Free Practice Questions for Microsoft AB-650 Exam

Answer Area

Correct Selection

Group type

Microsoft 365

Membership type

Dynamic User

Microsoft 365 groups provide integrated collaboration resources, including a shared email address, an Exchange Online group mailbox, a shared calendar, and a connected SharePoint team site.

First selection: Microsoft 365.

A Microsoft 365 group satisfies both collaboration requirements without requiring administrators to create separate resources.

Distribution lists and mail-enabled security groups provide email capabilities but do not automatically provision a connected SharePoint team site. Ordinary security groups also lack the required shared email functionality.

Second selection: Dynamic User.

Microsoft Entra ID supports dynamic membership based on user attributes. This allows the research department group to include eligible users automatically without manual membership updates.

Assuming the referenced attribute is the Department property, administrators can use the following rule:

(user.department -eq " Research " )

When a user ' s department changes to Research, the membership engine automatically adds that user. When the value changes to another department, the user is removed.

An Assigned membership type would require administrators or group owners to maintain membership manually. Dynamic Device is inappropriate because Microsoft 365 groups contain users, not devices.

Licensing consideration: Dynamic membership requires Microsoft Entra ID P1 licensing for affected users. The question does not explicitly identify the licence entitlement, which should be checked before implementation.

Therefore, Microsoft 365 with Dynamic User membership meets the collaboration and administrative-efficiency requirements.

Microsoft Purview retention labels control how long content must be preserved and what action occurs after the configured retention period expires.

Option B is the intended examination answer, based on the default retention-period start date.

The exhibit shows Retention1 configured with a six-month retention period and the Retain and Delete action.

Microsoft documents that retention periods start from the content creation date by default, unless the label is explicitly configured to use another trigger.

File1 was created on January 1, 2025. Therefore, its six-month retention period ends on July 1, 2025.

The modification on January 10 does not reset the retention period under the default configuration. Similarly, deleting File1 on February 1 does not override the retention requirement.

Option A ignores the retention configuration. Option C would apply if retention began on the last modification date. Option D incorrectly calculates six months from the user-initiated deletion.

Important technical distinction: The question says permanently and unrecoverable. Microsoft ' s current SharePoint and OneDrive documentation states that retained content is subsequently moved through the Recycle Bin, where an additional 93-day recovery period can apply. Consequently, July 2025 represents the intended retention expiration and deletion processing date, not necessarily the final irreversible deletion date. Strictly interpreted, none of the options guarantees that outcome.

Microsoft References:

Microsoft Learn — Retention policies and labels .

Microsoft Learn — Retention behavior for SharePoint and OneDrive .

Microsoft Entra ID supports passwordless authentication through several technologies, including Microsoft Authenticator, Windows Hello for Business, and FIDO2 security keys.

First selection: Microsoft Authenticator.

Microsoft Authenticator supports passwordless phone sign-in using device-based cryptographic authentication. Instead of entering a password, users approve authentication requests through the mobile application, complete number matching, and verify their identity using a device PIN or biometric authentication.

Email OTP, SMS, and voice calls do not provide the same Microsoft Entra passwordless phone sign-in capability.

Second selection: Microsoft Entra admin center.

The Microsoft Entra admin center provides centralized configuration of authentication methods through Entra ID → Authentication methods → Policies.

An administrator with at least the Authentication Policy Administrator role can select Microsoft Authenticator, enable it for all users, and configure the authentication mode to support passwordless sign-in.

The Microsoft 365 admin center primarily manages Microsoft 365 services, users, subscriptions, and licensing. The Microsoft Defender portal focuses on security monitoring and threat protection. Neither is the dedicated administrative interface for configuring Microsoft Entra authentication methods.

Implementation consideration: Enabling the authentication method does not automatically register every user. Users must register Microsoft Authenticator and activate passwordless phone sign-in before using it. Administrators can use Temporary Access Pass to support onboarding.

Therefore, Microsoft Authenticator and the Microsoft Entra admin center are the correct selections.

An administrator can create usernames that contain the: contoso221018.onmicrosoft.com, east.contoso221018.onmicrosoft.com, and contoso.com domains; Exchange Online can receive inbound email messages sent to the: contoso221018.onmicrosoft.com domain only

Microsoft 365 supports multiple verified domains within a tenant. These domains can be used for Microsoft Entra user principal names, while Exchange Online email routing depends on additional service configuration and DNS records.

