Microsoft AB-650 is a certification exam to test IT professional knowledge. ExamPrepAway is a website which can help you quickly pass the Microsoft certification AB-650 Exams. Before the exam, you use pertinence training and test exercises and answers that we provide, and in a short time you'll have a lot of harvest.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Implement security, compliance, and governance for AI and Microsoft 365 | 25-30% | - Secure AI-enabled workloads
|
| Topic 2: Administer Microsoft 365 Copilot and AI services | 25-30% | - Prepare Microsoft 365 for AI
|
| Topic 3: Manage Microsoft 365 workloads | 20-25% | - Manage devices and applications
|
| Topic 4: Manage Microsoft 365 tenant and identity services | 20-25% | - Configure and manage Microsoft 365 tenants
|
You may feel astonished and doubtful about this figure; but we do make our AB-650 exam dumps well received by most customers. Better still, the 98-99% pass rate of AB-650 exam questions has helped most of the candidates get the certification successfully, which is far beyond that of others in this field. In recent years, supported by our professional expert team, our AB-650 Test Braindumps have grown up and have made huge progress. You can totally rely on our AB-650 learning material for your future learning path.
NEW QUESTION # 13
You have a Microsoft 365 E5 subscription that contains two security groups named Group1 and Group2.
You need to recommend an authentication solution to meet the following requirements:
* Administrators must be able to generate a time-limited code to allow the members of Group1 to authenticate without using their password.
* The members of Group2 must be able to authenticate by confirming a two-digit code on their mobile device.
Which authentication method should you recommend for each group? To answer, drag the appropriate methods to the correct groups. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Answer Area
Correct Selection
Group1
A Temporary Access Pass
Group2
Microsoft Authenticator
Microsoft Entra ID provides several authentication methods for secure sign-in, including Temporary Access Pass (TAP) and Microsoft Authenticator.
First selection: A Temporary Access Pass.
Group1 requires administrators to generate a time-limited authentication code that users can use without entering their existing passwords.
A Temporary Access Pass meets this requirement. It is a time-limited passcode that administrators can issue for one-time or multiple-use authentication.
Administrators can enable TAP through Microsoft Entra admin center # Entra ID # Authentication methods # Policies # Temporary Access Pass.
After enabling the method for Group1, an authorized administrator can generate individual passes for users.
TAP is particularly useful for onboarding passwordless authentication methods and recovering access when users lose their credentials.
Second selection: Microsoft Authenticator.
Group2 requires authentication using a two-digit verification challenge on a mobile device.
Microsoft Authenticator supports number matching, where users enter the number displayed during sign-in into their Authenticator app to approve authentication.
Number matching strengthens MFA by helping prevent accidental approval of fraudulent sign-in requests.
Microsoft enables number matching for Authenticator push notifications. Some same-device mobile application flows instead provide a Yes/No confirmation experience.
The other listed methods do not provide the specific combination of administrator-generated temporary passes and Authenticator number-matching notifications.
Microsoft References:
* Microsoft Learn - Configure Temporary Access Pass
* Microsoft Learn - Microsoft Authenticator number matching
NEW QUESTION # 14
You have a Microsoft 365 subscription.
You have a data loss prevention (DLP) policy that blocks sensitive data from being shared in email messages.
You need to modify the policy so that when an email message containing sensitive data is sent to both external and internal recipients, the message is only prevented from being delivered to the external recipients.
What should you modify?
Answer: A
Explanation:
Microsoft Purview Data Loss Prevention (DLP) enables administrators to control how sensitive information is shared through Exchange Online, SharePoint, OneDrive, and other Microsoft 365 services.
Option C is correct because DLP rule actions determine how Microsoft 365 handles content that matches configured sensitive information conditions.
To restrict only external recipients, administrators should modify the rule ' s Restrict access or encrypt the content in Microsoft 365 locations action.
For Exchange email, configure:
Block only people outside your organization.
This action is designed to prevent external recipients from receiving protected email while preserving internal delivery where supported.
Option A is incorrect because the policy already protects Exchange email. Changing locations would not provide the required recipient-specific enforcement.
Option B is incorrect because conditions determine when a DLP rule matches content, rather than what happens to a message after detection.
Option D is incorrect because exceptions exclude matching content from policy processing instead of defining how individual recipients are blocked.
Important consideration: Microsoft documents that enabled DLP policy tips can prevent users from sending messages containing both internal and external recipients until they remove the external recipients. Therefore, this action does not guarantee transparent delivery splitting in every client.
Microsoft Reference: Microsoft Learn - Data Loss Prevention policy reference .
NEW QUESTION # 15
Your company has an office in London.
You have a Microsoft 365 subscription.
You need to create a Conditional Access policy named Policy1 that meets the following requirements:
* Only FIDO2 passkeys, Windows Hello for Business, and certificates must be supported for authentication.
* The London office must be marked as a trusted location and excluded from Policy1.
How should you configure Authentication strength in Policy1 and what should you use to define named location for the London office? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Answer Area
Correct Selection
Authentication strength
Phishing-resistant MFA
Named location
IP ranges
HOTSPOT Exhibit - White Background with Original Dropdown Options
Microsoft Entra Conditional Access supports authentication strengths and named locations to enforce secure authentication while excluding trusted corporate networks.
First selection: Phishing-resistant MFA.
The built-in Phishing-resistant MFA authentication strength supports the following authentication methods:
* FIDO2 passkeys and security keys
* Windows Hello for Business
* Microsoft Entra certificate-based authentication configured for multifactor authentication This matches the stated requirements. Standard Multifactor authentication and Passwordless MFA permit additional authentication methods that are not necessarily phishing-resistant, so neither provides the required restriction.
