AB-650 Exam Dumps : Administering Microsoft 365 and AI Services

Microsoft Entra Password Protection helps prevent users from choosing weak or commonly used passwords by checking password changes against Microsoft ' s global banned-password list and an administrator-defined custom list.

Option A is correct because the Microsoft Entra Password Protection domain controller (DC) agent extends password validation to on-premises Active Directory Domain Services.

By default, configuring a custom banned-password list in Microsoft Entra ID protects cloud-based password changes but does not automatically extend the enforcement mechanism to domain controllers.

To implement on-premises protection, administrators must deploy the Password Protection DC agent to domain controllers and configure the supporting Microsoft Entra Password Protection proxy service. The proxy retrieves password protection policies from Microsoft Entra ID and makes them available to the DC agents.

Administrators must also enable password protection for Windows Server Active Directory and configure Enforced mode rather than Audit mode.

Option B is incorrect because the Microsoft Entra provisioning agent supports identity provisioning and synchronization scenarios.

Option C is incorrect because password writeback supports writing cloud-initiated password changes to on-premises Active Directory.

Option D is incorrect because password hash synchronization enables cloud authentication using synchronized password hashes; it does not enforce custom banned passwords during on-premises password changes.

Therefore, deploying the DC agent is the correct choice, with the additional deployment components and enforcement configuration required for operation.

Microsoft References:

Answer Area

Correct Selection

Project documents

Sensitive information type (SIT)

Proposal documents

Exact data match (EDM)

Microsoft Purview provides different classification technologies for identifying sensitive information. The appropriate method depends on whether the information follows a predictable pattern or must match known values.

First selection: Sensitive information type (SIT).

Contoso ' s project documents contain project codes consisting of the letters PR, followed by a hyphen and nine digits, such as PR-123456789.

This predictable structure makes a custom sensitive information type appropriate. Administrators can create a SIT using a regular expression such as:

PR-[0-9]{9}

Supporting keywords and confidence requirements can further minimize false positives.

Second selection: Exact data match (EDM).

Contoso ' s proposal documents contain customer IDs consisting of seven to ten alphanumeric characters. The valid customer IDs are recorded in an Excel workbook.

EDM is appropriate because it compares detected values against a known reference dataset. Administrators can prepare the customer IDs for EDM classification using a supported data format.

EDM reduces false positives by identifying customer IDs that actually exist in the reference data rather than matching arbitrary alphanumeric strings.

A fingerprint SIT would be more appropriate for Contoso ' s feedback forms, which use a standardized template. Trainable classifiers are better suited to content requiring contextual or semantic classification.

Therefore, a custom SIT for project codes and EDM for known customer IDs satisfy both requirements.

Microsoft References:

Microsoft Learn — Create custom sensitive information types .

Microsoft Learn — Exact Data Match sensitive information types .

Microsoft Learn — Reduce false positives using classifiers

The Contoso case study specifies the following planned change:

Add an additional email address alias for the users in Group4.

Group4 is a Microsoft 365 group containing User1 and User2. Both users have Microsoft Exchange mailboxes.

Option C is correct because the Exchange Online PowerShell Set-Mailbox cmdlet supports modifying mailbox properties, including additional SMTP email addresses.

Administrators can use the -EmailAddresses parameter with the @{Add=...} syntax to add a secondary email address without removing existing addresses or modifying the primary SMTP address.

For example:

Set-Mailbox -Identity " user1@contoso.com " `

-EmailAddresses @{Add= " user1.alias@contoso.com " }

The same operation can be performed for the other Group4 members.

Option A is incorrect because Set-MailUser manages mail-enabled users who have external mailboxes, rather than Exchange Online user mailboxes.

Option B is incorrect because Update-MgUser manages Microsoft Entra user properties and is not the appropriate cmdlet for modifying Exchange Online mailbox proxy addresses.

Option D is incorrect because Set-ADUser manages on-premises Active Directory user objects. Contoso ' s users are cloud-only, and their Exchange Online mailboxes are managed in Microsoft 365.

Therefore, Set-Mailbox is the appropriate cmdlet for implementing the planned change.

Microsoft References:

Microsoft Learn — Add or remove email addresses for a mailbox in Exchange Online .

Microsoft Learn — Set-Mailbox PowerShell reference .