The exhibit shows three domains with different status indicators: the default contoso221018.onmicrosoft.com domain is Healthy, contoso.com has Incomplete setup, and east.contoso221018.onmicrosoft.com has No services selected.

First selection: All three domains.

The intended interpretation is that the domains have been added to the tenant and are available for identity naming. A custom domain can be used for a user ' s sign-in name once domain ownership has been verified, even if other Microsoft 365 service configuration is incomplete.

Second selection: The default onmicrosoft.com domain only.

The default tenant domain provides Exchange Online ' s fallback email-routing namespace. In the exhibit, the custom domain has incomplete service configuration, while the additional subdomain has no services selected.

However, there is an important technical limitation: these administrative status indicators alone do not conclusively establish the live external MX records or every Exchange Online accepted-domain setting. Those configurations must be inspected to verify actual inbound mail routing.

The selections above represent the intended examination interpretation, not independent proof of the tenant ' s current DNS configuration.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain

https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate authentication risk and enforce access restrictions based on suspicious sign-in activity.

Option D is correct because the Sign-in risk condition evaluates the probability that an individual authentication attempt is unauthorized. Microsoft Entra ID Protection calculates this risk using various detections, including anonymous IP addresses and impossible travel.

Anonymous IP address: Microsoft identifies sign-ins originating from anonymizing services, including Tor exit nodes and anonymous VPN services. Such connections may indicate attempts to conceal the user ' s actual location or identity.

Impossible travel: Microsoft identifies activities originating from geographically distant locations within a period shorter than the time required for physical travel. This can indicate account compromise or unauthorized credential use.

Administrators can configure a Conditional Access policy that evaluates sign-in risk levels and selects Block access under Grant controls.

Option A is incorrect because the Locations condition evaluates network locations, countries, regions, and IP address ranges rather than directly evaluating identity risk detections.

Option B is incorrect because Insider risk relates to potentially risky internal user activity.

Option C is incorrect because User risk represents the likelihood that an account is compromised, rather than the risk associated with a specific sign-in event.

Important: Impossible travel detection can occur offline, so risk-based blocking is not guaranteed to prevent the initial suspicious sign-in in real time.

Microsoft Reference: Microsoft Learn — Risk detections in Microsoft Entra ID Protection .

Review the: Microsoft 365 Copilot credits report; Notify the department by: Adding a budget and alert recipients to the billing policy

Microsoft 365 provides consumption reports and billing policy controls for organizations using pay-as-you-go Microsoft Copilot services.

First selection: Microsoft 365 Copilot credits report.

The Microsoft Copilot Credits report provides detailed information about consumption associated with metered Copilot Chat and agent interactions.

Administrators can access the report through the Microsoft 365 admin center under Reports, Usage, Microsoft Copilot, and Credits.

The report includes credits consumed by individual users, agents, billing policies, and user-agent combinations. These breakdowns help identify unusually high consumption and determine which activities are contributing to increased costs.

Second selection: Adding a budget and alert recipients to the billing policy.

Microsoft 365 pay-as-you-go billing policies support configurable budgets and spending notifications.

Administrators can specify a budget threshold and designate finance personnel as notification recipients. When consumption reaches the configured notification milestones, Microsoft sends email alerts to the designated recipients.

This provides proactive cost visibility without requiring finance personnel to manually inspect consumption reports.

A critical distinction is that billing policy budgets provide notifications rather than hard spending limits. Reaching the budget threshold does not necessarily stop additional consumption or billing.

Therefore, the Credits report provides the consumption breakdown, while the billing policy budget and notification recipients provide threshold-based alerts.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/message-consumption

https://learn.microsoft.com/en-us/microsoft-365/copilot/pay-as-you-go/setup

Microsoft Entra Lifecycle Workflows supports automated identity lifecycle management, including workflows that govern Microsoft Entra agent identity sponsorships when employees change positions or leave an organization.

Option B is correct because the Lifecycle Workflows Administrator role grants the administrative permissions required to create, modify, and manage lifecycle workflows without granting broad entitlement management permissions.

Microsoft documents several agent sponsorship workflow tasks, including sending notifications to managers, notifying cosponsors, and transferring agent identity sponsorships to a manager.

These tasks are available within mover and leaver workflow templates. Admin1 can configure the appropriate workflow triggers, assign sponsorship-related tasks, and manage workflow execution.

