Question 170 A group contains confidential documents and its membership changes must be approved. What is a safer owner setup? Only a domain verification TXT record for the group's email suffix Small named accountable group owners with an approval workflow All tenant users designated group owners One shared account password used by all project leads Explanation Correct Answer B:Scoped ownership and review reduce unauthorized addition of members. Incorrect Answers A:DNS ownership does not approve resource membership. C:Broad ownership permits uncontrolled membership changes. D:Shared identity reduces accountability for membership edits.
Question 171 An external partner's contact object exists, but employees cannot find it in the directory list. What should be reviewed? Only the company OneDrive version retention A Microsoft Defender endpoint antivirus exclusion The mail contact's address list visibility and directory synchronization state Invite the vendor as an Entra B2B guest without checking whether the existing mail contact is hidden from address lists Explanation Correct Answer C:Visibility settings or missing synchronization can hide an otherwise valid contact. Incorrect Answers A:File versioning cannot show a mail contact. B:Endpoint malware policy is unrelated to address book objects. D:B2B collaboration does not determine visibility of a recipient contact in Exchange address books.
Question 172 HR sends a department transfer list, and an engineer must remove and add group memberships for hundreds of staff. What validation makes the update safer? Change every employee's primary email domain simultaneously Disable all directory audit logs during the change Use an unrestricted -All wildcard against every tenant group Compare the approved expected membership delta with a dry-run output Explanation Correct Answer D:An exact change preview catches unintended removals before production execution. Incorrect Answers A:SMTP suffix changes are unnecessary for group membership updates. B:Losing audit evidence makes the migration harder to defend. C:Broad wildcard writes risk touching unrelated departments.
Question 173 A team wants to nest security groups and assume that every Microsoft 365 connected workload evaluates nested membership identically. What should it verify? That all groups have identical display names Support for nested group evaluation at each target resource and policy That the tenant uses one outbound email relay That every group uses the same mailbox alias Explanation Correct Answer B:Services vary in how indirect group membership is used for access and licensing. Incorrect Answers A:Names do not determine nesting evaluation behavior. C:Mail routing does not establish nested access semantics. D:SMTP aliases are not group membership inheritance mechanisms.
Question 174 An invited contractor must have collaboration access for 30 days, then be removed without affecting employees. Which design is appropriate? Set the guest's Microsoft 365 Group expiration date to 30 days and assume it automatically removes only that external contractor Turn off Microsoft 365 Backup when the contract ends Use time-bounded guest entitlement or scheduled access review with resource scope Disable all tenant users after 30 days Explanation Correct Answer C:Guest governance can expire access rather than relying on indefinite membership. Incorrect Answers A:Group expiration applies to the group's lifecycle, not a guest's time-limited membership or resource entitlement. B:Backup protection is unrelated to guest membership expiry. D:Tenant-wide account disablement is disproportionate.
Question 175 A shared mailbox grows beyond the supported unlicensed size threshold. What must the administrator evaluate? A new Global Administrator for each delegate A DLP policy excluding the support address A suitable Exchange Online license for the shared mailbox's size and features A second custom domain for mailbox storage Explanation Correct Answer C:Unlicensed shared mailbox use has documented capacity and feature limits. Incorrect Answers A:Admin roles do not expand shared mailbox size eligibility. B:DLP exceptions do not supply mailbox storage licensing. D:Domains do not increase mailbox capacity entitlement.
Question 176 A staff member receives messages from a distribution group but cannot find a shared group calendar. What is the likely design mismatch? The user's Entra sign-in is necessarily blocked A distribution group does not provide the Microsoft 365 Group collaboration calendar Assign a calendar permission directly to the distribution list and assume that creates the group calendar and file workspace Purview data retention expired the group calendar immediately Explanation Correct Answer B:Mail fan-out alone is not the same resource model as a Microsoft 365 Group. Incorrect Answers A:Receiving a distribution message does not prove group calendar entitlement. C:A distribution list delivers mail; integrated collaboration calendars and sites belong to Microsoft 365 Groups. D:Retention settings cannot make a distribution list have a group calendar.
Question 177 A service team wants a common address but no one should sign in directly as that mailbox. What access principle should it follow? Keep the shared mailbox sign-in enabled but require all delegates to share a rotating password when responding from the common address Keep shared mailbox direct sign-in blocked and use individual delegate accounts Enable direct sign-in using one published password Make the mailbox a Global Administrator Explanation Correct Answer B:Delegation preserves user attribution and avoids shared interactive credentials. Incorrect Answers A:Shared interactive credentials remove individual attribution; block direct sign-in and delegate access to named staff accounts. C:A common password creates security and accountability problems. D:A service mailbox should not gain directory administration.
Question 178 An existing cloud-only user needs a new sign-in suffix after the brand domain is verified. Which attribute needs review? Only the device update channel The user's User Principal Name and any relevant sign-in/application dependencies Only the Exchange anti-malware notification address Only the group's email distribution address Explanation Correct Answer B:UPN change affects the sign-in name and can affect external application references. Incorrect Answers A:Client patch settings do not assign identity UPNs. C:Malware notifications do not update a user login suffix. D:A group alias is not the individual user's UPN.
Question 179 Several guest accounts have no resource access and must be removed. What should be checked before cleanup? Access ownership, invitation history and applicable retention requirements Whether service-health emails were read Remove the guest objects immediately without checking whether their invitation history includes preserved audit or ownership obligations Whether every user is assigned an unused Teams add-on Explanation Correct Answer A:Offboarding should not erase necessary evidence or active business commitments. Incorrect Answers B:Incident notifications do not govern guest identity deletion. C:Guest cleanup should respect relevant access ownership and retention considerations, not assume unused accounts are safe to erase. D:Licensing inventory alone cannot prove guests are safe to remove.
Question 180 An IT unit wants a Conditional Access policy to apply to a defined population of workforce users. Which group type is appropriate? An Exchange mail contact listing an external supplier A mail flow transport rule recipient list An Entra security group with verified membership where supported by the policy A Microsoft 365 Backup job group Explanation Correct Answer C:Security groups are appropriate identity scoping constructs for Conditional Access. Incorrect Answers A:A contact is not the intended workforce user group. B:Transport rule groups are not inherently policy target populations. D:Backup job scoping does not define Conditional Access membership.
