Question 650 Attackers send previously unseen malicious Office files that signature-based scanning does not recognize. What feature can help? Accept any message with a valid DKIM signature as safe without considering the signer's domain alignment or message threat evidence A mailbox retention tag with indefinite storage Safe Attachments dynamic analysis for supported attachments Safe Links URL protection alone Explanation Correct Answer C:Detonation assesses behavior beyond known signatures. Incorrect Answers A:A signature can validate mail from a different domain and does not by itself rule out phishing content or impersonation. B:Preservation cannot detect malicious file behavior. D:Link checking is not a substitute for file analysis.
Question 651 A finance department wants suspected malicious attachments blocked rather than delivered while scanning is pending. What should administrators configure? An Outlook client display setting A mail transport rule that removes every attachment regardless of verdict An appropriate Safe Attachments policy action and delivery behavior for the group A tenant-wide mailbox-size increase Explanation Correct Answer C:Policy actions control handling of detected or pending files. Incorrect Answers A:Client cosmetics do not enforce scanning. B:Blanket removal does not implement risk-based sandboxing. D:Quota does not choose detonation response.
Question 652 A legitimate signed spreadsheet is quarantined after sandbox analysis. What investigation is appropriate? Automatically treat signer reputation as conclusive Whitelist every spreadsheet attachment forever Turn off all attachment scanning for the whole tenant Inspect detection details, submit the file for review and use authorized narrow remediation Explanation Correct Answer D:Validation matters before releasing or bypassing a flagged file. Incorrect Answers A:Signed files can still be compromised. B:Broad bypasses invite malicious macros. C:One false positive does not justify broad disablement.
Question 653 A message is delivered and later identified as malicious by updated threat intelligence. Which feature may remove supported delivered messages? A user mailbox archive action A sensitivity label publishing policy Zero-hour auto purge under Defender protection policies A static MX DNS route change Explanation Correct Answer C:Post-delivery cleanup can respond to later verdict changes. Incorrect Answers A:Archiving moves content but does not use a threat verdict. B:Labels do not purge malicious messages automatically. D:Inbound routing cannot retract delivered messages.
Question 654 A malicious URL email was delivered before detection; investigators need to know whether it was moved or deleted automatically. What should be checked? Only an unrelated endpoint vulnerability report Defender post-delivery action evidence and relevant message investigation details Only the company's SPF TXT value Only the employee's calendar availability Explanation Correct Answer B:Action records show cleanup results and scope. Incorrect Answers A:Vulnerability inventory cannot prove message purge. C:Sender DNS does not show postdelivery action. D:Calendar events do not show ZAP outcomes.
Question 655 A phishing campaign targeted hundreds of users, and security needs to pivot on sender, subject and URL. Which experience is useful? Only the Microsoft 365 admin usage report Only the SharePoint document library search Defender for Office 365 Threat Explorer or supported email investigation experience Only a Teams meeting attendance report Explanation Correct Answer C:Explorer provides message and threat detection pivots. Incorrect Answers A:Adoption analytics do not identify phishing messages. B:Site content search is not mail campaign triage. D:Meetings data cannot group messages by sender URL.
Question 656 A recipient claims a suspicious message never arrived, while Defender reports it quarantined. Which data sources can clarify the route? Message trace together with Defender message disposition and quarantine evidence Only endpoint process events Only the user's mailbox display name Only a Secure Score control status Explanation Correct Answer A:Transport and protection logs show what happened. Incorrect Answers B:Process events do not prove email transport disposition. C:Display metadata does not identify routing. D:Posture is not a message delivery record.
Question 657 A file hash appears in emails to 80 recipients, but only two devices show execution. What distinction matters? If no execution is seen the email cannot be malicious Mail receipt does not establish that the attachment executed on every endpoint Every recipient must have executed the attachment The file hash automatically identifies compromised credentials Explanation Correct Answer B:Endpoint telemetry determines local execution scope. Incorrect Answers A:Threat verdict does not require successful execution. C:Delivery alone is not execution proof. D:A hash is not proof of credential theft.
Question 658 A malicious link was shared through Teams rather than email. Which area should security review? Only the sender's DKIM status Only Exchange inbound connector rules Defender collaboration threat telemetry and URL protections applicable to Teams Only Outlook junk folder counts Explanation Correct Answer C:Phishing can arrive through collaboration channels. Incorrect Answers A:Teams messages are not SMTP mail. B:SMTP connectors do not inspect all Teams chats. D:Mailbox junk folders lack Teams conversation scope.
Question 659 Help desk staff may release harmless messages but must not allow unreviewed high-risk phish to self-release. What configuration matters? Use only a mailbox retention tag Remove quarantine notifications entirely without alternatives Quarantine policy permissions and release request/approval settings by threat category Grant every user immediate release of all malware Explanation Correct Answer C:Release rights can be scoped by risk. Incorrect Answers A:Retention does not determine quarantine permissions. B:Users may lose appropriate review avenues. D:Unrestricted release defeats quarantine.
Question 660 A user can request a quarantined message but cannot restore it personally. What policy difference explains this? Every quarantined message must automatically be deleted An SPF lookup decides who can click release The user's mailbox quota determines release rights Quarantine policy allows request-release while requiring authorized approval Explanation Correct Answer D:User request and direct release are different capabilities. Incorrect Answers A:Quarantine permits supported management workflows. B:Sender DNS is not quarantine authorization. C:Storage does not grant threat-release permission.
