which contains only one IP address, and File4.bmp, whose image content is not scanned by the ordinary text-based DLP condition.

The other three files satisfy the sensitive-information threshold and are blocked.

Technical qualification: Microsoft Purview also supports optional OCR scanning for image files. If OCR is enabled for SharePoint and the bitmap ' s content qualifies, File4.bmp could also be restricted. The answer 5 and 2 assumes OCR is not enabled.

Microsoft References:

DomainKeys Identified Mail (DKIM) is an email authentication mechanism that uses public-key cryptography to digitally sign outgoing email messages. It enables receiving mail systems to verify that signed message headers and the message body have not been modified after signing.

When DKIM is configured for the accepted domain contoso.com, Exchange Online signs outbound messages using a private key. The receiving mail server retrieves the corresponding public key through DNS and verifies the DKIM signature.

The signature is included in the email ' s DKIM-Signature header, which contains information identifying the signing domain, cryptographic algorithm, and signed message components.

For custom domains in Microsoft 365, administrators typically configure the required DNS CNAME records and enable DKIM signing through Microsoft Defender.

Option A is incorrect because Microsoft Purview Message Encryption protects message confidentiality rather than providing DKIM authentication signatures.

Option C is incorrect because Domain-based Message Authentication, Reporting, and Conformance (DMARC) defines authentication alignment and handling policies based on SPF and DKIM results.

Option D is incorrect because Authenticated Received Chain (ARC) preserves authentication information through intermediary mail systems, particularly when forwarding modifies messages.

DKIM is therefore the correct technology for digitally signing outbound email messages.

Microsoft References:

Microsoft Defender for Office 365 provides configurable inbound anti-spam policies that enable administrators to filter unwanted email according to sender characteristics, geographic origin, languages, and recipient groups.

Option C is correct because a custom anti-spam inbound policy supports geographic filtering through the From these countries setting and can be scoped to selected recipient groups.

Administrators can configure the policy through the following steps:

Navigate to Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam.

Select Create policy → Inbound.

Under Users, groups, and domains, specify Group1 as the recipient group.

Under Bulk email threshold & spam properties, enable From these countries and select the countries or regions from which unwanted messages originate.

Configure the appropriate spam action, such as moving detected messages to Junk Email or quarantine.

This configuration ensures that geographic spam filtering applies specifically to Group1 without altering protection settings for other recipients.

Option A is incorrect because connection filter policies operate on source IP addresses and do not provide the required group-specific geographic filtering.

Options B and D are incorrect because preset security policies do not provide the required customizable country-based filtering settings.

Option E is incorrect because anti-phishing policies focus on spoofing, impersonation, and phishing detection rather than geographic spam filtering.

Implementation consideration: Recipient-group targeting supports mail-enabled security groups, distribution groups, and Microsoft 365 groups. Also, Standard or Strict preset security policies take precedence over custom inbound anti-spam policies for recipients included in those presets.

Microsoft Entra ID provides a group naming policy that enables organizations to enforce consistent naming conventions for Microsoft 365 groups.

First selection: The Microsoft Entra admin center.

Administrators configure the naming policy by navigating to the Microsoft Entra admin center and selecting Microsoft Entra ID → Groups → Naming policy.

The policy supports two principal capabilities: prefix-suffix naming conventions and custom blocked words.

Prefix-suffix rules automatically add predefined text or supported user attributes, such as Department or Company, to group names. Blocked-word policies prevent users from creating Microsoft 365 groups with prohibited terminology.

Second selection: Microsoft 365 only.

The Microsoft Entra group naming policy applies specifically to Microsoft 365 groups, including groups created through Microsoft Teams, Outlook, SharePoint, and other supported Microsoft 365 applications.

It does not apply to ordinary security groups, mail-enabled security groups, or Exchange distribution groups.

Exchange distribution groups can have separate naming policies configured through Exchange administration, but these are distinct from the Microsoft Entra Microsoft 365 group naming policy.

Microsoft 365 E5 includes the licensing required for this functionality.

An additional consideration is that certain privileged administrator roles are exempt from enforcement, and existing Microsoft 365 groups are not automatically renamed when the policy is introduced.

Therefore, the correct selections are the Microsoft Entra admin center and Microsoft 365 groups only.

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access through eligible role assignments. This capability allows administrators to grant temporary access to sensitive Microsoft Entra administrator roles without maintaining permanent privileged permissions.

When engineers are assigned as eligible for an administrator role, they do not immediately receive the role ' s active privileges. Instead, they must activate the role before performing privileged administrative tasks.

