Free Practice Questions for Microsoft AB-650 Exam

List the AI app and agent inventory: AI observability; Review interactions: Activity explorer; Identify SharePoint exposure concerns: Data risk assessments

Microsoft Purview Data Security Posture Management (DSPM) combines AI activity visibility, sensitive-data investigations, and exposure assessments within a centralized data security framework.

First selection: AI observability. This capability provides an inventory of AI applications and agents, including their activity, risk characteristics, and sensitive interactions. Administrators can identify recently used agents and investigate potentially risky AI applications.

Second selection: Activity explorer. DSPM Activity explorer enables administrators to investigate events associated with sensitive information. Its AI activities view provides visibility into AI interactions, prompts and responses where supported, sensitive information detections, and data loss prevention policy matches. This makes it suitable for examining whether confidential SharePoint information was involved in an AI interaction.

Third selection: Data risk assessments. This capability identifies potential data exposure and oversharing risks. Administrators can assess sensitive content and investigate SharePoint locations where excessive access permissions or sharing configurations may expose information.

The remaining options perform different functions. Posture provides an overall data security dashboard, Remediation actions supports implementing security controls, and Reports provides summarized security information.

Consequently, AI observability, Activity explorer, and Data risk assessments are the correct selections for the three investigation requirements.

Microsoft References:

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

Microsoft 365 supports pay-as-you-go billing for Microsoft Copilot Chat and SharePoint agents through Azure subscriptions. Administrators can analyze the associated charges using Microsoft 365 Cost Management.

Option A is correct because Cost Management in the Microsoft 365 admin center provides service-level billing information for supported Microsoft 365 pay-as-you-go workloads.

Administrators can navigate to Microsoft 365 admin center → Billing → Cost management.

The Cost Management experience provides the following capabilities:

View billed consumption for Microsoft Copilot Chat and SharePoint agents.

Filter costs by service family to isolate the relevant Microsoft 365 AI workloads.

Select a historical reporting period, including the previous calendar month.

Review cost breakdowns and spending trends.

Export available billing information for financial analysis.

Although the billing policies are connected to Sub1, the Microsoft 365 reporting experience enables finance personnel to focus on the relevant AI services without including unrelated Azure virtual machines, storage, or other resources.

Option B is incorrect because the Copilot Chat usage report primarily measures adoption and engagement rather than billed service costs.

Option C is incorrect because Power Platform Capacity add-ons are not the appropriate reporting interface for these Microsoft 365 pay-as-you-go charges.

Option D is incorrect because Billing accounts manages billing relationships and invoices rather than providing the requested service-specific cost analysis.

Microsoft References:

Microsoft Learn — View costs and billing for Microsoft Copilot pay-as-you-go .

Microsoft Learn — Use Cost Management in the Microsoft 365 admin center

Answer Area

Correct Selection

Agents flagged by aggregated security and compliance signals

Agents at risk

Agents that lack accountable lifecycle management

Agents without owners

Microsoft Agent 365 provides centralized governance action cards within the Microsoft 365 admin center to identify security risks, ownership gaps, and agent lifecycle issues.

First selection: Agents at risk.

The Agents at risk card identifies agents associated with aggregated security and compliance risk signals from Microsoft Entra, Microsoft Defender, and Microsoft Purview.

Administrators can select Manage agent risks to open the Agent Registry with the relevant agents filtered by identified risk.

This enables security teams to investigate potentially compromised agents, inappropriate permissions, data exposure concerns, and other detected security issues.

Second selection: Agents without owners.

The Agents without owners card identifies agents that do not have an assigned owner responsible for governance and lifecycle management.

Administrators can select Assign Owner to review affected agents and establish ownership accountability.

An assigned owner helps ensure ongoing technical maintenance, appropriate access management, and governance oversight.

The remaining action cards address different scenarios. Agents with exceptions identifies agents experiencing operational errors, while Pending requests for agents identifies agent deployment requests awaiting administrative approval.

Microsoft documents that AI Administrators and Global Administrators can perform the relevant governance actions.

Therefore, Agents at risk and Agents without owners are the correct selections.

Microsoft References:

Microsoft Learn — Agent 365 overview and governance action cards .

Microsoft Learn — Agent Registry and security risk management .

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access through eligible role assignments. This capability allows administrators to grant temporary access to sensitive Microsoft Entra administrator roles without maintaining permanent privileged permissions.

When engineers are assigned as eligible for an administrator role, they do not immediately receive the role ' s active privileges. Instead, they must activate the role before performing privileged administrative tasks.

The activation process can require multifactor authentication, justification, approval, or other security controls, depending on the configured PIM role settings.

Administrators can define a maximum activation duration. Once the activation period expires, the active role assignment expires automatically, and the user must activate the role again before performing privileged operations.

Option A is incorrect because access packages manage access to resources but do not inherently implement just-in-time activation for Microsoft Entra administrator roles.

Option B is incorrect because administrative units restrict the scope of delegated administration without providing automatic role activation and expiration.

Option D is incorrect because active membership in a role-assignable group grants privileges without requiring activation.

Therefore, PIM eligible role assignments satisfy both requirements: explicit activation and automatic expiration.

Microsoft References:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

Answer Area

Verified available selection

Social engineering technique

Credential harvest

Training experience

Mass Market Phishing

Microsoft Defender for Office 365 Plan 2, included in Microsoft 365 E5, provides Attack simulation training for conducting simulated phishing campaigns and assigning security awareness training to users.

First selection: Credential harvest.