The Lifecycle Workflows Administrator role is specifically scoped to lifecycle workflow management. It does not inherently grant administrative control over access packages, access reviews, or entitlement management catalogs.

Option A is incorrect because Global Administrator provides excessive privileges.

Option C is incorrect because AI Administrator is not the dedicated role for managing Microsoft Entra Lifecycle Workflows.

Option D is incorrect because Identity Governance Administrator provides broader identity governance permissions, conflicting with least privilege.

Option E is incorrect because Agent ID Administrator manages agent identity administration rather than providing the specific lifecycle workflow permissions required.

Therefore, Lifecycle Workflows Administrator is the appropriate role.

Microsoft References:

https://learn.microsoft.com/en-us/entra/id-governance/agent-sponsor-tasks

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

SharePoint Data Access Governance provides reporting capabilities that help administrators identify overshared sites, excessive permissions, and potentially risky content exposure without changing the existing SharePoint authorization configuration.

Option D is correct because Data Access Governance reports can identify sites that have broad access permissions, anonymous sharing links, and permissions granted to large organizational groups.

Administrators can access these reports through the SharePoint admin center under Reports and Data access governance.

The site permissions snapshot report provides visibility into permissioned users, guest access, broken permission inheritance, and sharing links.

Sharing links activity reports can also identify sites where users have created Anyone links, organization-wide links, or externally shared links.

These capabilities are especially important for Microsoft 365 Copilot because Copilot respects existing SharePoint permissions. Overshared content may therefore appear in responses provided to users who have access through excessively broad permissions.

Option A primarily measures site usage rather than evaluating permission exposure.

Option B focuses on classified content rather than analyzing SharePoint site permission structures.

Option C involves reviewing user access assignments, rather than identifying overshared sites across the SharePoint environment.

Option E supports compliance content searches but is not the dedicated solution for detecting broad site permissions.

Data Access Governance reports provide the required visibility without modifying permissions.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/data-access-governance-reports

https://learn.microsoft.com/en-us/sharepoint/data-access-governance-site-permissions-report

Microsoft Defender for Office 365 supports outbound spam policies that control sending limits and automatically restrict accounts exhibiting suspicious outbound email activity.

Option A is correct because a custom outbound anti-spam policy can target Group1 specifically, allowing administrators to enforce more restrictive sending limits for marketing department mailboxes without changing the organization-wide configuration.

Administrators can navigate to Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Anti-spam, and create a custom outbound policy.

The policy should include Group1, configure the appropriate external recipient limit, and select Restrict the user from sending mail as the action when a limit is reached.

Option B is incorrect because modifying the default outbound policy would affect other users not covered by a higher-priority custom outbound policy.

Option C is incorrect because Strict preset security policies do not contain configurable outbound spam policies.

Option D is incorrect because Standard preset protection cannot provide a custom outbound sending limit.

Option E is incorrect because inbound anti-spam policies protect incoming email rather than restricting compromised users ' outgoing messages.

Crucially, Microsoft ' s documentation confirms that Strict and Standard preset security policies do not override outbound spam policies. Therefore, the custom outbound policy can apply to Group1 without excluding its members from Strict protection.

Microsoft References:

Microsoft Learn — Configure outbound spam policies .

Microsoft Learn — Preset security policies .

The Microsoft 365 Admin mobile app provides administrators with mobile access to Microsoft 365 administrative functions, including service health monitoring, incident notifications, Message Center updates, and support requests.

Option C is correct because the Microsoft 365 Admin mobile app includes a dedicated Service Health feature that enables administrators to monitor the operational status of Microsoft 365 services directly from a mobile device.

Administrators can view active service incidents, service advisories, outages, and relevant service disruption details.

The app also supports configurable push notifications for service health alerts, enabling administrators to receive timely information about service disruptions without signing in to the web-based Microsoft 365 admin center.

Option A is incorrect because Intune Company Portal provides employees with access to managed corporate applications, device enrollment, and compliance information.

Option B is incorrect because the Intune app focuses on device management and access to organizational resources rather than Microsoft 365 service health monitoring.

Option D is incorrect because Microsoft Authenticator supports multifactor authentication, passwordless sign-in, and authentication approvals. It does not provide Microsoft 365 service health reporting.

Therefore, the Microsoft 365 Admin mobile app is the correct solution.

Microsoft Reference: Microsoft Learn — About the Microsoft 365 admin mobile app .