Here in this Desktop practice test software, the Administering Microsoft 365 and AI Services (AB-650) practice questions given are very relevant to the actual Administering Microsoft 365 and AI Services (AB-650) exam. It is compatible with Windows computers. PrepPDF provides its valued customers with customizable Administering Microsoft 365 and AI Services (AB-650) practice exam sessions. The Administering Microsoft 365 and AI Services (AB-650) practice test software also keeps track of the previous Microsoft AB-650 practice exam attempts.
| Section | Weight | Objectives |
|---|---|---|
| Manage and secure AI services in Microsoft 365 | 35-40% | - Enable and manage Microsoft 365 Copilot
|
| Configure and manage Microsoft 365 tenants and workloads | 20-25% | - Manage Microsoft 365 workloads
|
| Govern and secure Microsoft 365 tenants and workloads | 40-45% | - Implement and manage authentication and access
|
>> AB-650 Valid Exam Simulator <<
Our AB-650 study quiz boosts high quality and we provide the wonderful service to the client. We boost the top-ranking expert team which compiles our AB-650 guide prep elaborately and check whether there is the update every day and if there is the update the system will send the update automatically to the client. The content of our AB-650 Preparation questions is easy to be mastered and seizes the focus to use the least amount of answers and questions to convey the most important information.
NEW QUESTION # 42
Your organization develops custom enterprise agents that are registered and governed by using Microsoft Entra Agent ID.
The security team mandates that an autonomous finance agent named FinanceAgent01 must only be allowed to authenticate and access Microsoft Graph APIs when originating from your corporate Azure virtual network's public IP range.
You need to enforce this network location restriction on FinanceAgent01 without affecting human user sign-ins or standard enterprise applications.
What should you do in the Microsoft Entra admin center?
Answer: A
Explanation:
Microsoft Entra ID extends identity governance and Conditional Access capabilities to non-human identities, including service principals and AI agents managed via Microsoft Entra Agent ID.
Option B is correct because Conditional Access for workload and agent identities allows administrators to select specific single-tenant service principals or agent identities and enforce access controls-such as blocking access outside of trusted Named Locations-when the agent requests tokens for target resources like Microsoft Graph.
Option A is incorrect because Continuous Access Evaluation (CAE) handles near real-time token revocation for critical events and cannot be scoped independently as a standalone network policy without Conditional Access.
Option C is incorrect because Microsoft Entra Password Protection enforces password complexity rules for human users and does not restrict token requests from workload or agent identities based on IP ranges.
Option D is incorrect because Restricted Management Administrative Units limit which administrators can modify an object in Entra ID, rather than restricting runtime network access for an agent.
Therefore, creating a Conditional Access policy targeting workload/agent identities with a Named Location condition meets the requirement.
Microsoft References:
[https://learn.microsoft.com/en-us/entra/identity/conditional-access/workload-identity](https://www.google.com/search?q=https://learn.microsoft.com/en-us/entra/identity/conditional-access/workload-identity)
NEW QUESTION # 43
You have a Microsoft 365 subscription that contains a Microsoft SharePoint communication site named Site1 and a security group named Group1.
Some users that are outside of Group1 have direct permissions or sharing links to the content in Site1.
You need to ensure that users can access Site1 and its content only when they meet both of the following conditions.
* The user is a member of Group1.
* The user has SharePoint permissions to the content.
The solution must meet the following requirements:
* Apply only to Site1.
* Preserve the existing SharePoint permissions.
* Minimize administrative effort.
What should you do?
Answer: C
Explanation:
Microsoft SharePoint Restricted Access Control (RAC) provides an additional authorization boundary for SharePoint sites. It restricts site and content access to members of designated Microsoft Entra security groups or Microsoft 365 groups while preserving existing SharePoint permissions.
Option C is correct because configuring Restricted Access Control for Site1 and specifying Group1 satisfies both conditions simultaneously. Users must belong to Group1 and already possess appropriate SharePoint permissions. Membership in Group1 alone does not grant access.
Users outside Group1 are denied access even if they have direct permissions or previously received sharing links. Restricted Access Control can be configured for an individual communication site without modifying its existing permission assignments.
Option A is incorrect because sharing restrictions primarily control sharing operations rather than comprehensively enforcing the existing-content access boundary required.
Option B is incorrect because Restricted Content Discovery limits content visibility in organization-wide search and Microsoft 365 Copilot but does not prevent users with existing permissions from directly accessing files.
Option D is incorrect because manually changing SharePoint permissions could achieve access restrictions but would violate the requirement to preserve existing permissions and minimize administrative effort.
Therefore, configuring Restricted Access Control specifically for Site1 is the appropriate solution.
Microsoft Reference: Microsoft Learn - Restrict SharePoint site access .
Topic 1, Contoso Ltd
Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas.
Existing Environment Microsoft Entra configuration Contoso has an Azure subscription. Contoso has a Microsoft 365 E5 subscription. Contoso has a Microsoft Entra tenant named contoso.com. The tenant has an administrative unit named AU1 that contains the following membership rule. (device.deviceTrustType -eq
"Workplace") and (device.deviceOSType -in ["Windows", "Android"]) The tenant contains the cloud-only users shown in the following table.
The tenant contains the groups shown in the following table.
The tenant contains the devices shown in the following table.