Credential Harvest is a supported social engineering technique. It simulates a phishing email containing a link to a website that requests the recipient ' s sign-in credentials.

However, Microsoft also explicitly supports Link to Malware and Malware Attachment simulations under Microsoft 365 E5. All three techniques shown in the dropdown are therefore supported.

Second selection: Mass Market Phishing.

Microsoft documents Mass Market Phishing as an available training experience, including in the limited Attack simulation training trial offered to Microsoft 365 E3 customers. It is consequently a defensible selection for an E5 environment.

Important examination issue: Microsoft 365 E5 provides more extensive Attack simulation training capabilities than the E3 trial. The scenario does not specify a technique, training objective, or licensing restriction that uniquely identifies one pair of dropdown selections.

Accordingly, Credential harvest and Mass Market Phishing are confirmed available options, but the question cannot be validated as having one uniquely correct answer based solely on the supplied information.

Microsoft References:

Microsoft Learn — Get started using Attack simulation training .

Microsoft Learn — Simulate a phishing attack .

Microsoft Agent 365 provides centralized governance settings in the Microsoft 365 admin center to control who can interact with AI agents and who can distribute agents throughout the organization.

First selection: User access.

The User access setting determines which users or security groups are permitted to access and interact with agents.

Administrators can navigate to Microsoft 365 admin center → Agents → Settings → User access.

Under the access configuration, administrators should select Specific users or groups and assign Group1.

This restricts agent interaction to members of Group1 and prevents users outside the approved group from accessing agents through the governed experience.

Second selection: Sharing.

The Sharing setting determines which users can distribute agents created through Microsoft Copilot Agent Builder.

Administrators should navigate to Agents → Settings → Sharing, select Specific users or groups, and assign Group2.

This permits members of Group2 to distribute agents organization-wide while preventing other users from using organization-wide sharing.

The remaining settings serve different purposes. Agent Management Rules automate governance actions, Allowed agent types controls permitted publisher categories, and Policy template provides predefined governance configurations.

Therefore, User access controls agent interaction, while Sharing controls organization-wide distribution.

Track the number of unique Site1 pages visited by users: From the Microsoft 365 admin center, review the SharePoint site usage reports.; Monitor the Site1 collection storage quotas: From the SharePoint admin center, review the Active sites page.

Microsoft 365 provides both analytical usage reporting and administrative site-management capabilities for SharePoint Online. These functions serve different monitoring requirements.

First selection: SharePoint site usage reports.

The Microsoft 365 admin center includes SharePoint site usage reports that provide information about site activity, storage consumption, and user engagement.

The report contains a metric named Pages visited, representing the number of unique pages visited on a SharePoint site during the reporting period. This differs from Page views, which represents the total number of page views, including repeated visits.

Administrators can access this information through Reports, Usage, and SharePoint site usage.

Second selection: Active sites page.

The SharePoint admin center provides the Active sites page for managing and monitoring individual SharePoint sites.

Administrators can select Site1 and inspect information such as allocated storage, current storage consumption, and site details. When manual storage limits are configured, administrators can also review or change the site ' s storage allocation.

The Microsoft 365 usage report is designed primarily for analytical reporting, while the SharePoint Active sites page provides administrative oversight of site collections and their storage configurations.

Therefore, the two selected administrative locations satisfy the requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/sharepoint-site-usage-ww

https://learn.microsoft.com/en-us/sharepoint/manage-sites-in-new-admin-center

Microsoft Entra ID supports soft deletion of Microsoft 365 groups, retaining their directory objects and associated service resources for a defined recovery period.

First selection: Group3 only.

The original examination answer reflects the established Microsoft 365 group restoration capability. Microsoft 365 groups can be restored with their membership, Exchange mailbox, SharePoint site, calendar, and supported associated resources.

Traditional distribution groups and mail-enabled security groups do not use the same Microsoft Entra Microsoft 365 group soft-delete recovery workflow.

Second selection: 30 days.

Microsoft maintains deleted Microsoft 365 groups in a recoverable state for 30 days. Administrators can restore them during that period by using the Microsoft Entra admin center or supported PowerShell commands.

Current Microsoft documentation correction: Microsoft now also supports restoration of cloud security groups through a public-preview capability. Therefore, Group1 may also be recoverable if it is a cloud security group in a supported tenant.

The exhibit identifies Group1 only as Security and does not specify whether it is cloud-managed or synchronized from Active Directory.

As a result, Group3 only is the intended historical answer, but it is no longer unconditionally correct under current Microsoft documentation. The 30-day retention period remains correct.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/users/groups-restore-deleted

https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/restore-deleted-group

Microsoft Purview Data Loss Prevention (DLP) policies support different actions depending on the Microsoft 365 workload to which a policy is applied. Administrators must select a supported location before configuring a particular DLP action.

Option B is correct because the Set headers action is supported specifically for Exchange Online email.

This action allows administrators to add or modify an email message header when the message matches the conditions of a DLP rule. For example, an organization can configure a rule that detects sensitive financial information and adds a custom header indicating that the email requires additional handling.

Microsoft documents Set headers as a non-halting action, meaning it does not automatically stop subsequent DLP rule processing.

Option A is incorrect because OneDrive policies govern files and sharing activities rather than Exchange transport message headers.

Option C is incorrect because SharePoint DLP policies primarily protect stored documents and control access to sensitive content.

Option D is incorrect because Teams chat and channel messages do not expose the Exchange-specific Set headers action.

Therefore, the DLP policy must include the Exchange email location to support Set headers.

Microsoft Reference: Microsoft Learn — Data Loss Prevention policy reference .