our company is determined to help provide the most accurate AB-650 Exam Questions and help more people get the AB-650 certificate successfully. Our company has a long history of 10 years in designing AB-650 study materials and enjoys a good reputation across the globe. Now we can be the leader in this exam field and have a large number of regular customers from different countries. We are looking forward to your joining in us.
| Section | Objectives |
|---|---|
| Topic 1: Manage Microsoft 365 tenant administration | - Manage Microsoft 365 users, groups, and roles
|
| Topic 2: Manage Microsoft 365 security, compliance, and governance | - Implement compliance and data governance
|
| Topic 3: Manage Microsoft 365 workloads and collaboration services | - Administer Exchange Online
|
| Topic 4: Administer Microsoft 365 Copilot and AI services | - Manage Microsoft 365 Copilot
|
>> AB-650 Valid Test Duration <<
In the Desktop AB-650 practice exam software version of Microsoft AB-650 practice test is updated and real. The software is useable on Windows-based computers and laptops. There is a demo of the Administering Microsoft 365 and AI Services (AB-650) practice exam which is totally free. Administering Microsoft 365 and AI Services (AB-650) practice test is very customizable and you can adjust its time and number of questions.
NEW QUESTION # 71
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. Standard protection is enabled for all recipients.
The subscription contains a mail-enabled security group named Group1. Group1 contains users that require custom inbound anti-spam actions. A custom anti-spam inbound policy named Policy1 is applied to Group1 and has a priority value of 0.
You discover that email sent to the users in Group1 is evaluated by using the Standard preset security policy instead of Policy1.
You need to ensure that Policy1 is applied to Group1. All other recipients must continue to receive the Standard protection settings.
What should you do?
Answer: C
Explanation:
Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti- spam policies.
The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.
Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only.
It cannot override the Standard preset security policy.
Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group ' s members. These users can then be evaluated by Policy1, provided its recipient conditions match.
Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.
Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.
Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.
Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.
Therefore, Group1 must be excluded from the Standard preset security policy.
Microsoft References:
https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies
https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined
NEW QUESTION # 72
You have a Microsoft 365 E5 subscription that contains a user named User1.
You need to perform the following actions:
* Create a shared mailbox named Mbox1 in the subscription.
* Grant User1 the Send As permission for Mbox1.
Which Microsoft 365 portals can you use to perform each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Microsoft Exchange Online supports shared mailbox creation and delegated mailbox permission management through both the Microsoft 365 admin center and Exchange admin center (EAC).
First selection: Exchange admin center and Microsoft 365 admin center only.
Administrators can create shared mailboxes through either administrative interface.
In the Microsoft 365 admin center, navigate to Teams & groups # Shared mailboxes # Add a shared mailbox.
Alternatively, in the Exchange admin center, navigate to Recipients # Mailboxes # Add a shared mailbox.
Both interfaces support creating Mbox1 and configuring its basic mailbox properties.
Second selection: Exchange admin center and Microsoft 365 admin center only.
Both portals support granting Send As permissions.
In the Microsoft 365 admin center, select Mbox1 under Shared mailboxes and open Manage mailbox permissions.
In the Exchange admin center, select Mbox1 under Recipients, open Manage mailbox delegation, and configure Send As permissions for User1.
The Send As permission enables User1 to send messages that appear to originate directly from Mbox1 without displaying User1 as the sender.
The Microsoft Entra admin center manages identity objects, roles, groups, and authentication settings. It does not provide the Exchange mailbox creation and mailbox delegation interfaces required by this question.
Therefore, both tasks can be performed through the Exchange admin center and Microsoft 365 admin center.
Microsoft References:
* Microsoft Learn - Shared mailboxes in Exchange Online .
* Microsoft Learn - Create a shared mailbox .
* Microsoft Learn - Configure shared mailbox permissions
NEW QUESTION # 73
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals.
More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft 365 subscription that uses Microsoft Agent 365. The subscription contains an agent named Agent1.
The compliance team reports that confidential project information might appear in prompts submitted to Agent1 and in responses generated by Agent1.
You need to identify agent interactions that include confidential information in prompts or responses.
Solution: You use Microsoft Purview Information Protection.
Does this meet the goal?
Answer: A
Explanation:
Microsoft Purview Information Protection provides data classification, sensitivity labeling, and protection capabilities for organizational information. However, Information Protection alone does not provide the dedicated investigation workflow required to identify individual AI agent interactions containing confidential information in prompts or responses.
The more appropriate solution is Microsoft Purview Data Security Posture Management (DSPM), using its AI observability and Activity explorer capabilities.