All the devices are managed by using Microsoft Intune. Microsoft Entra authentication methods Contoso contains an Authentication methods policy for Microsoft Authenticator that has the following settings:
Include: Group1 Exclude: Group3 Authentication mode: Passwordless Privileged Identity Management (PIM) configuration Privileged roles are managed by using Privileged Identity Management (PIM). The PIM settings for the AI Administrator role are configured as shown in the following table.
Email configuration Each user has a Microsoft Exchange mailbox. Contoso contains an anti-spam outbound policy named Antispam1 that has the following configurations: Included groups: Group4 Excluded users:
User2 Set an external message limit: 3 Set an internal message limit: 5 Set a daily message limit: 13 Restriction placed on users who reach the message limit: Restrict the user from sending mail Microsoft SharePoint configuration Contoso has a Microsoft SharePoint site named Site1 that stores the following types of content and various other documents: Project documents: All the documents have a project code that includes the letters PR, followed by a dash and nine digits (for example PR-123456789). Proposal documents:
All the documents have a customer ID that includes seven to 10 alphanumerical characters. All the customer IDs are recorded in a Microsoft Excel workbook. Feedback forms: All the documents were created by using the same template. Microsoft AI services Contoso implements the following Microsoft AI services: Microsoft
365 Copilot for selected users Microsoft Foundry agents, including an agent named Agent1 Requirements Planned changes Contoso plans to implement the following changes: Issue new Android devices to the Group1 users. Assign Microsoft 365 Copilot licenses to the users in Group1. Add an additional email address alias for the users in Group4. Create a Conditional Access policy named CAPolicy1 for Group3. Disable web search for Microsoft 365 Copilot and Microsoft 365 Copilot Chat. Create classifiers to identify project documents and proposal documents stored on Site1. Technical requirements Contoso identifies the following technical requirements: The users in Group3 that access Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA). Microsoft 365 Copilot responses must NOT use content from the project documents stored on Site1. Microsoft 365 Copilot responses must use content from only Microsoft 365 locations. The total costs of Agent1 must be monitored and evaluated monthly. All the Android devices must be registered in Microsoft Entra. Administrative effort must be minimized.
Administrative costs must be minimized.
NEW QUESTION # 44
You have a Microsoft 365 subscription that uses Microsoft Defender for Office 365. Standard protection is enabled for all recipients.
The subscription contains a mail-enabled security group named Group1. Group1 contains users that require custom inbound anti-spam actions. A custom anti-spam inbound policy named Policy1 is applied to Group1 and has a priority value of 0.
You discover that email sent to the users in Group1 is evaluated by using the Standard preset security policy instead of Policy1.
You need to ensure that Policy1 is applied to Group1. All other recipients must continue to receive the Standard protection settings.
What should you do?
Answer: B
Explanation:
Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti- spam policies.
The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.
Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only.
It cannot override the Standard preset security policy.
Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group ' s members. These users can then be evaluated by Policy1, provided its recipient conditions match.
Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.
Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.
Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.
Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.
Therefore, Group1 must be excluded from the Standard preset security policy.
Microsoft References:
https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies
https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined
NEW QUESTION # 45
You have a Microsoft 365 subscription that uses Microsoft Agent 365. The subscription contains two security groups named Group1 and Group2.
Users create agents by using Agent Builder in Microsoft 365 Copilot.
You need to configure Agent settings to meet the following requirements:
* Only the users in Group1 must be able to interact with the agents.
* Only the users in Group2 must be able to distribute the agents to your organization.
What should you configure for each requirement? To answer, drag the appropriate settings to the correct requirements. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Microsoft Agent 365 provides centralized governance settings in the Microsoft 365 admin center to control who can interact with AI agents and who can distribute agents throughout the organization.
First selection: User access.
The User access setting determines which users or security groups are permitted to access and interact with agents.
Administrators can navigate to Microsoft 365 admin center # Agents # Settings # User access.
Under the access configuration, administrators should select Specific users or groups and assign Group1.
This restricts agent interaction to members of Group1 and prevents users outside the approved group from accessing agents through the governed experience.
Second selection: Sharing.
The Sharing setting determines which users can distribute agents created through Microsoft Copilot Agent Builder.
Administrators should navigate to Agents # Settings # Sharing, select Specific users or groups, and assign Group2.
This permits members of Group2 to distribute agents organization-wide while preventing other users from using organization-wide sharing.
The remaining settings serve different purposes. Agent Management Rules automate governance actions, Allowed agent types controls permitted publisher categories, and Policy template provides predefined governance configurations.
Therefore, User access controls agent interaction, while Sharing controls organization-wide distribution.
NEW QUESTION # 46
You need to implement CAPolicy1. The solution must meet the technical requirements.
Which two Conditional Access settings should you configure? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.
The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).
First selection: Sign-in risk.
Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.
Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.
Second selection: Grant.
The Grant access control determines which authentication requirements must be satisfied before access is permitted.
Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.
Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.
Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.
NEW QUESTION # 47
......
The trick to the success is simply to be organized, efficient, and to stay positive about it. If you are remain an optimistic mind all the time when you are preparing for the AB-650 exam, we deeply believe that it will be very easy for you to successfully pass the exam, and get the related certification in the near future. Of course, we also know that how to keep an optimistic mind is a question that is very difficult for a lot of people to answer. Because the AB-650 Exam is so difficult for a lot of people that many people have a failure to pass the exam.
AB-650 Free Dump Download: https://www.preppdf.com/Microsoft/AB-650-prepaway-exam-dumps.html