Free Microsoft Administering Microsoft 365 and AI Services AB-650 Exam Questions

Microsoft 365 network connectivity insights help administrators evaluate how network configuration affects connectivity to Microsoft 365 services. Accurate office-location identification is essential for associating connectivity measurements with the appropriate branch.

Option C is correct because Microsoft 365 allows administrators to define office locations manually and associate each location with its corresponding local area network subnet ranges.

This configuration is particularly important when multiple branches exist in the same city. Because the branches have distinct IPv4 LAN subnets, Microsoft 365 can distinguish their connectivity measurements by using the configured subnet information.

Microsoft Learn explicitly supports the manual location configuration method when Windows Location Services is unavailable. Administrators can navigate to the Microsoft 365 admin center, access Network connectivity, and configure office locations with their respective LAN subnet information.

Option A is insufficient because simply running network tests does not establish the required persistent branch-specific subnet mapping.

Option B does not provide the local subnet information needed to distinguish branches reliably.

Option D conflicts with the stated requirement because Windows Location Services is disabled by policy. Furthermore, automatic geographic location discovery may not distinguish multiple offices in the same city.

Therefore, manually configuring both locations and their LAN subnet ranges meets the requirement.

Microsoft Reference:

https://learn.microsoft.com/en-us/Microsoft-365/Enterprise/office-365-network-mac-perf-overview?view=o365-worldwide

The Microsoft 365 Copilot Agent usage report provides centralized reporting on the adoption and activity of agents used through Microsoft 365 Copilot Chat and supported Microsoft 365 applications.

Option B is correct because the report supports usage analysis over the previous 7 or 30 days and provides agent-specific activity information.

Administrators can access the report through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft 365 Copilot, and Agents.

The report includes information about active agents, active users, agent responses, and usage trends. Its daily time-series reporting helps administrators examine usage patterns, while agent-level details support comparisons between Agent1 and Agent2.

Option A is incorrect because Microsoft Defender for Cloud Apps app governance primarily focuses on application permissions, OAuth applications, and associated security risks rather than Copilot agent activity reporting.

Option C is incorrect because billing and usage information primarily addresses consumption and associated charges rather than providing the complete agent adoption and activity reporting requested.

Option D is incorrect because Microsoft Purview Audit provides event-level audit records. Although relevant activities may be recorded, it is not the most direct reporting solution for comparing agent usage.

Therefore, the Microsoft 365 Copilot Agent usage report is the appropriate selection.

Microsoft Reference:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-agents-new

Microsoft 365 admin center provides centralized Agent settings to control both the categories of agents permitted within an organization and the users authorized to access them.

Option B, User access, is correct. This setting determines which users and groups can interact with organizational agents. Administrators should select the option for specific users or groups and assign Group1. This ensures that members of Group1 can use permitted agents while users outside the group are excluded from the pilot.

Option E, Allowed agent types, is correct. This setting controls which publisher categories are permitted. Administrators should allow agents developed by Microsoft and the organization while disabling agents from external publishers.

This configuration enables Group1 members to use Agent1 and approved Microsoft agents without allowing third-party agents.

Option A is incorrect because policy templates apply predefined governance and security configurations rather than defining the combination of user access and agent publisher categories.

Option C controls agent-sharing behavior rather than the overall ability to interact with agents.

Option D provides rules for agent management and lifecycle activities but does not replace the specific access and publisher controls required.

Microsoft's current documentation refers to Allowed agent types as Agent and plugin access. The underlying publisher restrictions remain consistent with the question.

Microsoft Reference:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-settings

Microsoft Agent 365 provides centralized governance of tools and Model Context Protocol (MCP) servers that AI agents use to access external services and organizational data.

Option D is correct because the Microsoft 365 admin center's Tools management interface enables administrators to block an individual MCP server without disabling the agent or unrelated MCP servers.

In this scenario, MCP2 is currently marked Available but has not completed its security review. Allowing agents to invoke MCP2 could expose procurement information before appropriate security controls have been validated.

