In addition to the Microsoft AB-650 PDF questions, we offer desktop AB-650 practice exam software and web-based AB-650 practice test to help applicants prepare successfully for the actual Administering Microsoft 365 and AI Services exam. These Administering Microsoft 365 and AI Services practice exams simulate the actual AB-650 Exam conditions and provide an accurate assessment of test preparation. Our desktop-based AB-650 practice exam software needs no internet connection.
| Section | Objectives |
|---|---|
| Manage Microsoft 365 security, compliance, and governance | - Implement compliance and data governance
|
| Manage Microsoft 365 tenant administration | - Manage Microsoft 365 users, groups, and roles
|
| Administer Microsoft 365 Copilot and AI services | - Manage Microsoft 365 Copilot
|
| Manage Microsoft 365 workloads and collaboration services | - Administer SharePoint Online and OneDrive
|
Constantly updated multiple mock exams with a great number of questions that will help you in better self-assessment. Memorize all your previous Administering Microsoft 365 and AI Services (AB-650) exam questions attempts and display all the changes in your results at the end of each Microsoft AB-650 Practice Exam attempt. Users will be able to customize the AB-650 practice test software by time or question types. Supported on all Windows-based PCs.
NEW QUESTION # 110
Your company has an office in London.
You have a Microsoft 365 subscription.
You need to create a Conditional Access policy named Policy1 that meets the following requirements:
* Only FIDO2 passkeys, Windows Hello for Business, and certificates must be supported for authentication.
* The London office must be marked as a trusted location and excluded from Policy1.
How should you configure Authentication strength in Policy1 and what should you use to define named location for the London office? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Answer Area
Correct Selection
Authentication strength
Phishing-resistant MFA
Named location
IP ranges
HOTSPOT Exhibit - White Background with Original Dropdown Options
Microsoft Entra Conditional Access supports authentication strengths and named locations to enforce secure authentication while excluding trusted corporate networks.
First selection: Phishing-resistant MFA.
The built-in Phishing-resistant MFA authentication strength supports the following authentication methods:
* FIDO2 passkeys and security keys
* Windows Hello for Business
* Microsoft Entra certificate-based authentication configured for multifactor authentication This matches the stated requirements. Standard Multifactor authentication and Passwordless MFA permit additional authentication methods that are not necessarily phishing-resistant, so neither provides the required restriction.
Second selection: IP ranges.
Microsoft Entra named locations allow administrators to define trusted corporate locations using public IPv4 or IPv6 address ranges.
Administrators should navigate to Microsoft Entra admin center # Entra ID # Conditional Access # Named locations.
Create an IP ranges named location, enter the London office ' s public IP ranges, and enable Mark as trusted location.
Next, edit Policy1, configure its Network condition, and exclude the London named location.
Countries is inappropriate because the requirement concerns one office rather than the entire United Kingdom. Trusted IPs refers to a legacy multifactor authentication configuration rather than the recommended IP-based named-location method.
Therefore, Phishing-resistant MFA and IP ranges satisfy both requirements.
Microsoft References:
* Microsoft Learn - Conditional Access authentication strengths
* Microsoft Learn - Named locations and trusted networks
NEW QUESTION # 111
You have a Microsoft 365 subscription.
You have product documents in an external software as a service (SaaS) knowledge base named KB1.
You plan to enable users to find and reason over the content in KB1 by using Microsoft 365 Copilot and Microsoft Search.
You need to configure a Copilot connector. The solution must meet the following requirements:
Index the KB1 content into Microsoft Graph.
Preserve the source permissions of KB1.
What should you configure?
Answer: A
Explanation:
Microsoft 365 Copilot connectors integrate information from external systems into Microsoft 365 Copilot and Microsoft Search. Two principal connector architectures are available: synced connectors and federated connectors.
Option A is correct because synced Copilot connectors ingest external content into Microsoft Graph and make the indexed information available for search and Copilot grounding.
A synced connector can connect to external SaaS knowledge bases, retrieve documents and associated metadata, and store the indexed information in Microsoft ' s search infrastructure.
The connector also supports access control lists (ACLs), ensuring that users receive search results and Copilot responses only for content they are authorized to access in the source system.
Preserving source permissions requires configuring the connector to honor the knowledge base ' s original access control model rather than making the indexed content visible to everyone.
Option B is incorrect because a custom Power Platform connector provides integration with external APIs but does not inherently index knowledge base content into Microsoft Graph.
