Question 140 An external analyst's engagement ends, but the tenant must preserve existing audit records. What should an owner do? Remove the guest's resource access and disable or delete the guest identity under retention policy Grant the departing analyst Compliance Administrator Delete all guest audit-log entries before removing access, on the assumption that cleanup is necessary when the contractor leaves Change the organization's default domain Explanation Correct Answer A:Revoking authorization can end collaboration without erasing unrelated audit evidence. Incorrect Answers B:Escalating privilege is the opposite of access removal. C:Existing investigative and compliance evidence should remain under applicable retention; remove permissions, not the audit trail. D:Domain naming has no bearing on one guest's permissions.
Question 141 A confidential project group has 120 members and many external guests. Who is best placed to justify membership during a periodic review? The Microsoft service-health incident team Every member of the tenant regardless of role The external DNS registrar for the organization's domain Accountable group owners or designated resource owners Explanation Correct Answer D:Owners know legitimate business need for membership and can approve removals. Incorrect Answers A:Service operations personnel cannot approve project access. B:Unrestricted approval lacks accountable access ownership. C:A registrar does not know internal project entitlement.
Question 142 An administrator mistakenly deletes a cloud user yesterday and needs its identity restored. Where should they begin? Microsoft 365 Message center product roadmap A Microsoft Purview DLP incident report The deleted-users recovery experience in Microsoft Entra ID Recreate a new user with the same UPN rather than recovering the deleted cloud identity from its supported recycle window Explanation Correct Answer C:Soft-deleted user objects can be recovered within supported retention limits. Incorrect Answers A:Release notices do not restore directory objects. B:DLP events do not provide the primary deleted-user restore workflow. D:A new identity can lose the original object ID and relationships; deleted-users recovery is the appropriate first route.
Question 143 A deleted employee is restored during the recovery window; a connected application expects the same directory object. Why is restoration preferable to recreating it? Recreating always restores all app permissions automatically Restoration can preserve the original object identity and links A service-health advisory changes object identifiers Tenant DNS TXT tokens regenerate lost object IDs Explanation Correct Answer B:Recreating a user may produce a new object ID and break dependent permissions. Incorrect Answers A:A new object is not equivalent to the prior directory principal. C:Vendor service notices do not rebind identity objects. D:DNS verification is unrelated to Entra object identifiers.
Question 144 An employee is on leave and a replacement needs to handle departmental email, without accessing their whole tenant account. What approach is appropriate? Grant scoped mailbox delegation using named accounts after approval Give the replacement the employee's authentication password Grant permanent Global Administrator to the replacement Turn off Exchange mailbox auditing for privacy Explanation Correct Answer A:Delegation supplies operational access without sharing credentials or directory-wide roles. Incorrect Answers B:Shared passwords break accountability and may violate security policy. C:Tenant-wide privilege is excessive for handling one mailbox. D:Disabling audit reduces accountability instead of scoping access.
Question 145 A guest can access a SharePoint file but does not appear in the expected group conversations. Which distinction should be checked? Whether the tenant's Office update channel changed Whether a Purview sensitivity label is attached to the guest identity Whether access to the SharePoint file was granted through a direct sharing link rather than Microsoft 365 Group membership Whether the guest is a member of the actual Microsoft 365 Group as well as a file recipient Explanation Correct Answer D:Individual file sharing can grant access without group membership. Incorrect Answers A:Application patching does not grant group conversation access. B:Labels classify content and do not directly add group membership. C:A direct file grant need not confer group conversation membership; verify the guest's actual group member state.
Question 146 A group is scheduled to expire, but its owner confirms the business project is still active. Which response preserves access? Delete the expiring group and recreate it with the same display name to prevent automatic expiration of its linked resources Turn off Microsoft Defender for Office 365 for the group Renew the group within the supported lifecycle process Delete the group and request that all documents be recreated Explanation Correct Answer C:Owner renewal can keep needed collaboration resources active. Incorrect Answers A:Recreation can lose the group's identity and associated content; renewal preserves the existing group lifecycle. B:Email protection does not renew an expiring group. D:Deletion unnecessarily disrupts content and history.
Question 147 A company wants project group names to indicate department and privacy classification. Which governance mechanism should be evaluated? Endpoint vulnerability exclusions for group owners Custom domain DNS verification for every group Supported Microsoft 365 Group naming policy and lifecycle conventions A global mailbox forwarding rule for new groups Explanation Correct Answer C:Naming policy can standardize group identity without manual post-creation renames. Incorrect Answers A:Endpoint exclusions do not set collaboration naming patterns. B:Groups do not require a dedicated verified DNS domain each. D:Mail flow cannot replace an identity naming convention.
Question 148 A tenant is overwhelmed with abandoned self-service groups and wants vetted creators. What can administrators evaluate? Supported controls limiting Microsoft 365 Group creation to an authorized population Create a mail distribution group called ApprovedCreators without configuring the supported Microsoft 365 Group creation restriction Resetting SharePoint recycle bin settings Changing Office application fonts by policy Explanation Correct Answer A:Group creation governance reduces unmanaged collaboration sprawl. Incorrect Answers B:A named distribution list alone does not limit who can provision collaborative groups in the tenant. C:File recovery retention does not prevent new group creation. D:Presentation changes do not regulate group creators.
Question 149 A user has direct and group-based licenses, but a service remains enabled after one group's assignment is removed. What should the admin inspect? Only an Exchange mail contact object Only a Teams meeting attendance report All effective direct and group license sources for that service plan Only the tenant's default domain Explanation Correct Answer C:Removing one grant does not remove access while another assignment remains. Incorrect Answers A:Mail contacts are unrelated to the user's effective product entitlements. B:Attendance history does not identify license-assignment provenance. D:UPN suffix choice does not enumerate license sources.
Question 150 A group license process fails because two products contain incompatible service plans. What should be resolved? The tenant's eDiscovery hold duration The specific plan conflict and intended combination of product licenses The user's office telephone number Add another license product to the same group without examining whether it conflicts with the user's existing service plan assignments Explanation Correct Answer B:Conflicting plans must be reconciled for the user's effective entitlement. Incorrect Answers A:Legal preservation does not alter entitlement compatibility. C:Contact metadata does not affect plan compatibility. D:More licenses may increase incompatible plan combinations; the assignment error identifies which entitlements conflict.
