Question 100 A SharePoint owner assumes the site's standard version history provides the same restoration capabilities as Microsoft 365 Backup. How should this be evaluated? Configure Exchange DKIM to make files recoverable Compare supported recovery points, scope, and retention behavior of each mechanism Use Microsoft Secure Score as the sole recovery plan Disable version history before enabling backup Explanation Correct Answer B:File versioning and dedicated backup may have different recovery guarantees and administrative procedures. Incorrect Answers A:Email signatures cannot create SharePoint restore points. C:A posture score is not a defined data recovery mechanism. D:Removing version history is not required to assess backup coverage.
Question 101 A newly hired contractor has no on-premises account and needs access only to Microsoft 365 services. Where can an admin create the cloud identity? Create a new AD DS user in an internal directory and assume it automatically becomes a cloud-only Entra identity without any synchronization Microsoft Entra ID user management Create an Exchange Online mail contact for the contractor and expect that contact object to supply an authenticating cloud sign-in identity Invite the contractor as an external B2B guest and treat that guest invitation as identical to provisioning the requested tenant-managed cloud-only user Explanation Correct Answer B:A cloud-only account can be created directly in Entra without requiring local AD DS. Incorrect Answers A:A local account is not a cloud-only Microsoft Entra account unless it is provisioned or synchronized appropriately; the scenario has no on-premises source. C:A mail contact can represent an external recipient but is not a native Microsoft Entra user with credentials for Microsoft 365 applications. D:B2B guest collaboration and a new tenant-managed cloud user have different identity ownership, lifecycle and sign-in expectations.
Question 102 An employee's display name was synchronized from on-premises AD DS, and a cloud edit is overwritten at the next synchronization. Where should the authoritative value be corrected? The user's Microsoft 365 Apps update profile Modify the cloud object's displayName property directly in Microsoft Entra and allow the next on-premises synchronization to reconcile it Change Exchange recipient display properties in the cloud while leaving the synchronized source object's displayName unchanged The originating on-premises AD DS attribute Explanation Correct Answer D:An on-premises mastered attribute is re-exported during synchronization and overrides cloud edits. Incorrect Answers A:Office client updates do not govern synchronized user attributes. B:A cloud-side edit cannot persist for an attribute whose source of authority is the synchronized on-premises AD DS record. C:An Exchange-side recipient edit is not the lasting authority for the directory attribute being overwritten by the next sync cycle.
Question 103 A cloud-only account is confirmed compromised and must no longer sign in while investigators preserve its mailbox. What immediate identity action fits? Permanently delete the compromised user together with the mailbox before placing the identity in a blocked-sign-in state Block the user's sign-in in Entra and revoke existing sessions as appropriate Remove the compromised user's verified custom-domain UPN suffix for all tenant users to force the affected identity to reauthenticate Reset the user's password but let previously issued sessions expire on their own Explanation Correct Answer B:Sign-in blocking contains access without deleting the account or mailbox evidence. Incorrect Answers A:Deletion jeopardizes required mailbox preservation and audit continuity; block sign-in and revoke sessions while preserving the account for investigation. C:Changing shared tenant domains is disproportionate and would disrupt unrelated identities without necessarily revoking existing sessions. D:A password reset alone may leave existing tokens or sessions usable during a confirmed compromise.
Question 104 A project needs an external consultant to collaborate in a SharePoint resource without being an employee. Which identity model is appropriate? Turn off tenant external access restrictions for everyone Give the consultant a named privileged directory administrator role because the SharePoint resource is in an enterprise tenant Invite a Microsoft Entra B2B guest and grant scoped resource access Create a tenant-managed cloud member account for the consultant and permanently grant ordinary employee-wide group privileges Explanation Correct Answer C:B2B collaboration lets the external identity access approved content with controlled permissions. Incorrect Answers A:Broad external access changes are unnecessary when guest invitations can be scoped. B:Directory-wide administrative privilege is unnecessary for a bounded SharePoint collaboration assignment and increases exposure. D:A member account may technically authenticate but violates external collaboration isolation and least-privilege resource scoping for a guest consultant.
