Question 130 An administrator assumes adding a group to another licensed group always passes inherited product licenses through any nested membership depth. What should be verified? Inspect the parent group's dynamic membership rule but assume nested licensing is supported Whether the nested group has an Exchange address alias that matches the parent group's email domain Whether the licensing mechanism supports the intended direct membership and nesting behavior Whether all group members share the same UPN suffix Explanation Correct Answer C:Licensing eligibility must be verified rather than assuming nested groups inherit every license. Incorrect Answers A:Membership evaluation alone does not prove that nested memberships pass product entitlement through group-based licensing. B:Mail addresses do not determine the supported direct membership requirements of Entra group-based licensing. D:UPN domain does not establish nested licensing semantics.
Question 131 A user receives an assignment failure when a regional product requires geographic eligibility. Which directory property is relevant? The Exchange mailbox archive quota The user's usage location and the license's regional availability requirements The user's preferred OneDrive sharing link type Check the user's Exchange Online mailbox location rather than the Entra usageLocation used in regional license eligibility Explanation Correct Answer B:License assignment eligibility can depend on correctly set usage location. Incorrect Answers A:Mailbox storage does not define the account's licensing geography. C:Sharing defaults do not determine regional license eligibility. D:An Exchange mailbox location does not establish the directory usage-location restriction for assigning the specified regional subscription.
Question 132 A long-term leave user must keep retained mailbox data but should stop using a paid workload. What must administrators assess before removing a license? The workload's data retention and mailbox preservation requirements when de-licensing Only the tenant's Microsoft Secure Score recommendation count Remove the suite license immediately and assume the departed user's existing mailbox, archive, and compliance preservation remain unaffected Keep mailbox delegation unchanged and remove the license without checking mailbox preservation Explanation Correct Answer A:Removing a license can change service eligibility and data lifecycle behavior. Incorrect Answers B:Secure Score does not define the correct data retention handling for a leaver. C:De-licensing can change available mailbox features or data handling; preservation must be assessed before entitlement removal. D:Delegation does not preserve licensed mailbox data when de-licensing changes the supported mailbox state or retention behavior.
Question 133 A vendor's contact email changes, and employees still select the old address from the organizational list. Which object should be updated? A Microsoft Entra administrative unit A Defender Endpoint onboarding policy Update the vendor's guest-user collaboration permissions while leaving the external mail contact's delivery address unchanged The mail contact representing the vendor's external address Explanation Correct Answer D:Address-list contact metadata controls the destination shown for that external recipient. Incorrect Answers A:Admin scope does not define mail contact destinations. B:Device enrollment cannot edit the vendor email address. C:Guest resource authorization does not correct the external recipient address presented by the organizational address list.
Question 134 A shared mailbox is accessible to eight staff and audit evidence must identify who sent each response. Which practice supports attribution? Give the mailbox a publicly known password Use named user delegates rather than one shared interactive mailbox password Give every staff member an independent shared mailbox password rotation schedule while sending all messages from the same account Disable Exchange mailbox auditing for delegates Explanation Correct Answer B:Individual delegates leave distinct user actions instead of a single shared credential. Incorrect Answers A:Shared credentials make auditing and containment difficult. C:Direct shared logins mask actor attribution; named delegates with mailbox auditing better identify who sent the response. D:Removing audit activity obscures attribution.
Question 135 A dormant project group still holds a SharePoint site and mailbox years after closure. What governance mechanism should be assessed? A Teams meeting lobby policy change Group lifecycle and expiration policies with accountable owner review A tenant-wide Endpoint DLP exception Delete the group's SharePoint site and Exchange mailbox without reviewing whether the project owner still needs historical content Explanation Correct Answer B:Group lifecycle controls can identify and retire unused collaboration resources safely. Incorrect Answers A:Lobby rules do not delete or archive group resources. C:DLP exceptions do not retire stale Microsoft 365 Groups. D:Unreviewed deletion is not a controlled lifecycle decision and may lose business records that require owner confirmation.
Question 136 The only owner of a Microsoft 365 Group has retired, but the team still needs its conversations and SharePoint site. What is the least disruptive response? Appoint a new authorized group owner without recreating the group Delete and recreate the group with the same display name instead of reassigning an authorized owner to the existing object Convert every group member into a tenant administrator Delete and recreate the group to reset ownership Explanation Correct Answer A:Changing ownership preserves group resource identity and contents. Incorrect Answers B:Recreation can lose object identity and related collaboration resources; ownership can be re-established without replacing the group. C:Global roles are not required to manage one project group. D:Recreation can disrupt mail, files, links and history.
Question 137 A dynamic group excludes recently synchronized workers even though their job titles appear correct in HR. What should administrators inspect? The actual Entra attribute values and dynamic membership evaluation result The tenant's service health notification recipient list Inspect the HR source file's job-title strings but not the resulting Entra property values or dynamic membership evaluation The company's Teams call quality dashboard Explanation Correct Answer A:HR labels and synchronized directory values may differ until the rule's inputs are correct. Incorrect Answers B:Notification subscriptions cannot fix group rule matches. C:The group rule evaluates effective Entra attributes, which may differ from an HR source string until mapped and synchronized. D:Media telemetry does not evaluate group membership conditions.
Question 138 A Graph PowerShell cleanup script should delete only disabled test accounts. Which control should be added before destructive execution? A precise preflight filter, output review and limited scoped execution with audit logging Enable a wildcard user selection with no preview Disable sign-in auditing before execution Execute the wildcard delete command with a broad tenant filter, relying on PowerShell confirmation prompts instead of a test-account preflight list Explanation Correct Answer A:Verifying matching objects prevents unintended deletions while retaining traceability. Incorrect Answers B:An unbounded selection increases the risk of deleting real accounts. C:Reducing evidence is not a guard against script errors. D:Confirmation dialogs do not provide sufficient evidence that the filter is restricted to the approved disabled test accounts.
Question 139 An employee is synced from AD DS, while another is cloud-only. Why should a bulk profile-update script distinguish them? Mail contacts are the authority for all user profile fields Apply cloud-only update commands to all users, relying on the next sync cycle to preserve edits even for AD DS-mastered attributes The writable authoritative directory differs by identity source Only synced users can have Microsoft 365 licenses Explanation Correct Answer C:Changing a synced cloud attribute may be overwritten, while cloud-only objects can be updated in Entra. Incorrect Answers A:Mail contacts do not master employee user identity attributes. B:Synced identities can overwrite cloud changes from the source system; cloud-only and synchronized accounts have different authorities. D:Both identity types can receive supported licenses.
Question 140 An external analyst's engagement ends, but the tenant must preserve existing audit records. What should an owner do? Remove the guest's resource access and disable or delete the guest identity under retention policy Grant the departing analyst Compliance Administrator Delete all guest audit-log entries before removing access, on the assumption that cleanup is necessary when the contractor leaves Change the organization's default domain Explanation Correct Answer A:Revoking authorization can end collaboration without erasing unrelated audit evidence. Incorrect Answers B:Escalating privilege is the opposite of access removal. C:Existing investigative and compliance evidence should remain under applicable retention; remove permissions, not the audit trail. D:Domain naming has no bearing on one guest's permissions.
