Question 40 The domain MX record points to Microsoft 365 and DNS lookup succeeds, but one employee cannot receive mail. What is the most targeted next check? Verify that employee's Exchange Online recipient address and mailbox provisioning Move the employee into a different Purview DLP policy Rerun a successful public MX lookup without inspecting the individual's Exchange recipient and address assignment after provisioning Turn off Microsoft Defender for Endpoint on the employee computer Explanation Correct Answer A:A correctly routed message still needs a recognized, provisioned recipient. Incorrect Answers B:DLP policies are not a substitute for a valid Exchange recipient. C:A healthy MX record proves the tenant is reached, but not that this user's accepted recipient address exists or resolves correctly. D:Endpoint security is not the mailbox's receiving infrastructure.
Question 41 Microsoft 365 Service health shows no incident, but two remote offices have degraded performance. Which investigation should lead? Increase sensitivity label protection levels Assume the entire Microsoft 365 service is down globally Compare regional egress, DNS, proxy and Microsoft network connectivity signals Disable every Exchange mail flow rule Explanation Correct Answer C:A multi-site subset pattern can stem from shared ISP or networking choices. Incorrect Answers A:Labels do not repair a degraded network route. B:No global incident evidence exists and most other sites are healthy. D:Transport rules do not explain all cloud-service latency.
Question 42 A global admin wants Teams outage notifications to reach a dedicated operations distribution list rather than every employee. Which approach is appropriate? Assign every user the Global Administrator role Publish a new verification TXT record for the service Modify each employee's Exchange alias to the operations address Configure authorized service health notification recipients according to supported settings Explanation Correct Answer D:Targeted admin subscriptions notify the responsible team without unnecessary broadcast. Incorrect Answers A:Role escalation to all employees is unnecessary and unsafe. B:The tenant has already proved DNS ownership; TXT records do not subscribe teams. C:Changing recipient aliases is not a service incident subscription method.
Question 43 Some messages originate from both the old relay and Microsoft 365 during a phased cutover. What must be considered in SPF design? Remove DKIM signing from the old sender immediately Authorize all legitimate sending systems in a single valid SPF policy Publish separate independent SPF TXT records for each mail provider Change only the domain's MX preference Explanation Correct Answer B:During coexistence, legitimate senders need authorization without creating competing SPF records. Incorrect Answers A:DKIM removal does not fix SPF record structure during coexistence. C:Multiple SPF policy records at the same name can cause SPF permerror. D:Inbound MX routing does not identify all outbound sender IPs.
Question 44 An organization has configured custom sign-in branding but users accessing a third-party phishing page see a similar logo. What does branding alone not prove? That the site is authentic or that the session uses the expected Microsoft login endpoint That the organization's security team has read all alerts That an employee holds a Microsoft 365 license That a verified custom domain is owned by the organization Explanation Correct Answer A:Attackers can copy logos; the actual domain and authentication flow still matter. Incorrect Answers B:Branding provides no evidence of incident handling. C:A login page design is unrelated to assigned subscriptions. D:Domain verification is a separate administrative process.
Question 45 An organization accepts mail for two acquired brands in one tenant. Which configuration supports inbound mail for both? Make all employees Global Administrators in the tenant Verify each custom domain and provision its accepted Exchange recipients Set a single brand's MX and assume the second is automatically routed Use an Entra group alias instead of verifying the second domain Explanation Correct Answer B:Each domain must be validated and recognized by the service for recipient resolution. Incorrect Answers A:Admin role assignments do not establish SMTP recipient addresses. C:DNS is per-domain; one brand's MX does not route another brand's inbound mail. D:A group alias cannot stand in for domain ownership verification.
Question 46 A registrar displays a TXT record under the wrong hostname, leaving Microsoft unable to verify the custom domain. What should be corrected? Disable Microsoft Entra Password Protection Set the domain's MX target to the DNS registrar Place the exact Microsoft-issued verification value at the required public DNS record name Replace the organization's SPF statement with the verification value Explanation Correct Answer C:Validation depends on finding the expected token at the correct DNS name. Incorrect Answers A:Password screening has no effect on public DNS ownership checks. B:MX is not used to locate a TXT ownership token. D:Overwriting SPF breaks mail authentication while failing to fix a misnamed record.
Question 47 A support ticket describes failed Outlook and OneDrive access after a policy update, but Teams remains available. Which first diagnostic is most useful? Change all custom domain MX records Inspect per-application Entra sign-in logs and effective Conditional Access results Turn off Microsoft 365 Backup Delete and recreate the tenant immediately Explanation Correct Answer B:Policies can have specific application scopes that explain selective failures. Incorrect Answers A:Inbound email DNS cannot explain simultaneous OneDrive access denial. C:Backup protection does not determine application sign-in access. D:A tenant rebuild is destructive and not an initial diagnostic step.
Question 48 After lowering an MX record's TTL, a few remote senders still deliver to the old gateway. What should the team examine? Whether Exchange message trace retention was shortened The cached DNS answer's remaining TTL at the remote resolvers Whether the user's OneDrive quota was increased The number of DKIM signatures per message Explanation Correct Answer B:Existing caches may retain the prior MX until its original TTL expires. Incorrect Answers A:Trace retention affects investigation, not DNS caching. C:File storage has no influence on external mail sender routing. D:Signatures do not expire a cached MX lookup.
Question 49 A marketing team wants mailboxes ending in offers.example.com, separate from example.com. What should the admin plan? Add a transport rule to rewrite all unrelated addresses Add and verify the subdomain as a supported accepted custom domain Configure only a new SharePoint site URL Assume verification of example.com always provisions every subdomain mailbox automatically Explanation Correct Answer B:A subdomain needs the appropriate tenant/domain and DNS configuration for that namespace. Incorrect Answers A:Mail flow rewrites do not replace registering and provisioning the intended domain. C:SharePoint naming is unrelated to SMTP domain acceptance. D:Parent ownership alone does not create accepted Exchange recipients for each suffix.
Question 50 One migrated brand's mail fails while the first remains healthy; each has a different MX host. What should be compared first? The tenant's Microsoft Secure Score trend The working brand's mailbox retention labels The functioning brand's Teams meeting policy The failing brand's own published DNS and accepted-domain configuration Explanation Correct Answer D:Each independent SMTP domain uses its own records and recipient acceptance. Incorrect Answers A:Secure Score is not an MX or accepted-domain diagnostic. B:Retention labels cannot explain the other brand's inbound MX lookup. C:Meeting controls do not direct delivery for a distinct SMTP domain.
