Question 1 A newly acquired company wants to add fabrikam-example.com as a custom Microsoft 365 domain. What must its administrator establish before using that domain for accounts? Configure the custom domain's public MX destination before verifying ownership of its DNS namespace in Microsoft 365 Publish the Microsoft-provided domain verification TXT record Publish outbound DKIM selector CNAMEs for the new domain and treat successful key discovery as the required Microsoft 365 ownership proof Stage cloud user accounts with the proposed unverified UPN suffix and rely on later DNS propagation to activate that suffix Explanation Correct Answer B:The tenant must prove control of the DNS namespace before it can claim the domain. Incorrect Answers A:MX routing can point at a service even when Microsoft 365 has not established that this tenant controls the custom domain; verification is a separate prerequisite. C:DKIM selector publication permits validation of message signatures but does not replace the specific domain-ownership challenge issued by Microsoft 365. D:Precreating accounts does not establish a tenant's control of a custom namespace; the verified domain must be attached before dependable use.
Question 2 A verified TXT value was entered but the Microsoft 365 domain wizard still reports the domain unverified. What evidence should be checked first? Query authoritative public DNS for the exact TXT name and value Validate only the inbound mail MX preference values because a low-priority Exchange Online route should also complete the domain TXT ownership check Change the administrator's product entitlement to Microsoft 365 E5 on the assumption that DNS ownership checks require premium service licensing Enable modern authentication for the tenant's sign-in protocols and retry domain ownership verification without checking the public DNS TXT lookup Explanation Correct Answer A:The wizard queries DNS, so propagation and record location are the relevant first checks. Incorrect Answers B:Microsoft 365 domain verification examines the ownership record and its published value; an otherwise valid inbound mail route does not diagnose a missing TXT record. C:Domain ownership is proved through a public DNS record, not the license level assigned to an administrative identity. D:Authentication policy does not affect authoritative DNS visibility or the exact TXT host/value required by the domain wizard.
Question 3 An administrator receives a warning that a custom domain is already verified in another Microsoft 365 tenant. Which requirement must be satisfied? Change the tenant's default sign-in domain and retry verification of the already-claimed external custom DNS namespace Add both tenants' outbound mail systems to one SPF record and treat shared sending authorization as proof of shared custom-domain tenancy Publish a new DKIM selector under the requested domain while keeping its registration active in the previous Microsoft 365 tenant Release the domain from the other tenant through the authorized recovery or removal process Explanation Correct Answer D:Microsoft 365 does not allow the same custom domain to remain verified in two tenants concurrently. Incorrect Answers A:A default identity-domain setting does not release another tenant's existing ownership binding for the same custom domain. B:SPF may authorize multiple mail senders but does not permit simultaneous verification of a custom DNS domain in distinct Microsoft 365 tenants. C:A new mail-signing selector does not transfer tenant-level ownership of the domain; the old registration must be released or recovered.
Question 4 A verified domain is ready to receive mail in Exchange Online, but Internet mail still reaches the old provider. Which DNS change directs new inbound mail to Exchange Online? Add the Microsoft 365 SPF include to the domain's existing sender policy while leaving the public MX destination at the old inbound mail provider Publish Microsoft 365 Autodiscover records for Outlook clients without changing the public MX records used by remote SMTP senders Enable Exchange Online DKIM signing and publish its selector CNAMEs while keeping the old inbound SMTP routing in the public MX records Change the public MX record to the Microsoft 365 mail endpoint Explanation Correct Answer D:MX is the inbound SMTP delivery route looked up by remote senders. Incorrect Answers A:SPF can authorize Microsoft as a sender, but external senders still follow the published MX records for inbound delivery. B:Outlook client discovery is separate from inbound message routing; remote mail systems continue to use MX destinations. C:DKIM identifies authenticated outbound messages, not the destination chosen by external senders when delivering mail into the domain.
Question 5 After moving outbound messages to Microsoft 365, external recipients report SPF failures for messages from the new sending service. What DNS setting should be evaluated? Update the original Microsoft 365 tenant verification TXT token and assume it also authorizes every outbound sending host under SPF Adjust public MX priorities to point at Microsoft 365 and expect that inbound-route change to authorize outbound sender IPs for SPF Change the public Autodiscover endpoint for Outlook and assume client discovery updates the sender-policy evaluation performed by external mail recipients The SPF TXT policy for the domain's authorized senders Explanation Correct Answer D:A sender-policy record determines which IPs and services may send on behalf of that domain. Incorrect Answers A:Verification tokens assert domain control; receiver SPF evaluation uses a separate sender-policy TXT statement and sending IP address. B:MX priorities select inbound delivery endpoints; they do not define which hosts are permitted to send mail claiming the domain. C:Autodiscover helps clients find mail services but cannot make the source IP pass the receiving system's SPF policy checks.