The activation process can require multifactor authentication, justification, approval, or other security controls, depending on the configured PIM role settings.

Administrators can define a maximum activation duration. Once the activation period expires, the active role assignment expires automatically, and the user must activate the role again before performing privileged operations.

Option A is incorrect because access packages manage access to resources but do not inherently implement just-in-time activation for Microsoft Entra administrator roles.

Option B is incorrect because administrative units restrict the scope of delegated administration without providing automatic role activation and expiration.

Option D is incorrect because active membership in a role-assignable group grants privileges without requiring activation.

Therefore, PIM eligible role assignments satisfy both requirements: explicit activation and automatic expiration.

Microsoft References:

List the AI app and agent inventory: AI observability; Review interactions: Activity explorer; Identify SharePoint exposure concerns: Data risk assessments

Microsoft Purview Data Security Posture Management (DSPM) combines AI activity visibility, sensitive-data investigations, and exposure assessments within a centralized data security framework.

First selection: AI observability. This capability provides an inventory of AI applications and agents, including their activity, risk characteristics, and sensitive interactions. Administrators can identify recently used agents and investigate potentially risky AI applications.

Second selection: Activity explorer. DSPM Activity explorer enables administrators to investigate events associated with sensitive information. Its AI activities view provides visibility into AI interactions, prompts and responses where supported, sensitive information detections, and data loss prevention policy matches. This makes it suitable for examining whether confidential SharePoint information was involved in an AI interaction.

Third selection: Data risk assessments. This capability identifies potential data exposure and oversharing risks. Administrators can assess sensitive content and investigate SharePoint locations where excessive access permissions or sharing configurations may expose information.

The remaining options perform different functions. Posture provides an overall data security dashboard, Remediation actions supports implementing security controls, and Reports provides summarized security information.

Consequently, AI observability, Activity explorer, and Data risk assessments are the correct selections for the three investigation requirements.

Microsoft References:

User2 can enable Copilot image generation for the subscription: Yes; User1 can use Microsoft 365 Copilot in the Exchange admin center: Yes; User3 can buy a Microsoft 365 Copilot license without admin approval: No

Microsoft 365 Copilot administrative controls determine who can manage AI functionality, access Copilot within administrative portals, and purchase licenses independently.

First statement: Yes. User2 holds the AI Administrator role, which provides permission to configure Microsoft Copilot settings, including image generation. An AI Administrator can navigate to the Microsoft 365 admin center, open Copilot settings, and modify the Copilot image generation configuration.

Second statement: Yes. User1 holds the Global Reader role. This is a recognized administrative role that provides read-only access to supported Microsoft 365 administrative portals, including Exchange admin center. Because Copilot in admin centers is configured as Allowed for all admins, User1 can access supported Copilot functionality within the permissions of the role. This does not grant permission to modify Exchange settings.

Third statement: No. The self-service purchasing configuration is Allow trials only. This permits eligible users to start supported trials but prevents them from purchasing Microsoft 365 Copilot licenses independently.

User3 has no administrative role and cannot bypass the purchasing restriction.

Therefore, the correct sequence is Yes, Yes, No.

Microsoft References:

Microsoft Purview supports service-side sensitivity auto-labeling for Exchange Online email, including inspection of supported email attachments.

Statement 1: Yes, conditionally.

When an active Exchange auto-labeling policy detects sensitive information in a supported Office attachment, it applies the configured sensitivity label to the email, even if the email body does not contain sensitive information.

File1.docx contains an IP address and uses a supported Word format. If that IP address satisfies the auto-labeling policy ' s conditions, the email receives Sensitivity1.

The sensitivity label ' s Auto-labeling for files and emails setting being None does not prevent a separately configured service-side auto-labeling policy from functioning.

Statement 2: No.

Microsoft documentation explicitly states that Exchange auto-labeling labels the email rather than its attachments. Therefore, File1.docx does not receive Sensitivity1 simply because its content triggered the email label.

Consequently, the configured watermark is not automatically added to File1.docx.

Statement 3: No.

File2.xml is not a supported Office attachment format for Exchange sensitivity auto-labeling. Additionally, the service-side labeling process does not apply document headers to attachments.

Therefore, File2.xml does not receive the configured header.

Microsoft Purview Data Loss Prevention (DLP) policies evaluate content against configured sensitive information types, confidence levels, and instance-count thresholds. Matching content is then subject to the rule ' s configured actions and notifications.

First selection: Available to both internal and external users.

The exhibit shows that Policy1 has no action configured under the Actions section. Although user notifications are enabled, no access restriction or encryption action has been selected.

