They found difficulty getting hands on Microsoft AB-650 real exam questions as it is undoubtedly a tough task. Besides this, it is also hard to pass the AB-650 exam on the first attempt. Nervousness and fear of exam is also daunting for applicants. The actual AB-650 Questions being offered by ITexamReview will enable you to obtain the certification without any hassle.
| Section | Weight | Objectives |
|---|---|---|
| Implement security, compliance, and governance for AI and Microsoft 365 | 25-30% | - Secure AI-enabled workloads
|
| Manage Microsoft 365 tenant and identity services | 20-25% | - Manage identity and authentication
|
| Manage Microsoft 365 workloads | 20-25% | - Administer collaboration services
|
| Administer Microsoft 365 Copilot and AI services | 25-30% | - Manage Copilot and AI capabilities
|
>> AB-650 Latest Test Report <<
It is a universally accepted fact that the AB-650 exam is a tough nut to crack for the majority of candidates, but there are still a lot of people in this field who long to gain the related certification so that a lot of people want to try their best to meet the challenge of the AB-650 exam. A growing number of people know that if they have the chance to pass the AB-650 Exam, they will change their present situation and get a more decent job in the near future. More and more people have realized that they need to try their best to prepare for the AB-650 exam.
NEW QUESTION # 119
Your company has a Microsoft 365 subscription that contains the domains shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Answer:
Explanation:
Explanation:
An administrator can create usernames that contain the: contoso221018.onmicrosoft.com, east.contoso221018.
onmicrosoft.com, and contoso.com domains; Exchange Online can receive inbound email messages sent to the: contoso221018.onmicrosoft.com domain only Microsoft 365 supports multiple verified domains within a tenant. These domains can be used for Microsoft Entra user principal names, while Exchange Online email routing depends on additional service configuration and DNS records.
The exhibit shows three domains with different status indicators: the default contoso221018.onmicrosoft.com domain is Healthy, contoso.com has Incomplete setup, and east.contoso221018.onmicrosoft.com has No services selected.
First selection: All three domains.
The intended interpretation is that the domains have been added to the tenant and are available for identity naming. A custom domain can be used for a user ' s sign-in name once domain ownership has been verified, even if other Microsoft 365 service configuration is incomplete.
Second selection: The default onmicrosoft.com domain only.
The default tenant domain provides Exchange Online ' s fallback email-routing namespace. In the exhibit, the custom domain has incomplete service configuration, while the additional subdomain has no services selected.
However, there is an important technical limitation: these administrative status indicators alone do not conclusively establish the live external MX records or every Exchange Online accepted-domain setting. Those configurations must be inspected to verify actual inbound mail routing.
The selections above represent the intended examination interpretation, not independent proof of the tenant ' s current DNS configuration.
Microsoft References:
https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain
https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain
NEW QUESTION # 120
You have a Microsoft 365 subscription that contains a Microsoft Entra security group named Group1. The subscription has self-service password reset (SSPR) disabled.
You need to pilot SSPR for Group1. The solution must require users to use a mobile app notification to reset their password.
What should you configure in the Password reset settings?
Answer: C
Explanation:
Microsoft Entra self-service password reset (SSPR) allows users to reset their passwords without contacting an administrator or helpdesk. Administrators can configure which authentication methods users must complete to verify their identities.
Option A is correct because Authentication methods controls the verification methods available during password reset, including Microsoft Authenticator push notifications.
In the legacy SSPR configuration, administrators navigate to Microsoft Entra admin center # Entra ID # Password reset # Authentication methods.
The Mobile app notification method allows users to verify their identities by responding to a Microsoft Authenticator notification.
An important configuration consideration is that the legacy SSPR experience supports app notifications when two authentication methods are required for password reset. When only one method is required, the mobile application verification code is supported instead.
To restrict the pilot to Group1, administrators must separately configure Properties, enable SSPR for selected users, and select Group1.
Option B configures administrator-specific password reset requirements. Option C controls SSPR enablement and targeting, but not the authentication method itself. Option D controls registration requirements, and Option E configures password reset notifications.
Current documentation qualification: Microsoft has deprecated management of authentication methods through legacy SSPR policies. For new deployments, administrators should configure Microsoft Authenticator through the centralized Authentication methods policy.
NEW QUESTION # 121
You are deploying Microsoft 365 Copilot across a global enterprise network that uses strict firewall and proxy rules.
Users at a branch office report that the Microsoft 365 Copilot chat pane loads in Word and Teams, but prompts consistently time out or fail to stream responses.
You run the Microsoft 365 network connectivity test tool and need to verify the network protocol requirement that allows real-time streaming between client devices and the Copilot service endpoints.
Which protocol and port configuration must be allowed without TLS inspection or proxy interference to resolve the issue?
Answer: D
Explanation:
Microsoft 365 Copilot relies on persistent bi-directional communication channels to stream AI-generated responses from the cloud service back to the client application in real time.
Option B is correct because Microsoft 365 Copilot requires outbound WebSocket Secure (WSS) connections over TCP port 443. Deep packet inspection, TLS decryption, or proxy servers that block or downgrade WebSocket headers will cause Copilot prompts to hang or fail.
Option A is incorrect because SMB over port 445 is used for local file shares and is never used for cloud-to-client Copilot communications.
Option C is incorrect because UDP ports 3478-3481 are used for Microsoft Teams real-time audio/video media transport, not Copilot text streaming.
Option D is incorrect because TCP port 25 is used for Exchange mail flow between mail servers.