Question 105 An external partner is invited for limited access, but the team assigns broad internal member roles. What risk is being introduced? Add the external partner to unrelated Microsoft 365 Groups whose shared files and calendars exceed the negotiated project workspace Assign the partner privileged roles in Microsoft Entra beyond the SharePoint resource grants requested in the approved access agreement Exchange mail flow encryption is necessarily disabled Permissions may exceed the partner's intended collaboration scope Explanation Correct Answer D:Identity type does not justify granting broad workspace or directory privileges. Incorrect Answers A:Unnecessary group membership extends resource access beyond the intended collaboration boundaries even if the invitation itself is valid. B:Broad administrative role assignments create excessive privileges; the risk is authorization scope, not a DNS-verification side effect. C:Guest access assignment does not switch off transport encryption.
Question 106 A vendor needs to appear in the organization's address list for email routing but should not receive Microsoft 365 sign-in credentials. What object is suitable? Create a B2B guest identity solely to supply the external address-list recipient, with guest sign-in still available in the directory A new cloud member user with a shared password Create a disabled cloud member user with the vendor's address and assign it mailbox properties for external delivery A mail contact configured with the external email destination Explanation Correct Answer D:Mail contacts represent external addresses without giving them sign-in accounts. Incorrect Answers A:A guest identity would provide potentially unnecessary authentication and collaboration access; a mail contact is sufficient for external routing. B:An interactive identity would grant unnecessary sign-in capability. C:A user identity is not required to represent an outside recipient in the address list; a mail contact has the appropriate recipient type.
Question 107 A supplier needs to receive email messages but must not sign in to SharePoint. Which design avoids unnecessary collaboration access? Invite a B2B guest with broad group membership Create a mail contact for the external address Invite a B2B guest but exclude it from resource access restrictions even though only external mail delivery was requested Provision a shared mailbox in the tenant for the external supplier and provide direct interactive access to its account Explanation Correct Answer B:A mail contact supports addressing without provisioning a guest sign-in. Incorrect Answers A:A guest can authenticate and access resources beyond receiving mail. C:Conditional Access exceptions govern sign-in, which is unnecessary for a supplier who should receive email without collaboration privileges. D:A shared mailbox with supplied credentials adds needless tenant sign-in risk and is not the correct external mail-contact model.
Question 108 Four help desk operators need access to a common support mailbox. Which configuration fits least-privilege teamwork? Use an Exchange shared mailbox with individually delegated access Create four independent mail contacts pointing to the support address instead of granting the named operators access to one shared mailbox Grant each help desk worker Exchange Administrator for the whole tenant in order to read and respond from one support mailbox Give all four the same licensed user mailbox password Explanation Correct Answer A:Delegation maintains separate operator identities and avoids a shared password. Incorrect Answers B:Mail contacts cannot provide authenticated shared mailbox access or a common folder history for operators within the tenant. C:Whole-service administration far exceeds the mailbox-specific access needed for teamwork and weakens privileged access boundaries. D:Shared credentials eliminate individual accountability.
Question 109 A delegate can open a shared mailbox but messages they send appear from their own address. Which permission should be assessed? Assign Full Access to the shared mailbox again and expect it to change the sender identity on outgoing messages Tenant-wide service health administrative permissions Assign the delegate ownership of the associated Microsoft 365 Group while keeping shared-mailbox Send As permissions unchanged Send As permission on the shared mailbox Explanation Correct Answer D:Full Access allows reading or managing mailbox data but does not necessarily grant sending as that address. Incorrect Answers A:Full Access allows opening mailbox content but does not itself grant the Send As identity that the question identifies as missing. B:Service incident roles do not grant Exchange sender delegation. C:Group ownership controls membership and group settings, not the Exchange shared mailbox's message sender identity.
Question 110 A department wants mail visibly attributed to an assistant sending for the director, rather than impersonating the director. Which delegation is appropriate? Send on Behalf for the director's mailbox Delegate Full Access to the director's mailbox and assume the permission also determines a visible on-behalf-of From header Assign a second default tenant domain Send As permission for the director's mailbox Explanation Correct Answer A:Recipients can see the assistant is sending on behalf of the director. Incorrect Answers B:Opening and managing mailbox contents is separate from the Send on Behalf delegate behavior that preserves sender attribution. C:Domain settings do not control delegate attribution. D:Send As normally presents the director as the sender instead of emphasizing delegation.