Therefore, Policy1 does not block internal or external access to matching files. Existing SharePoint or OneDrive permissions remain effective.

Second selection: No.

Policy1 defines three sensitive information types: SWIFT Code at Medium confidence, EU Debit Card Number at High confidence, and Credit Card Number at High confidence.

Each condition permits between 1 and 9 instances.

A file containing 18 credit card numbers exceeds the configured maximum of nine. Assuming no other sensitive information type satisfies the rule, the file does not match Policy1.

Because user notifications are triggered by matching DLP rules, no notification emails are generated.

Selecting three notification recipient categories does not independently trigger notifications when the DLP conditions are not met.

Therefore, the correct selections are available to both internal and external users and no.

Microsoft Defender for Office 365 Plan 2 provides Attack simulation training capabilities, including dedicated Training campaigns that assign educational modules without requiring another simulated phishing attack.

Option A is correct because creating a Training campaign targeting Group1 allows administrators to reassign the required training directly to the current members of the group. Using Group1 avoids manually identifying recipients and minimizes administrative effort when group membership changes.

Administrators can configure training assignment notifications and reminder notifications during campaign creation. To deliver reminders as frequently as supported, they can select the twice-weekly reminder option.

Option B is correct because the Training threshold setting controls how soon users can receive a training module that was previously assigned.

The default threshold is 90 days. Because the earlier simulation assigned the module recently, this setting could prevent reassignment during the new campaign.

Setting Training threshold to 0 removes the restriction and permits the same module to be reassigned immediately.

Option C is incorrect because a 60-day threshold would still prevent reassignment to users whose previous assignment occurred within that period.

Option D is incorrect because a tenant payload creates customized phishing simulation content, not training assignments.

Option E is unnecessary because simulation automation creates automated phishing simulations rather than directly assigning training.

Therefore, A and B are correct.

Microsoft References:

Microsoft Entra ID provides role-based access control (RBAC) for administrative tasks, including the management of verified custom domain names.

Option D is correct because admin1@contoso.onmicrosoft.com holds the Domain Name Administrator role, which is the least-privileged Microsoft Entra built-in role capable of managing custom domains.

Microsoft explicitly documents that the Domain Name Administrator role includes permissions to add, verify, update, and delete custom domain names.

The scenario also satisfies the prerequisites for domain removal: contoso.com is not the default domain, and no users, groups, or applications reference it.

Furthermore, the administrator ' s user principal name uses contoso.onmicrosoft.com, rather than the domain being deleted. This avoids a dependency that would otherwise prevent removal.

Option A is incorrect because the License Administrator role manages licensing assignments and does not provide domain deletion permissions.

Option B is incorrect because the Global Administrator role can delete custom domains but grants significantly broader administrative privileges than necessary.

Option C is incorrect because the User Administrator role manages user and certain group-related operations but does not provide the required domain-management permissions.

Administrators can remove the domain through the Microsoft Entra admin center under Entra ID, Domain names, and Custom domain names.

Therefore, admin1@contoso.onmicrosoft.com is the correct account because it meets the requirement while following the principle of least privilege.

Microsoft Defender for Office 365 evaluates custom outbound anti-spam policies according to policy priority, inclusion conditions, and exclusions.

Microsoft documents two important evaluation rules:

Different inclusion condition types, such as Users and Groups, use AND logic.

Exclusions override inclusions, and the first applicable policy takes precedence.

Statement 1: No.

User1 belongs to Group1 but is not the explicitly specified user (User3) in AntiSpam1. User1 is specified in AntiSpam2 but does not belong to Group2. Therefore, neither custom policy applies. The limits cannot be combined to produce 150.

Statement 2: No.

User2 belongs to both Group1 and Group2. However, AntiSpam1 specifies User3 and Group1 as combined inclusion conditions, and additionally excludes Group2. AntiSpam2 specifies User1 and Group2 as combined inclusion conditions. User2 does not satisfy either policy ' s complete requirements.

Statement 3: No.

User3 is explicitly included in AntiSpam1 but does not belong to Group1. User3 also belongs to the excluded Group2. AntiSpam2 explicitly excludes User3. Consequently, neither custom policy imposes the stated 100-recipient daily limit on User3.

All three users fall back to the default outbound anti-spam policy.

Technical clarification: Microsoft defines the daily message limit in outbound anti-spam policies as a maximum number of recipients per day, not necessarily the number of email messages.

Microsoft Reference: Microsoft Learn — Configure outbound spam policies, recipient conditions, and policy precedence .

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .