Question 640 Three incidents are open: a low-severity simulation, active ransomware on production and a dormant risky configuration. What should responders prioritize? Ignore exposure configuration forever because there is active malware Handle the simulation first because it has more users Contain the active production ransomware while coordinating other findings by risk Process cases strictly by ticket creation date Explanation Correct Answer C:Ongoing destructive activity requires immediate action. Incorrect Answers A:Preventive remediation remains necessary after containment. B:Impact matters more than participation alone. D:Chronological order can miss urgent impact.
Question 641 A tenant wants to deploy Microsoft-recommended email protections rapidly to a pilot group. Which approach should the admin evaluate? A tenant-wide allow list for all domains An Exchange transport disclaimer alone Introduce a new Exchange retention label to test Defender for Office 365 threat filtering in a pilot security group A targeted Standard or Strict preset security policy appropriate to the pilot Explanation Correct Answer D:Presets coordinate supported protection settings across features. Incorrect Answers A:Broad allow lists weaken protection. B:A disclaimer does not implement layered threat protection. C:Retention controls content lifecycle rather than the anti-phishing or Safe Attachments policy selected for threat filtering.
Question 642 A highly targeted executive group faces elevated phishing risk and wants stronger protection with possible increased false positives. What choice is relevant? Disable anti-phishing policies for executives Configure only a service health alert subscription Use a global bypass of all safe attachments checks Evaluate Strict preset security policy for the selected high-risk users Explanation Correct Answer D:Strict settings prioritize stronger protection for high-risk groups. Incorrect Answers A:Privilege increases rather than reduces need for protection. B:Availability notifications do not filter email threats. C:Bypass increases malicious attachment exposure.
Question 643 Attackers imitate the CEO's display name in external messages to request wire transfers. Which Defender policy is relevant? Outbound spam policy for the CEO's own messages only Anti-phishing impersonation protection for selected priority users Apply a user mailbox archive policy to trigger Defender anti-spam phishing verdicts for messages arriving from external senders Only an organization-wide meeting policy Explanation Correct Answer B:Impersonation controls examine sender identity signals beyond display name. Incorrect Answers A:Outbound limits do not classify spoofed incoming messages. C:Archiving and threat verdicts are separate Exchange features; the relevant protection policy must be configured and targeted. D:Meetings settings do not inspect incoming mail.
Question 644 Attackers register lookalike domains similar to the company's brand and email employees. What setting should be considered? Label all externally received email for retention rather than configuring Defender anti-phishing protection and safe sender controls Defender for Office 365 anti-phishing domain impersonation protection Rely on a transport rule that checks only the sender display name A mailbox auto-reply for the domain registrar Explanation Correct Answer B:Lookalike domains can be evaluated as impersonation threats. Incorrect Answers A:Preserving mail does not apply detection, spoof intelligence or quarantine actions for a phishing threat. C:A display-name-only transport rule can miss lookalike domains and is not a substitute for impersonation detection. D:Replies do not detect lookalike senders.
Question 645 A message uses the organization's domain but fails expected sending authorization. Which evidence is central to spoof investigation? Compare the visible From name with the address-book entry without checking message authentication Only SharePoint site sharing permissions Authentication results and spoof intelligence signals for the sender Check the sender's Outlook address book display name and ignore authentication and header evidence for the spoofed message Explanation Correct Answer C:SPF, DKIM, DMARC and reputation support spoof analysis. Incorrect Answers A:Display-name matches do not establish sender authorization or explain the spoof verdict from SPF, DKIM, DMARC and headers. B:Site sharing is unrelated to message authentication. D:A familiar display name is easy to imitate and does not establish SPF, DKIM or DMARC results for the actual sending system.
Question 646 A legitimate mailing list forwards messages, and SPF alignment breaks even though DKIM remains valid. What should the admin consider? DMARC alignment behavior across SPF and DKIM after forwarding Change the outbound connector without evaluating sender-domain alignment Disable DKIM globally to avoid all forwarded-mail alignment failures instead of examining authentication results for the relay path Assume every forwarded message must be malicious Explanation Correct Answer A:Forwarding can break SPF without invalidating aligned DKIM. Incorrect Answers B:Transport configuration alone does not explain whether DKIM or SPF remain aligned after forwarding. C:Disabling valid DKIM signatures may reduce authentication evidence and will not identify the actual forwarding alignment issue. D:Forwarding is common and requires nuanced evaluation.
Question 647 Employees receive links that initially look benign but redirect to a malicious site hours later. Which protection is relevant? Safe Links URL analysis at supported time-of-click points Configure a mailbox archive policy that retains suspect mail longer rather than selecting the relevant Defender quarantine action Only an attachment detonation policy Only an inbound spam content keyword list Explanation Correct Answer A:Delayed weaponization can be detected during clicks. Incorrect Answers B:Archiving changes storage lifecycle, not the policy decision on whether unsafe messages enter user inboxes. C:Attachment scanning cannot inspect every clicked URL. D:Static keywords may miss link redirection.
Question 648 A security team needs evidence of which users clicked a suspicious URL and what protection outcome occurred. What report should it examine? Only Secure Score recommendations Verify the tenant custom domain through DNS and treat that as sufficient anti-phishing enforcement for external sender impersonation Defender Safe Links URL click reports and related user activity Only the mailbox quota for recipients Explanation Correct Answer C:Click telemetry links attempts to protection decisions. Incorrect Answers A:Posture score lacks individual click outcomes. B:Domain proof does not enforce safe message handling; anti-phishing controls need their own policy scope and signals. D:Quota is not click telemetry.
Question 649 An approved internal app uses signed URLs that break when rewritten, but external malicious links must still be inspected. What should be done? Assess narrowly scoped Safe Links exceptions for validated URLs or app behavior Exempt every domain ending in .com Disable Safe Links across the entire tenant Remove all click logging to avoid rewrite errors Explanation Correct Answer A:Exceptions should protect function without weakening broad coverage. Incorrect Answers B:Mass exemptions hide most threats. C:Global disablement removes malicious link protection. D:Logging does not determine URL rewriting.
Question 650 Attackers send previously unseen malicious Office files that signature-based scanning does not recognize. What feature can help? Accept any message with a valid DKIM signature as safe without considering the signer's domain alignment or message threat evidence A mailbox retention tag with indefinite storage Safe Attachments dynamic analysis for supported attachments Safe Links URL protection alone Explanation Correct Answer C:Detonation assesses behavior beyond known signatures. Incorrect Answers A:A signature can validate mail from a different domain and does not by itself rule out phishing content or impersonation. B:Preservation cannot detect malicious file behavior. D:Link checking is not a substitute for file analysis.