Therefore, permitting outbound WebSocket Secure (WSS) traffic over TCP port 443 is required.
Microsoft References:
[https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-requirements](https://www.google.com/search?q=https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-requirements)
NEW QUESTION # 122
You have a Microsoft 365 E5 subscription that contains a group named Group1. Group1 contains an agent named Agent1.
The finance department at your company uses Windows devices onboarded to Microsoft Purview. Microsoft Edge is configured for data loss prevention (DLP), and the Microsoft Purview browser extension is installed for supported non-Microsoft Edge browsers.
Exhibit 1 - DLP Policies
Exhibit 2 - DLP Alerts
The subscription has the DLP policies shown in the following table.
Name
Applies to
Detects
Enforcement behavior
Policy1
Endpoint devices
Credit card numbers or IBAN account numbers
Block prompts to other AI apps when using Microsoft Edge.
Policy2
Endpoint devices and users that have an Adaptive Protection risk level of Elevated Files that have a sensitivity label named Highly Confidential applied or contain U.S. Social Security numbers (SSNs) Block with override for uploads and prompts to other AI apps in supported browsers.
Policy3
Group1
IBAN account numbers in agent-to-human or human-to-agent messages
Audit matching messages in Microsoft Teams and email.
DLP alerts are generated as shown in the following table.
Name
Actor
Risk level
Source
Matched content
Alert1
User1
Elevated
Browser-based AI app file activity
A file labeled as Highly Confidential
Alert2
User2
Minor
Browser-based AI app prompt activity
Prompt text that contains a credit card number
Alert3
Agent1
Not applicable
Agent communication activity
A message that contains an IBAN account number
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Statement
Correct Answer
Policy2 generated Alert1.
Yes
Policy1 generated Alert2.
Yes - assuming the prompt was submitted in Microsoft Edge
Policy1 generated Alert3.
No
Microsoft Purview DLP evaluates sensitive information, user risk levels, protected workloads, and activity types to determine which policies apply.
Statement 1: Yes.
Alert1 involves User1, whose Adaptive Protection risk level is Elevated. The activity involves uploading a file labeled Highly Confidential through a browser-based AI application.
Policy2 targets elevated-risk users and detects files with that sensitivity label. Its Block with override action covers file uploads to supported AI applications. Therefore, Alert1 matches Policy2.
Statement 2: Yes, conditionally.
Alert2 involves User2 submitting a prompt containing a credit card number.
Policy1 detects credit card numbers in prompts submitted to other AI applications through Microsoft Edge.
Unlike Policy2, it does not require an Elevated risk level. User2 ' s Minor risk level therefore does not prevent Policy1 from applying.
However, the exhibit does not confirm which browser User2 used. The intended Yes is valid if the activity occurred in Edge.
Statement 3: No.
Alert3 involves Agent1 communicating a message containing an IBAN account number.
Policy1 applies to endpoint browser prompts, not agent-to-human or human-to-agent communications.
Policy3 specifically audits IBAN-containing agent communications for Group1. Therefore, Alert3 matches Policy3 rather than Policy1.
Microsoft References:
* Microsoft Learn - Prevent sensitive data sharing with AI apps in Microsoft Edge .
* Microsoft Learn - Adaptive Protection in DLP .
* Microsoft Learn - Purview data security and compliance for Agent 365 .
NEW QUESTION # 123
You have a Microsoft 365 subscription that has an initial domain named contoso.onmicrosoft.com and two verified custom domains named contoso.com and fabrikam.com.
The fabrikam.com domain is the default domain.
The contoso.com domain uses managed authentication, and has 750 references across unused user accounts, application identifier URIs, and mail-enabled security groups.
You need to remove contoso.com from the subscription. The solution must minimize manual changes to Microsoft Entra objects.
What should you do?
Answer: B
Explanation:
Microsoft Entra ID supports the ForceDelete operation for removing custom domains that still have references to directory objects. This operation automatically updates supported references, reducing the need for manual administrative changes.
Option C is correct because the domain meets the main ForceDelete prerequisites: it uses managed authentication, is not the default domain, and has fewer than 1,000 references.
However, Microsoft explicitly requires administrators to update or remove domain references from Exchange- managed objects, including mail-enabled security groups and distribution lists, before executing ForceDelete.
After these references are removed, ForceDelete can automatically update eligible user principal names, email addresses, proxy addresses, group addresses, and application identifier URIs to the tenant ' s initial onmicrosoft.com domain.
Option A is incorrect because manually updating all 750 references creates unnecessary administrative effort.
Option B is incorrect because ForceDelete cannot automatically remove all Exchange-managed dependencies.
The mail-enabled security group references must be corrected first.
Option D is incorrect because a default domain cannot be deleted while it remains designated as the default.
Therefore, clearing the Exchange-managed references and using ForceDelete is the most efficient supported approach.
Microsoft References:
* Microsoft Learn - Manage custom domain names and ForceDelete .
* Microsoft Graph - domain: forceDelete .
NEW QUESTION # 124
......
ITexamReview provides you with actual Microsoft AB-650 dumps in PDF format, Desktop-Based Practice tests, and Web-based Practice exams. These 3 formats of Administering Microsoft 365 and AI Services exam preparation are easy to use. This is a printable Microsoft AB-650 PDF dumps file. The Microsoft AB-650 Pdf Dumps enables you to study without any device, as it is a portable and easily shareable format, thus you can study Microsoft AB-650 dumps on your preferred smart device such as your smartphone or in hard copy format.
Detailed AB-650 Study Plan: https://www.itexamreview.com/AB-650-exam-dumps.html