Question 190 A company mandates that subscriptions be assigned only by team groups. An administrator manually assigns a license to one user during troubleshooting. What governance gap arises? A direct assignment changes the user's public DNS record Direct grants permanently disable usage reporting A direct grant can bypass group-based lifecycle expectations Direct grants automatically make users tenant administrators Explanation Correct Answer C:Offboarding from groups may leave an unintended direct entitlement. Incorrect Answers A:License assignments do not edit DNS. B:Usage reports are independent from the licensing source. D:Product entitlement does not confer Global Administrator.
Question 191 An owner accidentally deletes a Microsoft 365 Group that contains business files. Which option should be checked promptly? Create a new Microsoft 365 Group with the same display name, expecting its original SharePoint site and content to reconnect automatically A Defender Endpoint quarantine release The supported deleted-group restoration window and recovery process A user password reset script Explanation Correct Answer C:Soft-deleted groups can often be restored within a limited period, including associated resources. Incorrect Answers A:A new group gets a new identity and does not reliably restore its deleted group's associated collaboration resources. B:Endpoint malware quarantine is unrelated to deleted group resources. D:Resetting user credentials does not restore group membership and files.
Question 192 A help desk operator can view user license assignments but cannot add a paid license. What should the team evaluate? A Purview sensitivity label policy Grant the operator read-only Global Reader and assume that grants write permission to change user licensing The operator's Microsoft 365 Apps channel Whether the operator has an appropriate delegated license administration role Explanation Correct Answer D:Read-only access does not necessarily authorize product assignments. Incorrect Answers A:Content classification cannot grant license administration permissions. B:Viewing effective licenses differs from the delegated administrative role that can modify subscription assignments. C:Office update channels do not grant administrative license permissions.
Question 193 A team plans to rely on a single group owner for compliance approvals. What resilience step reduces disruption? Publish one shared admin password for all members Disable user account audits to simplify ownership Designate additional authorized owners and document responsibility Change the group's email alias every month Explanation Correct Answer C:Multiple accountable owners reduce abandonment if one owner leaves. Incorrect Answers A:Shared privileged credentials decrease accountability. B:Removing records weakens oversight and does not create backups. D:Alias rotation does not ensure owner availability.
Question 194 A partner account is suspected of unauthorized file downloads, but other external guests are legitimate. What should the tenant do? Delete all SharePoint sites containing guests Contain the specific guest's access and investigate its audit activity Block all external guests tenant-wide instead of restricting the one suspicious partner and investigating their SharePoint activity Disable all tenant external users permanently Explanation Correct Answer B:Scoped disablement and evidence review protect unrelated collaborations. Incorrect Answers A:Site deletion destroys content without establishing what happened. C:Blanket guest blocking disrupts legitimate collaborators; targeted containment and audit review fit the reported account risk. D:Blanket guest disablement may unnecessarily disrupt other approved partners.
Question 195 An automation service principal needs read-only directory access, but a team wants to assign a shared human account for convenience. Why is that weaker? A managed application identity and scoped permissions improve attribution and credential control The app will automatically need Global Administrator Reuse a licensed human administrator account for automation and share its password with the service integration A shared human account always provides stronger multifactor prompts Explanation Correct Answer A:Service principals separate automation from individual user sign-in and enable scoped governance. Incorrect Answers B:Read-only Graph access does not justify tenant-wide permanent roles. C:A shared human credential obscures workload attribution; a service principal/managed identity and scoped grants are appropriate. D:Shared credentials undermine identity attribution even when MFA is used.
Question 196 An admin removes unused premium licenses after a departure campaign. What check prevents service interruptions? Verify target users, dependent service plans, and remaining business need before revocation Rely solely on domain verification status Delete all device enrollment records before license removal Assume every inactive Teams user needs no Microsoft 365 license Explanation Correct Answer A:Some workers may still rely on premium capabilities despite low apparent use. Incorrect Answers B:DNS control cannot determine business license need. C:Device removal is not required to assess licensed use. D:Inactivity in one workload does not prove entitlement is unnecessary.
Question 197 A new cloud user was licensed five minutes ago but a workload still reports provisioning. What should be checked before recreating the account? The organization's Outlook signature disclaimer The employee's Teams background image DNS domain ownership TXT every time a service plan activates Effective licensing and current service provisioning status Explanation Correct Answer D:Some workload activation is asynchronous and recreating the user may complicate setup. Incorrect Answers A:Transport disclaimer rules do not provision a workload account. B:Cosmetic settings cannot speed service provisioning. C:Verification is not a per-user service provisioning step.
Question 198 A project includes confidential business plans and must prevent open self-enrollment in its collaboration group. What should be selected? Anonymous external guest links on all group files Appropriate private group visibility and controlled member approval Public group visibility for discoverability by every tenant user A default tenant domain change to a private-sounding suffix Explanation Correct Answer B:Privacy and ownership settings should reflect the sensitive membership scope. Incorrect Answers A:Anonymous links defeat the stated limited-access requirement. C:Public membership may expose resources beyond the intended team. D:Domain names do not enforce group privacy.
Question 199 An administrator deletes an unused shared mailbox and soon realizes required messages were preserved there. What should be assessed promptly? A Defender malicious URL block entry Supported recovery of the underlying deleted mailbox and retention/hold status The user's Microsoft 365 Apps installed version Create a new shared mailbox with the same address and assume it automatically contains all content from the deleted mailbox Explanation Correct Answer B:Deleted Exchange recipients may have time-bounded recovery paths and preservation dependencies. Incorrect Answers A:URL detection does not restore a shared mailbox. C:Desktop build cannot recreate mailbox data. D:A new recipient does not recover the original mailbox contents; investigate supported deleted mailbox recovery and holds.
Question 200 A former vendor employee still appears on a sensitive site's allowed-users list despite removal from its project group. What should the admin investigate? Only the guest's preferred language setting Direct site permissions and other surviving group grants Only the tenant's domain verification history Only the user's Exchange spam quarantine Explanation Correct Answer B:Removing one group membership may leave separate authorization routes. Incorrect Answers A:Profile localization does not determine site permissions. C:DNS history cannot identify SharePoint permissions. D:Quarantine state cannot revoke site access.