Microsoft DSPM supports visibility into AI agent activities, including Microsoft Agent 365. It can identify interactions involving sensitive information through integrated data classification, audit telemetry, sensitive information types, and trainable classifiers.
Administrators can navigate to the Microsoft Purview portal, open DSPM, and use Discover # Activity explorer # AI activities to investigate AI interactions. The AI observability page also provides agent-specific visibility into potentially sensitive interactions and associated risks.
Microsoft Purview Information Protection contributes classification and labeling capabilities to this process, but simply using Information Protection does not independently deliver the required agent-interaction investigation.
Therefore, the proposed solution does not fully satisfy the requirement, making Option B (No) the appropriate answer.
Microsoft References:
https://learn.microsoft.com/en-us/purview/ai-agent-365
https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about
NEW QUESTION # 74
You have a Microsoft 365 subscription that has an initial domain named contoso.onmicrosoft.com and two verified custom domains named contoso.com and fabrikam.com.
The contoso.com domain is NOT the default domain. No users, groups, or applications reference contoso.com.
The subscription contains the administrator accounts shown in the following table.
You need to delete contoso.com by using an account that is assigned the minimum required Microsoft Entra role.
Which account should you use?
Answer: D
Explanation:
Microsoft Entra ID provides role-based access control (RBAC) for administrative tasks, including the management of verified custom domain names.
Option D is correct because admin1@contoso.onmicrosoft.com holds the Domain Name Administrator role, which is the least-privileged Microsoft Entra built-in role capable of managing custom domains.
Microsoft explicitly documents that the Domain Name Administrator role includes permissions to add, verify, update, and delete custom domain names.
The scenario also satisfies the prerequisites for domain removal: contoso.com is not the default domain, and no users, groups, or applications reference it.
Furthermore, the administrator ' s user principal name uses contoso.onmicrosoft.com, rather than the domain being deleted. This avoids a dependency that would otherwise prevent removal.
Option A is incorrect because the License Administrator role manages licensing assignments and does not provide domain deletion permissions.
Option B is incorrect because the Global Administrator role can delete custom domains but grants significantly broader administrative privileges than necessary.
Option C is incorrect because the User Administrator role manages user and certain group-related operations but does not provide the required domain-management permissions.
Administrators can remove the domain through the Microsoft Entra admin center under Entra ID, Domain names, and Custom domain names.
Therefore, admin1@contoso.onmicrosoft.com is the correct account because it meets the requirement while following the principle of least privilege.
NEW QUESTION # 75
Your company has a Microsoft 365 subscription that contains the domains shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Answer:
Explanation:
Explanation:
An administrator can create usernames that contain the: contoso221018.onmicrosoft.com, east.contoso221018.
onmicrosoft.com, and contoso.com domains; Exchange Online can receive inbound email messages sent to the: contoso221018.onmicrosoft.com domain only Microsoft 365 supports multiple verified domains within a tenant. These domains can be used for Microsoft Entra user principal names, while Exchange Online email routing depends on additional service configuration and DNS records.
The exhibit shows three domains with different status indicators: the default contoso221018.onmicrosoft.com domain is Healthy, contoso.com has Incomplete setup, and east.contoso221018.onmicrosoft.com has No services selected.
First selection: All three domains.
The intended interpretation is that the domains have been added to the tenant and are available for identity naming. A custom domain can be used for a user ' s sign-in name once domain ownership has been verified, even if other Microsoft 365 service configuration is incomplete.
Second selection: The default onmicrosoft.com domain only.
The default tenant domain provides Exchange Online ' s fallback email-routing namespace. In the exhibit, the custom domain has incomplete service configuration, while the additional subdomain has no services selected.
However, there is an important technical limitation: these administrative status indicators alone do not conclusively establish the live external MX records or every Exchange Online accepted-domain setting. Those configurations must be inspected to verify actual inbound mail routing.
The selections above represent the intended examination interpretation, not independent proof of the tenant ' s current DNS configuration.
Microsoft References:
https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain
https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain
NEW QUESTION # 76
......
Our AB-650 exam guide is suitable for everyone whether you are a business man or a student, because you just need 20-30 hours to practice on our AB-650 exam questions, then you can attend to your AB-650 exam. There is no doubt that you can get a great grade. If you follow our AB-650 learning pace, you will get unexpected surprises. What are you waiting for? Just choose Microsoft 365 Certified guide question to improve your knowledge to pass AB-650 exam, which is your testimony of competence. You will get what you are dreaming for.
AB-650 100% Accuracy: https://www.trainingdump.com/Microsoft/AB-650-practice-exam-dumps.html