Administrators can navigate to the Microsoft 365 admin center, select Agents Tools Registry, locate MCP2, and select Block.

Blocking MCP2 changes its availability and prevents agents from using the tools exposed by that server. MCP1 remains available because it is a separate MCP server, and Agent1 itself is not disabled.

Option A is incorrect because agent management rules do not provide the direct server-specific blocking action requested.

Option B is incorrect because the Agent Registry manages agents, whereas the Tools Registry provides MCP server controls.

Option C is incorrect because policy templates are not the direct mechanism for blocking an individual MCP server.

Therefore, blocking MCP2 from Tools satisfies the requirements.

Microsoft Reference:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-plugins-skills-mcp-servers

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-tools-overview

Microsoft 365 provides administrative interfaces for reporting service problems and communicating product-related feedback.

Option C: Product feedback in the Microsoft 365 admin center. The Product feedback experience helps administrators review feedback submitted about Microsoft 365 applications and Copilot. Feedback can document unexpected behavior, feature problems, and limitations that Microsoft uses to improve its products.

Administrators can also submit feedback through the Microsoft 365 administrative feedback mechanisms. However, Product feedback is primarily a feedback-management experience, not a substitute for a formal technical support request.

Option E: Service health in the Microsoft 365 admin center. This is the most direct choice for reporting a suspected Microsoft 365 service issue. Administrators can navigate to Health, select Service health, and choose Report an issue when the problem is not already listed as an active incident.

Microsoft can correlate the submitted report with signals from other tenants and determine whether the problem represents a broader service incident.

Option A provides adoption and consumption information rather than incident reporting.

Option B publishes administrative announcements, feature updates, and service communications.

Option D is not the documented primary reporting interface for Microsoft 365 service incidents.

For a production-impacting issue requiring assistance, administrators should additionally use the Microsoft 365 admin center's Help and support functionality.

Microsoft Reference:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health

https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/feedback

DomainKeys Identified Mail (DKIM) is an email authentication mechanism that uses public-key cryptography to digitally sign outgoing email messages. It enables receiving mail systems to verify that signed message headers and the message body have not been modified after signing.

When DKIM is configured for the accepted domain contoso.com, Exchange Online signs outbound messages using a private key. The receiving mail server retrieves the corresponding public key through DNS and verifies the DKIM signature.

The signature is included in the email's DKIM-Signature header, which contains information identifying the signing domain, cryptographic algorithm, and signed message components.

For custom domains in Microsoft 365, administrators typically configure the required DNS CNAME records and enable DKIM signing through Microsoft Defender.

Option A is incorrect because Microsoft Purview Message Encryption protects message confidentiality rather than providing DKIM authentication signatures.

Option C is incorrect because Domain-based Message Authentication, Reporting, and Conformance (DMARC) defines authentication alignment and handling policies based on SPF and DKIM results.

Option D is incorrect because Authenticated Received Chain (ARC) preserves authentication information through intermediary mail systems, particularly when forwarding modifies messages.

DKIM is therefore the correct technology for digitally signing outbound email messages.

Microsoft Reference:

https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure

Microsoft Purview Information Protection provides data classification, sensitivity labeling, and protection capabilities for organizational information. However, Information Protection alone does not provide the dedicated investigation workflow required to identify individual AI agent interactions containing confidential information in prompts or responses.

The more appropriate solution is Microsoft Purview Data Security Posture Management (DSPM), using its AI observability and Activity explorer capabilities.

Microsoft DSPM supports visibility into AI agent activities, including Microsoft Agent 365. It can identify interactions involving sensitive information through integrated data classification, audit telemetry, sensitive information types, and trainable classifiers.

Administrators can navigate to the Microsoft Purview portal, open DSPM, and use Discover Activity explorer AI activities to investigate AI interactions. The AI observability page also provides agent-specific visibility into potentially sensitive interactions and associated risks.

Microsoft Purview Information Protection contributes classification and labeling capabilities to this process, but simply using Information Protection does not independently deliver the required agent-interaction investigation.