Second selection: IP ranges.
Microsoft Entra named locations allow administrators to define trusted corporate locations using public IPv4 or IPv6 address ranges.
Administrators should navigate to Microsoft Entra admin center # Entra ID # Conditional Access # Named locations.
Create an IP ranges named location, enter the London office ' s public IP ranges, and enable Mark as trusted location.
Next, edit Policy1, configure its Network condition, and exclude the London named location.
Countries is inappropriate because the requirement concerns one office rather than the entire United Kingdom. Trusted IPs refers to a legacy multifactor authentication configuration rather than the recommended IP-based named-location method.
Therefore, Phishing-resistant MFA and IP ranges satisfy both requirements.
Microsoft References:
* Microsoft Learn - Conditional Access authentication strengths
* Microsoft Learn - Named locations and trusted networks
NEW QUESTION # 16
You have a Microsoft 365 subscription that uses Microsoft Exchange.
The subscription contains a licensed user mailbox named Mailbox1 that has a primary SMTP address of support@contoso.com. Mailbox1 is 72 GB.
Mailbox1 will no longer be used by a single user. Three support users must manage the existing support email sent to Mailbox1.
You need to configure Mailbox1 access for the support users. The solution must meet the following requirements:
Enable the support users to open Mailbox1.
Preserve all the existing content in Mailbox1.
Configure replies to appear as sent from support@contoso.com.
What should you do?
Answer: C
Explanation:
Converting an existing Exchange Online user mailbox into a shared mailbox allows multiple employees to manage correspondence while preserving its existing messages, calendar information, and mailbox content.
Option B is correct because it satisfies the storage, access, and sender identity requirements.
The critical consideration is the mailbox size. Mailbox1 contains 72 GB of data, exceeding the 50 GB storage limit for an unlicensed shared mailbox. Microsoft requires an appropriate license, such as Exchange Online Plan 2, to increase a shared mailbox ' s primary mailbox capacity to 100 GB.
Consequently, the mailbox must retain suitable licensing after conversion.
Full Access permissions allow support users to open Mailbox1 and manage its existing content. Send As permissions enable users to send replies that appear to originate directly from support@contoso.com, without displaying the individual delegate ' s identity.
Option A is incorrect because removing the license would leave the 72 GB mailbox above the unlicensed shared mailbox storage limit.
Option C is incorrect because Send on Behalf displays the delegate ' s identity and also proposes removing the required license.
Option D does not preserve the existing mailbox as a shared mailbox with the specified delegation permissions.
The appropriate configuration is therefore to convert Mailbox1, grant Full Access and Send As, and retain the necessary license.
Microsoft References:
https://learn.microsoft.com/en-us/microsoft-365/admin/email/convert-user-mailbox-to-shared-mailbox
https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes
NEW QUESTION # 17
You have a Microsoft 365 subscription that uses a domain name of adatum.com.
In Microsoft Entra ID, you set Guest invite restrictions to Only users assigned to specific admin roles can invite guest users.
A user named user1@adatum.com reports that he can no longer invite external users from a domain named contoso.com to collaborate in Microsoft Teams.
You need to modify the Microsoft Entra ID configuration to meet the following requirements:
Ensure that User1 can invite the contoso.com users to Teams.
Ensure that only the contoso.com users can be invited as guests to the Microsoft Entra tenant.
Follow the principle of least privilege.
What should you do for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Ensure that User1 can invite the contoso.com users to Teams: Assign the Guest Inviter role to User1.; Ensure that only the contoso.com users can be invited as guests to the Microsoft Entra tenant: From the External collaboration settings, edit the Collaboration restrictions settings.
Microsoft Entra External ID provides separate administrative controls for guest invitation permissions and permitted external collaboration domains.
First selection: Assign the Guest Inviter role to User1.
The tenant currently permits guest invitations only from users assigned specific administrative roles.
Assigning the Guest Inviter role allows User1 to invite external collaborators without granting broader privileges such as Global Administrator or User Administrator.
This satisfies the principle of least privilege because User1 receives the permission necessary to perform guest invitations without unnecessary administrative authority.
Second selection: Edit the Collaboration restrictions settings.
Microsoft Entra External collaboration settings provide domain-based controls for external invitations. To restrict guest invitations to contoso.com, administrators must configure Collaboration restrictions to allow invitations only to specified domains and add contoso.com to the permitted domain list.
This prevents invitations to users from other external domains while allowing authorized inviters, including User1, to invite users from contoso.com.
Cross-tenant outbound access settings do not provide the required tenant-wide invitation domain allowlist.
Guest user access restrictions control what existing guests can see in the directory rather than which domains can be invited.
Both configurations are necessary to satisfy the stated requirements.
Microsoft References:
https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure
https://learn.microsoft.com/en-us/entra/external-id/allow-deny-list
NEW QUESTION # 18
......
Our AB-650 guide torrent has gone through strict analysis and summary according to the past exam papers and the popular trend in the industry and are revised and updated according to the change of the syllabus and the latest development conditions in the theory and the practice. The AB-650 exam questions have simplified the sophisticated notions. The software boosts varied self-learning and self-assessment functions to check the learning results. The software of our AB-650 Test Torrent provides the statistics report function and help the students find the weak links and deal with them.
Review AB-650 Guide: https://www.examprepaway.com/Microsoft/braindumps.AB-650.ete.file.html