Free AB-650 practice test: 30 questions with answers

Guest access combined with group expiration or access reviews limits the time an external user can keep access. Permanent accounts, never-expiring links and administrator roles all give access beyond the requirement.

PIM provides eligible role assignments that are activated on demand, with optional approval and time limits. Permanent assignments and shared passwords increase standing privilege, and Conditional Access does not manage role activation.

Administrative units limit a role's scope to a defined set of users or groups, which matches the regional requirement. A second tenant is excessive, global administrator grants tenant-wide rights, and removing roles prevents the work from being done.

Phishing-resistant methods such as FIDO2 security keys and passkeys can be enabled in the authentication methods policy and required through Conditional Access. SMS and security questions are weaker, and a shared PIN offers no protection.

Sign-in logs show each authentication attempt with the failure reason and the Conditional Access policies that were evaluated. Teams recordings, message traces and site usage reports do not show sign-in evaluation details.

A Conditional Access policy can use named locations to exclude trusted offices and require MFA for other locations. Tenant-wide settings cannot be scoped this way, disabling MFA removes protection, and guest-only MFA leaves employees unprotected.

Entra Password Protection blocks weak and common passwords, and a custom banned list adds organization-specific terms such as the company name. Frequent changes encourage weaker choices, and plain text or shared passwords are unsafe.

Defender for Office 365 investigation and response tools locate the messages across mailboxes and can soft delete them quickly. Exporting, tenant-wide mail shutdown and manual deletion are slower or disruptive.

Attack simulation training runs phishing simulations and assigns training to users who interact with them. Safe Links, anti-spam quarantine and auditing protect or record mail but do not run training campaigns.

A DLP policy scoped to Teams can detect sensitive information types such as credit card numbers and block or warn the sender. Retention deletes content rather than preventing the share, audit searches are after the fact, and profile labels do not cover chat content.

Copilot respects the user's existing permissions, so oversharing in SharePoint can expose sensitive content in answers. Reviewing permissions and labels first closes the gap. Enabling broadly first, deleting sites and disabling search do not address the data readiness issue.

Web search for Copilot is managed in the admin settings and can be scoped to groups for a pilot. Tenant-wide blocks or unscoped allowance do not match the pilot requirement, and browser extensions are not the control.

Copilot usage reports in the Microsoft 365 admin center show adoption by workload over time. Mail flow, Azure budgets and audit logs do not report Copilot adoption.

Agents in the registry are reviewed and then published or rejected by an administrator, which controls what users can install. Mailbox rules, site templates and meeting policies do not govern agent publication.

Copilot respects the user's permissions and the protection on content, so labels with encryption and tight site permissions limit what it can use. Public sites, one-day deletion and anonymous links all widen access or do not restrict Copilot's reach.

Data location commitments and the access controls that apply by region determine whether Copilot can be enabled for those users. Icons, site counts and wallpapers have no bearing on data protection.

Usage and adoption reports show which licensed users actively use Copilot, which helps reclaim unused licenses. Mail trace, domain status and named locations do not report usage.

Copilot settings include controls for third-party AI providers, so administrators can decide which are allowed. Transport rules, sharing links and guest access do not manage AI providers.

Agents have identities in Entra, so Conditional Access can block their access to specific resources while the review proceeds. Deleting mailboxes, granting broad rights and publishing to all users do not control the agent's access.

Agent 365 provides monitoring of agent activity, which covers what agents access and how they behave. Mailbox audit logs cover mailbox actions, call history covers calls, and the recycle bin holds deleted files.

Group-based licensing assigns and removes licenses automatically based on group membership, which matches a join-driven process. Manual assignment does not scale, purchasing pools does not assign licenses, and MFA is an authentication control.

Microsoft 365 Backup can restore OneDrive content to an earlier point in time, which is the purpose here. Deleting the account destroys the data, eDiscovery exports content for legal review, and labels classify content rather than restore it.

A shared mailbox lets members open and reply from the same mailbox with their own accounts, and permissions define who can read and send. A shared password is insecure, room mailboxes are for resources, and archive mailboxes hold older items.

Network connectivity insights show the network conditions that affect Microsoft 365 experiences such as Teams calls, which helps find the cause. Branding, group ownership and retention labels do not report network performance.

Service health reports service incidents and advisories, and notifications can be configured to alert administrators. Usage reports show adoption, Secure Score shows security posture, and sign-in logs record authentication events.

Organizational branding in the admin center controls the logo, company URL, themes and backgrounds used across the tenant. Mailbox retention, named locations and threat policies control other areas.

Group-based licensing assigns licenses to members automatically and removes them when membership ends. Manual pre-assignment, separate tenants and device-only licensing are not how it works.

Microsoft 365 verifies domain ownership through a TXT (or MX) record that the admin adds at the DNS provider, and the record value is supplied during setup. The other record types are unrelated to verifying ownership.

Group-based licensing keeps the assignment current as people join or leave the group, which fits department changes. Assigning to all users wastes licenses, and manual monthly assignment and self-purchase do not scale or fit the policy.

Team owners manage channels and membership, and promoting a member to owner gives exactly that scope. Recreating the team loses history, a global administrator role is far broader than needed, and sharing passwords is unsafe.