Microsoft AB-650 Actual Questions

Microsoft Defender for Office 365 provides configurable inbound anti-spam policies that enable administrators to filter unwanted email according to sender characteristics, geographic origin, languages, and recipient groups.

Option C is correct because a custom anti-spam inbound policy supports geographic filtering through the From these countries setting and can be scoped to selected recipient groups.

Administrators can configure the policy through the following steps:

Navigate to Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam.

Select Create policy → Inbound.

Under Users, groups, and domains, specify Group1 as the recipient group.

Under Bulk email threshold & spam properties, enable From these countries and select the countries or regions from which unwanted messages originate.

Configure the appropriate spam action, such as moving detected messages to Junk Email or quarantine.

This configuration ensures that geographic spam filtering applies specifically to Group1 without altering protection settings for other recipients.

Option A is incorrect because connection filter policies operate on source IP addresses and do not provide the required group-specific geographic filtering.

Options B and D are incorrect because preset security policies do not provide the required customizable country-based filtering settings.

Option E is incorrect because anti-phishing policies focus on spoofing, impersonation, and phishing detection rather than geographic spam filtering.

Implementation consideration: Recipient-group targeting supports mail-enabled security groups, distribution groups, and Microsoft 365 groups. Also, Standard or Strict preset security policies take precedence over custom inbound anti-spam policies for recipients included in those presets.

Microsoft Entra ID provides a group naming policy that enables organizations to enforce consistent naming conventions for Microsoft 365 groups.

First selection: The Microsoft Entra admin center.

Administrators configure the naming policy by navigating to the Microsoft Entra admin center and selecting Microsoft Entra ID → Groups → Naming policy.

The policy supports two principal capabilities: prefix-suffix naming conventions and custom blocked words.

Prefix-suffix rules automatically add predefined text or supported user attributes, such as Department or Company, to group names. Blocked-word policies prevent users from creating Microsoft 365 groups with prohibited terminology.

Second selection: Microsoft 365 only.

The Microsoft Entra group naming policy applies specifically to Microsoft 365 groups, including groups created through Microsoft Teams, Outlook, SharePoint, and other supported Microsoft 365 applications.

It does not apply to ordinary security groups, mail-enabled security groups, or Exchange distribution groups.

Exchange distribution groups can have separate naming policies configured through Exchange administration, but these are distinct from the Microsoft Entra Microsoft 365 group naming policy.

Microsoft 365 E5 includes the licensing required for this functionality.

An additional consideration is that certain privileged administrator roles are exempt from enforcement, and existing Microsoft 365 groups are not automatically renamed when the policy is introduced.

Therefore, the correct selections are the Microsoft Entra admin center and Microsoft 365 groups only.

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access through eligible role assignments. This capability allows administrators to grant temporary access to sensitive Microsoft Entra administrator roles without maintaining permanent privileged permissions.

When engineers are assigned as eligible for an administrator role, they do not immediately receive the role ' s active privileges. Instead, they must activate the role before performing privileged administrative tasks.

The activation process can require multifactor authentication, justification, approval, or other security controls, depending on the configured PIM role settings.

Administrators can define a maximum activation duration. Once the activation period expires, the active role assignment expires automatically, and the user must activate the role again before performing privileged operations.

Option A is incorrect because access packages manage access to resources but do not inherently implement just-in-time activation for Microsoft Entra administrator roles.

Option B is incorrect because administrative units restrict the scope of delegated administration without providing automatic role activation and expiration.

Option D is incorrect because active membership in a role-assignable group grants privileges without requiring activation.

Therefore, PIM eligible role assignments satisfy both requirements: explicit activation and automatic expiration.

Microsoft References:

List the AI app and agent inventory: AI observability; Review interactions: Activity explorer; Identify SharePoint exposure concerns: Data risk assessments

Microsoft Purview Data Security Posture Management (DSPM) combines AI activity visibility, sensitive-data investigations, and exposure assessments within a centralized data security framework.

First selection: AI observability. This capability provides an inventory of AI applications and agents, including their activity, risk characteristics, and sensitive interactions. Administrators can identify recently used agents and investigate potentially risky AI applications.

Second selection: Activity explorer. DSPM Activity explorer enables administrators to investigate events associated with sensitive information. Its AI activities view provides visibility into AI interactions, prompts and responses where supported, sensitive information detections, and data loss prevention policy matches. This makes it suitable for examining whether confidential SharePoint information was involved in an AI interaction.

Third selection: Data risk assessments. This capability identifies potential data exposure and oversharing risks. Administrators can assess sensitive content and investigate SharePoint locations where excessive access permissions or sharing configurations may expose information.

The remaining options perform different functions. Posture provides an overall data security dashboard, Remediation actions supports implementing security controls, and Reports provides summarized security information.

Consequently, AI observability, Activity explorer, and Data risk assessments are the correct selections for the three investigation requirements.

Microsoft References: