To take a good control of your life, this AB-650 exam is valuable with high recognition certificate. Actually getting a meaningful certificate by passing related AB-650 exam is also becoming more and more popular. So finding the perfect practice materials is pivotal for it. You may be constrained by a number of factors like lack of processional skills, time or money to deal with the practice exam ahead of you. While our AB-650 Study Materials can help you eliminate all those worries one by one.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Implement security, compliance, and governance for AI and Microsoft 365 | 25-30% | - Protect organizational data
|
| Topic 2: Administer Microsoft 365 Copilot and AI services | 25-30% | - Manage Copilot and AI capabilities
|
| Topic 3: Manage Microsoft 365 workloads | 20-25% | - Administer collaboration services
|
| Topic 4: Manage Microsoft 365 tenant and identity services | 20-25% | - Manage identity and authentication
|
Since different people have different preferences, we have prepared three kinds of different versions of our AB-650 practice test: PDF, Online App and software. Last but not least, our customers can accumulate exam experience as well as improving their exam skills in the mock exam. And your success is 100 guaranteed for our pass rate of AB-650 Exam Questions is as high as 99% to 100%. And We have put substantial amount of money and effort into upgrading the quality of our AB-650 Exam Preparation materials.
NEW QUESTION # 14
You have a Microsoft 365 E5 subscription.
You create a data loss prevention (DLP) policy named DLP1.
You need to ensure that endpoint rule actions are available in the advanced DLP rules for DLP1.
To which location should you apply DLP1?
Answer: A
Explanation:
Microsoft Purview Endpoint Data Loss Prevention (Endpoint DLP) protects sensitive information on managed endpoint devices. To make endpoint-specific rule actions available when configuring advanced DLP rules, the policy must include the Devices location.
Endpoint DLP enables organizations to monitor and restrict how users interact with sensitive information on supported Windows and macOS devices. Its policy actions can control activities such as copying sensitive files to USB storage, printing documents, transferring files through network shares, and uploading information through supported applications or browsers.
When administrators select Devices as the DLP policy location, the relevant endpoint-specific conditions and actions become available for rule configuration.
Option A, Instances, relates to connected cloud application instances and does not activate endpoint DLP rule actions.
Option B, On-premises repositories, applies to information protection scenarios involving on-premises data repositories rather than endpoint activity controls.
Option D, OneDrive accounts, enables DLP protection for files stored in OneDrive for Business but does not provide the endpoint-specific controls required by the question.
Therefore, DLP1 must be applied to the Devices location to expose and configure endpoint rule actions.
Microsoft References:
https://learn.microsoft.com/en-us/purview/endpoint-dlp-create-policy-device-scoping
NEW QUESTION # 15
You have a Microsoft 365 subscription.
Corporate management wants evidence of Microsoft 365 Copilot adoption trends across paid Copilot users.
You need to provide the evidence by using a Microsoft 365 admin center usage report.
What should you use?
Answer: D
Explanation:
The Microsoft 365 Copilot usage report provides organizational insights into how licensed users adopt and interact with Microsoft 365 Copilot across supported Microsoft 365 applications.
Option C is correct because the report is specifically designed to measure Copilot adoption, engagement, and utilization among enabled users.
Administrators can access it through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft Copilot, and the Copilot usage report.
The report provides metrics such as enabled users, active users, active-user rates, and adoption trends across Microsoft 365 workloads, including Word, Excel, PowerPoint, Outlook, and Teams.
It also provides historical trend views that management can use to evaluate whether licensed employees are adopting Copilot over time.
Option A is incorrect because the Copilot Chat usage report focuses on conversational activity in Copilot Chat rather than providing the broader licensed Copilot adoption reporting requested.
Option B is incorrect because Copilot credits reporting focuses on usage-based consumption and associated billing rather than adoption patterns among licensed users.
Option D is incorrect because the Microsoft 365 apps usage report measures application activity more generally, rather than Copilot-specific adoption.
Therefore, the Microsoft 365 Copilot usage report provides the appropriate management evidence.
Microsoft References:
https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage
NEW QUESTION # 16
You have a Microsoft 365 subscription that contains the users shown in the following table.
The Global Administrator role has the Privileged Identity Management (PIM) settings shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access to privileged roles through eligible assignments and configurable role activation requirements.
Statement 1: Yes.
User1 has an eligible Global Administrator assignment. The PIM configuration specifies Require justification on activation: Yes. Therefore, User1 must submit a business justification when activating the role. The user must also satisfy the configured multifactor authentication requirement.
Statement 2: No.
User2 has an assigned (active) Global Administrator role rather than an eligible assignment. Active assignments provide permissions without requiring role activation. Consequently, the configured MFA-on- activation requirement does not apply to User2 in the manner described. Separate Conditional Access policies may still require MFA during sign-in.
Statement 3: No.
User3 has an eligible Global Administrator assignment. The activation maximum duration is eight hours, meaning each activation can remain active for no longer than eight hours.
However, this does not terminate the underlying eligibility. The eligible assignment is configured to expire after 15 days.
After an eight-hour activation expires, User3 can activate the role again, provided the eligible assignment remains valid and the activation requirements are satisfied.
The distinction between activation duration and eligibility duration is fundamental to Microsoft Entra PIM.
Microsoft References:
* Microsoft Learn - Configure PIM role settings .
* Microsoft Learn - Activate Microsoft Entra roles in PIM .
* Microsoft Learn - Assign eligible and active roles .
NEW QUESTION # 17
You have a Microsoft 365 subscription that has an initial domain named contoso.onmicrosoft.com and two verified custom domains named contoso.com and fabrikam.com.
The fabrikam.com domain is the default domain.
The contoso.com domain uses managed authentication, and has 750 references across unused user accounts, application identifier URIs, and mail-enabled security groups.
You need to remove contoso.com from the subscription. The solution must minimize manual changes to Microsoft Entra objects.
What should you do?
Answer: C
Explanation:
Microsoft Entra ID supports the ForceDelete operation for removing custom domains that still have references to directory objects. This operation automatically updates supported references, reducing the need for manual administrative changes.
Option C is correct because the domain meets the main ForceDelete prerequisites: it uses managed authentication, is not the default domain, and has fewer than 1,000 references.
However, Microsoft explicitly requires administrators to update or remove domain references from Exchange- managed objects, including mail-enabled security groups and distribution lists, before executing ForceDelete.
After these references are removed, ForceDelete can automatically update eligible user principal names, email addresses, proxy addresses, group addresses, and application identifier URIs to the tenant ' s initial onmicrosoft.com domain.
Option A is incorrect because manually updating all 750 references creates unnecessary administrative effort.
Option B is incorrect because ForceDelete cannot automatically remove all Exchange-managed dependencies.
The mail-enabled security group references must be corrected first.
Option D is incorrect because a default domain cannot be deleted while it remains designated as the default.
Therefore, clearing the Exchange-managed references and using ForceDelete is the most efficient supported approach.
Microsoft References:
* Microsoft Learn - Manage custom domain names and ForceDelete .
* Microsoft Graph - domain: forceDelete .
NEW QUESTION # 18
You have a Microsoft 365 subscription.
Your company has multiple branch offices, including a branch office named Branch1. The users in Branch1 connect to Microsoft 365 by using a corporate web proxy.
On the Network connectivity page in the Microsoft 365 admin center, Branch1 displays the following network insight:
"We're detecting WebSocket (WSS) connection failures to the domain: *.cloud.microsoft, which causes Copilot to not work correctly for your users." HTTPS access to Microsoft 365 apps from Branch1 succeeds.
You need to resolve the insight without changing connectivity for the other branch offices.
What should you configure?
Answer: D
Explanation:
Microsoft 365 Copilot relies on secure WebSocket (WSS) connections to support real-time, bidirectional communication between client applications and Microsoft cloud services.
Option A is correct because the reported Network connectivity insight specifically identifies WebSocket connection failures for hosts within *.cloud.microsoft.
Microsoft documentation explains that this insight occurs when a network device or web proxy prevents successful WebSocket connections. Administrators should configure the affected proxy to permit WebSocket protocol connections, including the HTTP-to-WebSocket upgrade process, for the required Microsoft 365 endpoints.
Because the problem affects only Branch1, the configuration should be applied to the Branch1 web proxy policy. This resolves the connectivity issue without changing policies for other offices.
Option B is incorrect because the reported failure concerns WebSocket connectivity, not DNS resolution or regional endpoint selection.
Option C is incorrect as the best answer because TLS inspection can interfere with WebSocket connections, but the scenario does not establish that TLS inspection is the cause. Exempting endpoints from TLS inspection may be appropriate after further diagnosis, but allowing the required WebSocket protocol directly addresses Microsoft ' s reported insight.
Option D is incorrect because standard HTTPS connectivity already succeeds. Allowing HTTPS alone does not guarantee successful WebSocket protocol upgrades.
Therefore, the Branch1 proxy must allow WSS connections to the required Microsoft 365 hosts.
Microsoft References:
* Microsoft 365 Network Insights .
* Review Microsoft 365 network connection failures and WebSocket errors .
NEW QUESTION # 19
......
It is known to us that getting the AB-650 certification is not easy for a lot of people, but we are glad to tell you good news. The AB-650 study materials from our company can help you get the certification in a short time. Now we are willing to introduce our AB-650 Practice Questions to you in detail, we hope that you can spare your valuable time to have a try on our products. Please believe that we will not let you down!
Latest AB-650 Exam Simulator: https://www.dumpstests.com/AB-650-latest-test-dumps.html