For candidates who want to evaluate and enhance their Microsoft AB-650 Test Preparation online, the web-based practice test is a perfect choice. You can attempt our 60 Microsoft web-based practice exam whenever it suits you because it is accessible from any location with an internet connection. This Administering Microsoft 365 and AI Services browser-based practice exam helps you overcome exam fear as it simulates the environment of the real test.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Manage Microsoft 365 tenant and identity services | 20-25% | - Configure and manage Microsoft 365 tenants
|
| Topic 2: Administer Microsoft 365 Copilot and AI services | 25-30% | - Manage Copilot and AI capabilities
|
| Topic 3: Implement security, compliance, and governance for AI and Microsoft 365 | 25-30% | - Protect organizational data
|
| Topic 4: Manage Microsoft 365 workloads | 20-25% | - Manage devices and applications
|
For most users, access to the relevant qualifying examinations may be the first, so many of the course content related to qualifying examinations are complex and arcane. According to these ignorant beginners, the AB-650 Exam Questions set up a series of basic course, by easy to read, with corresponding examples to explain at the same time, the Administering Microsoft 365 and AI Services study question let the user to be able to find in real life and corresponds to the actual use of learned knowledge, deepened the understanding of the users and memory. Because many users are first taking part in the exams, so for the exam and test time distribution of the above lack certain experience, and thus prone to the confusion in the examination place, time to grasp, eventually led to not finish the exam totally.
NEW QUESTION # 88
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365. Strict protection is enabled for all recipients.
The subscription contains a group named Group1 that contains all the mailboxes for your company's marketing department.
Several marketing department mailboxes recently sent high volumes of external email after a credential was compromised.
You need to enforce a lower external message limit for Group1. The solution must automatically restrict senders that reach the limit.
What should you do?
Answer: E
Explanation:
Microsoft Defender for Office 365 supports outbound spam policies that control sending limits and automatically restrict accounts exhibiting suspicious outbound email activity.
Option A is correct because a custom outbound anti-spam policy can target Group1 specifically, allowing administrators to enforce more restrictive sending limits for marketing department mailboxes without changing the organization-wide configuration.
Administrators can navigate to Microsoft Defender portal # Email & collaboration # Policies & rules # Threat policies # Anti-spam, and create a custom outbound policy.
The policy should include Group1, configure the appropriate external recipient limit, and select Restrict the user from sending mail as the action when a limit is reached.
Option B is incorrect because modifying the default outbound policy would affect other users not covered by a higher-priority custom outbound policy.
Option C is incorrect because Strict preset security policies do not contain configurable outbound spam policies.
Option D is incorrect because Standard preset protection cannot provide a custom outbound sending limit.
Option E is incorrect because inbound anti-spam policies protect incoming email rather than restricting compromised users ' outgoing messages.
Crucially, Microsoft ' s documentation confirms that Strict and Standard preset security policies do not override outbound spam policies. Therefore, the custom outbound policy can apply to Group1 without excluding its members from Strict protection.
Microsoft References:
* Microsoft Learn - Configure outbound spam policies .
* Microsoft Learn - Preset security policies .
NEW QUESTION # 89
You have a Microsoft 365 subscription that contains an agent named Agent1. Agent1 uses a Model Context Protocol (MCP) server named MCP1.
An MCP server named MCP2 has Status set to Available. MCP2 exposes procurement data but has NOT completed a security review.
You need to prevent Agent1 from invoking MCP2. The solution must ensure that MCP1 and Agent1 remain available.
What should you do in Microsoft Agent 365?
Answer: D
Explanation:
Microsoft Agent 365 provides centralized governance of tools and Model Context Protocol (MCP) servers that AI agents use to access external services and organizational data.
Option D is correct because the Microsoft 365 admin center ' s Tools management interface enables administrators to block an individual MCP server without disabling the agent or unrelated MCP servers.
In this scenario, MCP2 is currently marked Available but has not completed its security review. Allowing agents to invoke MCP2 could expose procurement information before appropriate security controls have been validated.
Administrators can navigate to the Microsoft 365 admin center, select Agents # Tools # Registry, locate MCP2, and select Block.
Blocking MCP2 changes its availability and prevents agents from using the tools exposed by that server.
MCP1 remains available because it is a separate MCP server, and Agent1 itself is not disabled.
