Question 160 An auditor wants a bounded list of current user accounts, identities and departments. Which mechanism supports a repeatable read-only extraction? A global app update channel policy A Microsoft 365 Backup restore operation An Exchange outbound spam filter policy Microsoft Graph PowerShell user queries selecting necessary properties Explanation Correct Answer D:Graph can retrieve directory object data for an auditable report with read scopes. Incorrect Answers A:Office patch policies do not export user identity attributes. B:Restoring content is not a directory reporting method. C:Spam rules do not enumerate user directory departments.
Question 161 Help desk finds a user absent from the active users list after termination; HR says access was meant to be blocked, not erased. What should be checked? Inspect the user's assigned groups but not the deleted-users container or object state A SharePoint DLP alert for the user Deleted-user state versus sign-in disabled state for the identity Remove the employee's product licenses and interpret the absence from Active users as proof their cloud identity was merely sign-in blocked Explanation Correct Answer C:Deletion and authentication blocking have different recovery and data lifecycle implications. Incorrect Answers A:A group membership review cannot distinguish a deleted account from an existing account whose sign-in is disabled. B:DLP may record file events but does not define directory deletion state. D:Licensing can affect access but does not determine whether the user object was deleted or only disabled; inspect identity state.
Question 162 A contractor must stop accessing one confidential team but retain access to another approved project. What is the narrowest administrative action? Remove the contractor from the specific team/group or resource permission Delete the contractor's guest account immediately Remove the contractor's email domain from accepted domains Disable all external guest access in the tenant Explanation Correct Answer A:Scoped removal enforces least privilege without terminating all approved collaboration. Incorrect Answers B:Deleting the identity would also remove access to the unrelated approved project. C:SMTP domain removal is not resource permission revocation. D:A broad tenant setting would disrupt other partnerships.
Question 163 The compliance team wants to know which named delegates opened or acted on a shared mailbox. Which capability should be considered? Exchange mailbox auditing and applicable audit search records Domain verification TXT history alone Message center change announcements alone Client update installation reports Explanation Correct Answer A:Delegated mailbox activity may be attributed through supported audit events. Incorrect Answers B:DNS records do not identify which employee accessed mailbox content. C:Vendor notices are not individual mailbox-access logs. D:Office versions do not attribute mailbox delegate actions.
Question 164 An employee leaves, but the business must retain a functional team contact mailbox for authorized staff. What lifecycle action might be suitable? Change the tenant domain verification token Convert the eligible user mailbox to a shared mailbox and delegate access under policy Delete all mail items and create a mail contact in place Publish the leaver's password to department staff Explanation Correct Answer B:This can preserve ongoing team mail service without sharing the leaver's credentials. Incorrect Answers A:DNS ownership does not alter mailbox lifecycle. C:A contact cannot retain the historical local mailbox contents. D:Credential sharing violates attribution and security.
Question 165 A long-lived compliance working group must retain its collaborative site despite standard short project-group expiry. What should administrators consider? Disable all tenant Microsoft 365 groups Documented exemption or renewal governance supported by group lifecycle policy Set all shared mailboxes to forward externally Change all users' Entra sign-in risk levels Explanation Correct Answer B:Group lifecycle can be managed without arbitrary deletion of business-critical resources. Incorrect Answers A:Tenant-wide deletion is far broader than protecting one group. C:Forwarding does not protect collaboration group lifecycle. D:Identity risk signals cannot exempt a group from expiration.
Question 166 An IT analyst exports a directory user list for a third-party vendor that needs only display names. What control applies? Select only the required Graph properties and restrict export access Export every available profile and credential property Publish the CSV using anonymous SharePoint links Disable Microsoft Defender for Office 365 to permit download Explanation Correct Answer A:Data minimization reduces unnecessary disclosure of sensitive directory details. Incorrect Answers B:Excess fields create avoidable data exposure. C:Anonymous distribution is incompatible with restricted vendor access. D:Email protection settings cannot justify broad directory data sharing.
Question 167 An employee joins a licensed group but does not immediately see the enabled service plan. What should the admin examine? Inspect the user's installed Office Apps build and assume any missing licensed cloud service must be a desktop software-version issue Readd the employee to the same licensing group repeatedly while ignoring group-based assignment processing failures and service-plan dependencies Group licensing processing status and user assignment errors before assuming failure Grant the service license directly to the user as a permanent workaround without examining the group's license processing errors Explanation Correct Answer C:Asynchronous assignment and processing errors can delay effective entitlement. Incorrect Answers A:A client build check does not reveal whether group-based license assignment was processed or whether the expected service plan was enabled. B:Membership churn is not an authoritative diagnosis of async group licensing errors and may prolong propagation rather than resolve it. D:Direct assignment can mask an underlying group-level failure and diverge from the intended centralized licensing model.
Question 168 An employee is assigned a Microsoft 365 suite but must not use one particular service for regulatory reasons. Which control is relevant? Delete the employee from Entra to remove that one service Disable the disallowed service plan while preserving required suite entitlements Add a Defender Safe Links exception for the employee Remove the user's complete Microsoft 365 suite license when only one service plan is prohibited and other suite capabilities are required Explanation Correct Answer B:Per-user or group service-plan controls can limit eligible workloads. Incorrect Answers A:Account deletion revokes far more than the restricted workload. C:URL protection is not service entitlement configuration. D:Full de-licensing is broader than disabling the restricted service plan and may affect legitimately needed services.
Question 169 A support team must keep a common reply history and folder structure, not merely fan out incoming messages. Which object better meets this need? A distribution list that only forwards mail to personal mailboxes Create a mail-enabled security group and expect it to maintain shared mailbox folders and a common sent-reply history A mail contact with an external destination An Exchange shared mailbox with delegated staff access Explanation Correct Answer D:A shared mailbox offers common content and reply context for a team. Incorrect Answers A:Distribution alone does not create a shared conversation repository. B:Mail-enabled security groups can distribute or authorize, but do not provide the shared mail store required for common responses. C:Contacts route to one address rather than host shared inbox history.
Question 170 A group contains confidential documents and its membership changes must be approved. What is a safer owner setup? Only a domain verification TXT record for the group's email suffix Small named accountable group owners with an approval workflow All tenant users designated group owners One shared account password used by all project leads Explanation Correct Answer B:Scoped ownership and review reduce unauthorized addition of members. Incorrect Answers A:DNS ownership does not approve resource membership. C:Broad ownership permits uncontrolled membership changes. D:Shared identity reduces accountability for membership edits.