Option C is incorrect because federated Copilot connectors retrieve external data in real time without indexing the information into Microsoft 365. This directly conflicts with the indexing requirement.
Option D is incorrect because embedding exported files in a Copilot Studio agent does not provide the required Microsoft Graph indexing and synchronized source permissions.
Therefore, a synced Copilot connector satisfies both requirements.
Microsoft References:
https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/overview
https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/manage-access-permissions
NEW QUESTION # 112
You have a Microsoft 365 subscription that contains a Microsoft SharePoint communication site named Site1 and a security group named Group1.
Some users that are outside of Group1 have direct permissions or sharing links to the content in Site1.
You need to ensure that users can access Site1 and its content only when they meet both of the following conditions.
* The user is a member of Group1.
* The user has SharePoint permissions to the content.
The solution must meet the following requirements:
* Apply only to Site1.
* Preserve the existing SharePoint permissions.
* Minimize administrative effort.
What should you do?
Answer: D
Explanation:
Microsoft SharePoint Restricted Access Control (RAC) provides an additional authorization boundary for SharePoint sites. It restricts site and content access to members of designated Microsoft Entra security groups or Microsoft 365 groups while preserving existing SharePoint permissions.
Option C is correct because configuring Restricted Access Control for Site1 and specifying Group1 satisfies both conditions simultaneously. Users must belong to Group1 and already possess appropriate SharePoint permissions. Membership in Group1 alone does not grant access.
Users outside Group1 are denied access even if they have direct permissions or previously received sharing links. Restricted Access Control can be configured for an individual communication site without modifying its existing permission assignments.
Option A is incorrect because sharing restrictions primarily control sharing operations rather than comprehensively enforcing the existing-content access boundary required.
Option B is incorrect because Restricted Content Discovery limits content visibility in organization-wide search and Microsoft 365 Copilot but does not prevent users with existing permissions from directly accessing files.
Option D is incorrect because manually changing SharePoint permissions could achieve access restrictions but would violate the requirement to preserve existing permissions and minimize administrative effort.
Therefore, configuring Restricted Access Control specifically for Site1 is the appropriate solution.
Microsoft Reference: Microsoft Learn - Restrict SharePoint site access .
Topic 1, Contoso Ltd
Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas.
Existing Environment Microsoft Entra configuration Contoso has an Azure subscription. Contoso has a Microsoft 365 E5 subscription. Contoso has a Microsoft Entra tenant named contoso.com. The tenant has an administrative unit named AU1 that contains the following membership rule. (device.deviceTrustType -eq
"Workplace") and (device.deviceOSType -in ["Windows", "Android"]) The tenant contains the cloud-only users shown in the following table.
The tenant contains the groups shown in the following table.
The tenant contains the devices shown in the following table.
All the devices are managed by using Microsoft Intune. Microsoft Entra authentication methods Contoso contains an Authentication methods policy for Microsoft Authenticator that has the following settings:
Include: Group1 Exclude: Group3 Authentication mode: Passwordless Privileged Identity Management (PIM) configuration Privileged roles are managed by using Privileged Identity Management (PIM). The PIM settings for the AI Administrator role are configured as shown in the following table.
Email configuration Each user has a Microsoft Exchange mailbox. Contoso contains an anti-spam outbound policy named Antispam1 that has the following configurations: Included groups: Group4 Excluded users:
User2 Set an external message limit: 3 Set an internal message limit: 5 Set a daily message limit: 13 Restriction placed on users who reach the message limit: Restrict the user from sending mail Microsoft SharePoint configuration Contoso has a Microsoft SharePoint site named Site1 that stores the following types of content and various other documents: Project documents: All the documents have a project code that includes the letters PR, followed by a dash and nine digits (for example PR-123456789). Proposal documents:
All the documents have a customer ID that includes seven to 10 alphanumerical characters. All the customer IDs are recorded in a Microsoft Excel workbook. Feedback forms: All the documents were created by using the same template. Microsoft AI services Contoso implements the following Microsoft AI services: Microsoft
365 Copilot for selected users Microsoft Foundry agents, including an agent named Agent1 Requirements Planned changes Contoso plans to implement the following changes: Issue new Android devices to the Group1 users. Assign Microsoft 365 Copilot licenses to the users in Group1. Add an additional email address alias for the users in Group4. Create a Conditional Access policy named CAPolicy1 for Group3. Disable web search for Microsoft 365 Copilot and Microsoft 365 Copilot Chat. Create classifiers to identify project documents and proposal documents stored on Site1. Technical requirements Contoso identifies the following technical requirements: The users in Group3 that access Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA). Microsoft 365 Copilot responses must NOT use content from the project documents stored on Site1. Microsoft 365 Copilot responses must use content from only Microsoft 365 locations. The total costs of Agent1 must be monitored and evaluated monthly. All the Android devices must be registered in Microsoft Entra. Administrative effort must be minimized.