Therefore, the proposed solution does not fully satisfy the requirement, making Option B (No) the appropriate answer.

Microsoft Reference:

https://learn.microsoft.com/en-us/purview/ai-agent-365

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

Microsoft Purview Data Loss Prevention (DLP) policies protect sensitive information across Microsoft 365 workloads, including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams.

Option B is correct because the policy currently blocks sensitive files in SharePoint but does not prevent credit card information from being shared through email. This strongly indicates that the policy's locations do not include Exchange Online, or that Exchange Online is excluded from its scope.

Administrators must configure the DLP policy to include both Exchange email and SharePoint sites. The policy should identify the Credit Card Number sensitive information type and apply appropriate blocking actions to external sharing.

Option A is incorrect because user overrides determine whether users can bypass a DLP restriction. They do not enable protection for additional workloads.

Option C is incorrect because the policy already enforces restrictions in SharePoint, demonstrating that it is functioning for at least one location.

Option D is incorrect because the policy already detects credit card information in SharePoint. Changing the detection conditions alone does not extend enforcement to Exchange Online.

After adding Exchange Online, administrators should verify that the policy's rules block the relevant outbound email activity and that users cannot override the restriction.

Therefore, configuring the DLP policy locations is the appropriate solution.

Microsoft Reference: Microsoft Learn --- Data Loss Prevention policy reference.

Microsoft Defender for Office 365 Plan 2 provides Automated Investigation and Response (AIR) capabilities to investigate malicious email messages and recommend or execute remediation actions.

Option D is correct because Microsoft explicitly identifies Soft delete as the only available remediation action when configuring automatic remediation for AIR message clusters.

By default, AIR remediation actions require approval from the Security Operations (SecOps) team. However, administrators can enable automatic remediation for selected message cluster types, allowing malicious messages to be remediated without manual approval.

Administrators can configure this feature in the Microsoft Defender portal by navigating to Settings Email & collaboration MDO automation settings.

The Message clusters section supports three categories:

Similar files

Similar URLs

Multiple similar attributes

Under Remediation action, administrators select Soft delete. AIR then automatically removes qualifying malicious messages from user mailboxes without requiring SecOps approval.

Soft deletion moves messages into the Recoverable Items structure, allowing recovery according to applicable mailbox retention settings.

Option A moves messages to Deleted Items, while Option B moves them to Junk Email. Neither is supported as the configurable automatic AIR remediation action.

Option C permanently removes messages and is not supported for this automatic remediation configuration.

Microsoft also specifies that clusters containing more than 10,000 messages require manual review rather than automatic remediation.

Therefore, Soft delete is the only correct option.

Microsoft Defender for Office 365 provides configurable inbound anti-spam policies that enable administrators to filter unwanted email according to sender characteristics, geographic origin, languages, and recipient groups.

Option C is correct because a custom anti-spam inbound policy supports geographic filtering through the From these countries setting and can be scoped to selected recipient groups.

Administrators can configure the policy through the following steps:

Navigate to Microsoft Defender portal Email & collaboration Policies & rules Threat policies Anti-spam.

Select Create policy Inbound.

Under Users, groups, and domains, specify Group1 as the recipient group.

Under Bulk email threshold & spam properties, enable From these countries and select the countries or regions from which unwanted messages originate.

Configure the appropriate spam action, such as moving detected messages to Junk Email or quarantine.

This configuration ensures that geographic spam filtering applies specifically to Group1 without altering protection settings for other recipients.

Option A is incorrect because connection filter policies operate on source IP addresses and do not provide the required group-specific geographic filtering.

Options B and D are incorrect because preset security policies do not provide the required customizable country-based filtering settings.

Option E is incorrect because anti-phishing policies focus on spoofing, impersonation, and phishing detection rather than geographic spam filtering.

Implementation consideration: Recipient-group targeting supports mail-enabled security groups, distribution groups, and Microsoft 365 groups. Also, Standard or Strict preset security policies take precedence over custom inbound anti-spam policies for recipients included in those presets.