Option A is incorrect because agent management rules do not provide the direct server-specific blocking action requested.
Option B is incorrect because the Agent Registry manages agents, whereas the Tools Registry provides MCP server controls.
Option C is incorrect because policy templates are not the direct mechanism for blocking an individual MCP server.
Therefore, blocking MCP2 from Tools satisfies the requirements.
Microsoft References:
https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-plugins-skills-mcp-servers
https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-tools-overview
NEW QUESTION # 90
You have a Microsoft 365 E5 subscription.
You need to configure a group naming policy.
Which portal should you use, and to which types of groups will the policy apply? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Microsoft Entra ID provides a group naming policy that enables organizations to enforce consistent naming conventions for Microsoft 365 groups.
First selection: The Microsoft Entra admin center.
Administrators configure the naming policy by navigating to the Microsoft Entra admin center and selecting Microsoft Entra ID # Groups # Naming policy.
The policy supports two principal capabilities: prefix-suffix naming conventions and custom blocked words.
Prefix-suffix rules automatically add predefined text or supported user attributes, such as Department or Company, to group names. Blocked-word policies prevent users from creating Microsoft 365 groups with prohibited terminology.
Second selection: Microsoft 365 only.
The Microsoft Entra group naming policy applies specifically to Microsoft 365 groups, including groups created through Microsoft Teams, Outlook, SharePoint, and other supported Microsoft 365 applications.
It does not apply to ordinary security groups, mail-enabled security groups, or Exchange distribution groups.
Exchange distribution groups can have separate naming policies configured through Exchange administration, but these are distinct from the Microsoft Entra Microsoft 365 group naming policy.
Microsoft 365 E5 includes the licensing required for this functionality.
An additional consideration is that certain privileged administrator roles are exempt from enforcement, and existing Microsoft 365 groups are not automatically renamed when the policy is introduced.
Therefore, the correct selections are the Microsoft Entra admin center and Microsoft 365 groups only.
NEW QUESTION # 91
You need to evaluate the configuration of AU1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:
(device.deviceTrustType -eq " Workplace " ) -and
(device.deviceOSType -in [ " Windows " , " Android " ])
Statement 1: No.
Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.
Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.
Statement 2: Yes.
Device2 runs Windows 11 and is Microsoft Entra registered.
Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.
Statement 3: Yes.
The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.
Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.
Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.
Microsoft References:
* Manage dynamic membership in administrative units .
* Microsoft Entra dynamic membership rules and device attributes .
NEW QUESTION # 92
You are deploying Microsoft 365 Copilot across a global enterprise network that uses strict firewall and proxy rules.
Users at a branch office report that the Microsoft 365 Copilot chat pane loads in Word and Teams, but prompts consistently time out or fail to stream responses.
You run the Microsoft 365 network connectivity test tool and need to verify the network protocol requirement that allows real-time streaming between client devices and the Copilot service endpoints.
Which protocol and port configuration must be allowed without TLS inspection or proxy interference to resolve the issue?
Answer: D
Explanation:
Microsoft 365 Copilot relies on persistent bi-directional communication channels to stream AI-generated responses from the cloud service back to the client application in real time.
Option B is correct because Microsoft 365 Copilot requires outbound WebSocket Secure (WSS) connections over TCP port 443. Deep packet inspection, TLS decryption, or proxy servers that block or downgrade WebSocket headers will cause Copilot prompts to hang or fail.
Option A is incorrect because SMB over port 445 is used for local file shares and is never used for cloud-to-client Copilot communications.
Option C is incorrect because UDP ports 3478-3481 are used for Microsoft Teams real-time audio/video media transport, not Copilot text streaming.
Option D is incorrect because TCP port 25 is used for Exchange mail flow between mail servers.
Therefore, permitting outbound WebSocket Secure (WSS) traffic over TCP port 443 is required.
Microsoft References:
[https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-requirements](https://www.google.com/search?q=https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-requirements)
NEW QUESTION # 93
......
As we all know, sometimes the right choice can avoid the waste of time, getting twice the result with half the effort. Especially for AB-650 preparation materials, only by finding the right ones can you reduce the pressure and help yourself to succeed. If you haven't found the right materials yet, please don't worry. Maybe our AB-650 Practice Engine can give you a leg up which is our company's flagship product designed for the AB-650 exam.
New AB-650 Exam Question: https://www.itbraindumps.com/AB-650_exam.html