Administrative costs must be minimized.
NEW QUESTION # 113
You have a Microsoft 365 E5 subscription.
You configure a new data loss prevention (DLP) policy named Policy1 that detects when sensitive content is shared externally.
Policy1 has the DLP rule shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Microsoft Purview Data Loss Prevention (DLP) policies evaluate content against configured sensitive information types, confidence levels, and instance-count thresholds. Matching content is then subject to the rule ' s configured actions and notifications.
First selection: Available to both internal and external users.
The exhibit shows that Policy1 has no action configured under the Actions section. Although user notifications are enabled, no access restriction or encryption action has been selected.
Therefore, Policy1 does not block internal or external access to matching files. Existing SharePoint or OneDrive permissions remain effective.
Second selection: No.
Policy1 defines three sensitive information types: SWIFT Code at Medium confidence, EU Debit Card Number at High confidence, and Credit Card Number at High confidence.
Each condition permits between 1 and 9 instances.
A file containing 18 credit card numbers exceeds the configured maximum of nine. Assuming no other sensitive information type satisfies the rule, the file does not match Policy1.
Because user notifications are triggered by matching DLP rules, no notification emails are generated.
Selecting three notification recipient categories does not independently trigger notifications when the DLP conditions are not met.
Therefore, the correct selections are available to both internal and external users and no.
NEW QUESTION # 114
You have a Microsoft 365 subscription that uses Microsoft Agent 365. The subscription contains an agent named Agent1.
Agent1 uses Microsoft SharePoint content as knowledge. Some SharePoint files contain the national ID numbers of employees and have a sensitivity label applied.
You need to prevent Agent1 from returning content that is labeled as sensitive. The solution must NOT affect unlabeled content.
What should you use?
Answer: A
Explanation:
Microsoft Purview Data Loss Prevention (DLP) provides controls that prevent Microsoft 365 Copilot and supported agents from processing sensitive organizational information when generating responses.
Option C is correct because Microsoft Purview supports DLP policies that identify files by their sensitivity labels and prevent Copilot from using the protected content in generated responses.
Administrators can configure the solution through Microsoft Purview portal # Data loss prevention # Policies.
Create a policy using the Microsoft 365 Copilot and Copilot Chat location, with the following configuration:
* Condition: Content contains # Sensitivity labels
* Selection: The sensitivity label applied to the sensitive SharePoint files
* Action: Prevent Copilot from processing content
The policy prevents supported Copilot experiences from processing the labeled documents while allowing unlabeled SharePoint content to remain available for grounding, subject to existing permissions.
Option A is incorrect because Microsoft Defender for Cloud Apps primarily provides cloud application discovery, monitoring, and session controls.
Option B is incorrect because an agent blueprint defines agent identity and configuration characteristics rather than providing sensitivity-label-based content restrictions.
Option D is incorrect because Restricted SharePoint Search limits searchable SharePoint locations rather than selectively excluding files based on sensitivity labels.
Therefore, Microsoft Purview DLP is the appropriate solution.
Microsoft References:
* Microsoft Learn - Secure and govern Microsoft 365 Copilot agents .
* Microsoft Learn - Manage access to agents in SharePoint .
* Microsoft Learn - DLP for Copilot and Copilot Chat .
Final answer: C. Microsoft Purview data loss prevention (DLP)
NEW QUESTION # 115
......
The Lead2Passed is a reliable and trusted platform that is committed to making the Administering Microsoft 365 and AI Services (AB-650) exam preparation instant, simple and successful. To do this the Lead2Passed is offering top-rated and real Administering Microsoft 365 and AI Services (AB-650) exam questions with high-in-demand features. These features are inclusively designed to ace the Microsoft AB-650 exam preparation.
Test AB-650 Centres: https://www.lead2passed.com/Microsoft/AB-650-practice-exam-dumps.html