Question 6 A newly migrated brand wants receiving mail systems to reject forged messages that fail authenticated alignment. Which record expresses the enforcement policy? Republish the custom-domain ownership TXT token, treating ownership proof as an instruction for outside receivers to reject spoofed messages Publish a mail client discovery SRV record with a strict target, assuming a discovery record enforces spoofing rejection at receivers Point MX to a trusted mail gateway with high priority and assume the routing preference forces downstream DMARC rejection of spoofed mail A DMARC TXT policy with an appropriate reject action Explanation Correct Answer D:DMARC conveys handling instructions for messages failing aligned SPF or DKIM checks. Incorrect Answers A:The verification token confirms domain control to Microsoft; receivers need an explicit aligned DMARC policy for handling failures. B:Client discovery cannot instruct receiving mail gateways how to handle SPF/DKIM alignment failures; DMARC carries disposition policy. C:MX determines inbound routing, whereas the receiver-side authentication enforcement request is expressed in a DMARC policy TXT record.
Question 7 The messaging team has configured DKIM signing for a custom domain in Defender/Exchange, but activation requires DNS records. Which records are normally published? The Microsoft-provided DKIM selector CNAME records Put a DKIM private signing key in a public domain-verification TXT record so receiving servers can discover the signing material Publish a separate SPF TXT statement with a DKIM selector value instead of Microsoft's required selector-specific CNAME aliases Create extra inbound MX targets for each DKIM selector so validators can locate the signing key through mail routing Explanation Correct Answer A:The selectors link the organization's domain to public keys used to verify signatures. Incorrect Answers B:Public DNS must not expose a signing private key, and the ownership verification token is not the supported DKIM selector mapping. C:SPF authorizes sending sources; it cannot publish the DKIM public-key discovery aliases required for supported Microsoft 365 DKIM enablement. D:DKIM public-key discovery uses selector-specific DNS names, not the domain's inbound SMTP MX preferences.
Question 8 A pilot needs to sign in before the company has purchased a public custom domain. Which address namespace is available by default? Allow users to choose an arbitrary third-party UPN suffix before the organization has verified ownership of that namespace Use the local AD DS domain controller's public hostname as the automatic cloud UPN suffix without domain verification or tenant configuration The initial tenant's onmicrosoft.com domain Use the automatically provisioned Exchange Online inbound MX endpoint hostname as the default sign-in suffix for cloud users Explanation Correct Answer C:Microsoft 365 supplies this namespace during tenant creation for initial identities. Incorrect Answers A:A suffix is not automatically available merely because the user types it; the tenant initially has a verified onmicrosoft.com namespace. B:A domain-controller host address does not by itself become a supported Microsoft 365 tenant sign-in namespace. D:Exchange mail endpoints identify inbound SMTP service, whereas the initial onmicrosoft.com domain is the tenant's provided identity suffix.
Question 9 A tenant contains two verified domains; administrators want newly created cloud accounts to use the company brand by default. What should they configure? Remove the initial onmicrosoft.com tenant namespace after adding the company domain, so new identities cannot receive the old suffix Change the original namespace's mail MX destination and expect the administrator's new-user domain picker to default to the new brand Set the preferred verified domain as the tenant's default domain Change MFA registration requirements for new hires and assume this also sets their preferred default sign-in-domain suffix Explanation Correct Answer C:The default selection affects the suffix presented when creating new accounts. Incorrect Answers A:Removing the initial namespace is not the mechanism for choosing the default new-user domain; set the verified preferred domain explicitly. B:MX is a mail routing record, not the tenant setting that chooses the preferred UPN suffix for newly created cloud users. D:Authentication enrollment requirements do not select which verified domain the new-user creation interface uses by default.
Question 10 A company is decommissioning a brand and wants to remove its custom domain from Microsoft 365. What dependency must be addressed first? Delete Microsoft 365 service-health history before removing a custom domain, assuming historical notices constitute the domain dependency Remove that domain from user and group references that still use it Require all accounts to enroll passkeys before domain removal, leaving their original UPNs and proxy addresses unchanged Remove endpoint protection entitlements from the organization before deleting a brand domain referenced by mailboxes and cloud identities Explanation Correct Answer B:A domain in use by objects cannot be removed until those dependencies are reconfigured. Incorrect Answers A:Incident history does not bind recipient or user objects to a DNS namespace; used user and group addresses must be moved first. C:Authentication method replacement does not clear identity or email objects' references to the domain targeted for removal. D:Defender entitlement cannot release users, aliases, and groups that still reference the custom domain and may cause unrelated loss of security.
