Question 20 The company wants to monitor and manage Microsoft 365 Apps release channels using its central service management process. Which feature area is relevant? Microsoft 365 Apps update management in the admin center Entra domain verification wizard Exchange mailbox retention settings Purview sensitive-information types Explanation Correct Answer A:The organization can monitor supported update deployments and channel configurations centrally. Incorrect Answers B:DNS proof cannot select or monitor Office application builds. C:Mailbox retention is unrelated to desktop application update delivery. D:Classification patterns do not configure Microsoft 365 Apps update channels.
Question 21 An organization wants to limit broad exposure to a new Microsoft 365 Apps channel until testing finishes. What deployment decision is appropriate? Roll the chosen update channel to a designated pilot group first Disable Defender for Office 365 across the tenant Assign everyone Global Administrator to install patches Change the tenant's verified mail domains for the pilot Explanation Correct Answer A:Pilot scoping validates compatibility before scaling to the full fleet. Incorrect Answers B:Turning off email protection does not test Office application releases. C:Privileged directory roles are unnecessary for application update eligibility. D:DNS identity namespaces are not update channel targeting mechanisms.
Question 22 An update campaign shows devices assigned a new Microsoft 365 Apps build but many have not installed it. Which evidence is most relevant? Check the public SPF sender-policy DNS result to determine which devices have installed the new Microsoft 365 Apps client build Review Entra Identity Protection sign-in risks for the targeted employees and treat authentication risk as proof their Apps build installed Export each employee's Exchange forwarding destinations as a substitute for endpoint-level Microsoft 365 Apps build deployment reporting Device-level update status and deployment reports for the Apps management solution Explanation Correct Answer D:Deployment reporting distinguishes targeting from actual installation success. Incorrect Answers A:SPF authorizes senders; it cannot show device-level Office update deployment success or a failed installation state. B:Identity risk telemetry does not establish the installed software version or update deployment status on managed devices. C:Mail forwarding data describes message routing and does not distinguish devices targeted for updates from devices successfully installed.
Question 23 A regulated application is incompatible with the newest Office features. Which administrative response best limits unexpected changes? Move affected users to another verified email domain Delete Microsoft 365 service health subscriptions Turn on a more restrictive tenant DMARC policy Select an appropriate supported update channel and staged rollout cadence Explanation Correct Answer D:Channel strategy provides predictable feature delivery while allowing security servicing. Incorrect Answers A:An email suffix change does not determine Office build availability. B:Notifications do not control client update cadence. C:Email authentication policies do not control Office features.
Question 24 A ransomware incident overwrites SharePoint files; the business needs rapid recovery to an earlier point in time. Which capability should be evaluated? A DLP policy detecting credit card numbers An Exchange anti-phishing policy for a sender domain Microsoft 365 Backup for protected workloads and supported restore points Purview sensitivity labels only Explanation Correct Answer C:Backup supports restoring supported content after destructive or unwanted change. Incorrect Answers A:DLP blocks or monitors data movement, not restoring overwritten files. B:Sender protection cannot restore SharePoint versions after the incident. D:Classification labels do not substitute for a restore point.
Question 25 An organization assumes an Exchange mailbox backup policy will protect every OneDrive site. What must be verified? That OneDrive files have retention labels but no backup configuration That SPF includes the onmicrosoft.com domain That each relevant workload and protection unit has appropriate backup configuration That every mailbox has at least one alias Explanation Correct Answer C:Coverage is workload-scoped; Exchange protection is not automatic OneDrive protection. Incorrect Answers A:Retention may preserve records but does not confirm backup coverage or point-in-time recovery. B:SPF settings do not establish OneDrive recovery coverage. D:Aliases cannot extend a backup policy to another service.
Question 26 A help desk analyst needs to run a broad Microsoft 365 Backup restore. What should be checked before granting the request? Approve the backup restore request solely because the analyst has a Microsoft Teams entitlement, without checking restore role authorization Use Exchange shared-mailbox Send As permission as sufficient authority for a broad Microsoft 365 Backup data restore The required delegated backup or restore role and approved recovery scope Check whether the company's inbound SMTP MX destination changed recently and treat that DNS event as backup restore approval evidence Explanation Correct Answer C:Restoration is a privileged operation and should follow dedicated permissions and authorization. Incorrect Answers A:End-user collaboration licensing does not grant the role necessary to restore protected organizational data. B:Mailbox sending delegation is not a backup-restore privilege, and recovery scope still requires explicit authorization. D:DNS mail route changes do not establish the applicant's backup permissions or the permitted scope of restoration.
Question 27 A business requests recovery to a known safe moment before an accidental deletion. Which backup feature matters most? The number of users with Global Reader The preferred display order of MX records Availability of a restore point covering the affected workload and time Number of sensitivity labels deployed to the tenant Explanation Correct Answer C:The desired recovery time must be within the protection and restore capabilities. Incorrect Answers A:Read-only roles do not create recovery points. B:Mail routing priorities cannot recreate deleted content. D:Classification does not provide a historical backup snapshot.
Question 28 A user can't open OneDrive following a company-wide sign-in policy change, but Service health shows no OneDrive incident. What evidence is best to inspect? The user's Entra sign-in result and the changed access policy Review the user's OneDrive entitlement first, without checking the changed access policy Inspect the affected SharePoint site's member permissions without checking the sign-in decision Reconfigure the user's OneDrive synchronization client before examining browser sign-in results Explanation Correct Answer A:A tenant access policy can block a healthy cloud service for a particular user. Incorrect Answers B:OneDrive licensing can prevent service use, but the timing of a sign-in policy change makes its sign-in outcome the more direct evidence. C:A permission problem can deny content access, but the scenario identifies a tenant authentication-policy change rather than a site-permission edit. D:Sync-client remediation cannot explain a cloud sign-in policy decision without evidence of client-specific failure.
Question 29 A merger requires updating the legal organization contact information visible in Microsoft 365 administrative records. Where should the administrator look? The Entra Conditional Access policy list Organization profile settings in the Microsoft 365 admin center Purview Content explorer The Exchange anti-spam allow list Explanation Correct Answer B:Tenant profile metadata contains the configured organization information. Incorrect Answers A:CA policies govern access decisions, not the company's legal contact profile. C:Content search is not the tenant organization profile editor. D:A sending domain list does not update business information.
Question 30 A company is changing inbound mail to Exchange Online but wants the transition reversible. Which preliminary step most directly supports operational readiness? Record existing MX and related DNS values and plan tested rollback thresholds Delete all users in the outgoing mail platform before the switch Enable tenant-wide forwarding to unknown addresses Remove the custom domain from Microsoft 365 after verifying it Explanation Correct Answer A:Documented records and validation reduce cutover risk when changing mail routing. Incorrect Answers B:Premature deletion makes rollback difficult and threatens message continuity. C:Uncontrolled forwarding introduces privacy and mail delivery risks. D:The domain must stay attached for recipient addresses and routing.
