All AB-650 Test Inside Microsoft Questions

Microsoft Entra ID provides role-based access control (RBAC) for administrative tasks, including the management of verified custom domain names.

Option D is correct because admin1@contoso.onmicrosoft.com holds the Domain Name Administrator role, which is the least-privileged Microsoft Entra built-in role capable of managing custom domains.

Microsoft explicitly documents that the Domain Name Administrator role includes permissions to add, verify, update, and delete custom domain names.

The scenario also satisfies the prerequisites for domain removal: contoso.com is not the default domain, and no users, groups, or applications reference it.

Furthermore, the administrator ' s user principal name uses contoso.onmicrosoft.com, rather than the domain being deleted. This avoids a dependency that would otherwise prevent removal.

Option A is incorrect because the License Administrator role manages licensing assignments and does not provide domain deletion permissions.

Option B is incorrect because the Global Administrator role can delete custom domains but grants significantly broader administrative privileges than necessary.

Option C is incorrect because the User Administrator role manages user and certain group-related operations but does not provide the required domain-management permissions.

Administrators can remove the domain through the Microsoft Entra admin center under Entra ID, Domain names, and Custom domain names.

Therefore, admin1@contoso.onmicrosoft.com is the correct account because it meets the requirement while following the principle of least privilege.

Microsoft Defender for Office 365 evaluates custom outbound anti-spam policies according to policy priority, inclusion conditions, and exclusions.

Microsoft documents two important evaluation rules:

Different inclusion condition types, such as Users and Groups, use AND logic.

Exclusions override inclusions, and the first applicable policy takes precedence.

Statement 1: No.

User1 belongs to Group1 but is not the explicitly specified user (User3) in AntiSpam1. User1 is specified in AntiSpam2 but does not belong to Group2. Therefore, neither custom policy applies. The limits cannot be combined to produce 150.

Statement 2: No.

User2 belongs to both Group1 and Group2. However, AntiSpam1 specifies User3 and Group1 as combined inclusion conditions, and additionally excludes Group2. AntiSpam2 specifies User1 and Group2 as combined inclusion conditions. User2 does not satisfy either policy ' s complete requirements.

Statement 3: No.

User3 is explicitly included in AntiSpam1 but does not belong to Group1. User3 also belongs to the excluded Group2. AntiSpam2 explicitly excludes User3. Consequently, neither custom policy imposes the stated 100-recipient daily limit on User3.

All three users fall back to the default outbound anti-spam policy.

Technical clarification: Microsoft defines the daily message limit in outbound anti-spam policies as a maximum number of recipients per day, not necessarily the number of email messages.

Microsoft Reference: Microsoft Learn — Configure outbound spam policies, recipient conditions, and policy precedence .

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.