Question 660 A user can request a quarantined message but cannot restore it personally. What policy difference explains this? Every quarantined message must automatically be deleted An SPF lookup decides who can click release The user's mailbox quota determines release rights Quarantine policy allows request-release while requiring authorized approval Explanation Correct Answer D:User request and direct release are different capabilities. Incorrect Answers A:Quarantine permits supported management workflows. B:Sender DNS is not quarantine authorization. C:Storage does not grant threat-release permission.
Question 661 A supplier's invoices are quarantined due to a spam verdict, causing missed payments. What is the safest first response? Immediately release every attachment from the sender Globally allow all supplier-domain mail without review Turn off anti-spam protection for all finance mailboxes Validate message headers, threat signals and sender authenticity before scoped remediation Explanation Correct Answer D:Trusted business context does not override malicious indicators. Incorrect Answers A:Attachments still require verdict review. B:A domain can be spoofed or compromised. C:Broad bypass increases risk.
Question 662 An administrator wants to block a confirmed malicious URL across supported Microsoft 365 protection surfaces. What capability may help? Only a new MX record Only a custom transport disclaimer Only a mailbox retention hold Tenant Allow/Block List entry for the verified URL indicator Explanation Correct Answer D:A centrally managed URL indicator can enforce supported blocks. Incorrect Answers A:Mail routing cannot blacklist a web URL. B:Disclaimers do not block malicious URLs. C:Preservation does not prevent malicious click-through.
Question 663 A trusted sender domain was temporarily allowed after a false positive, but an account there is now compromised. What should security do? Reassess and remove overly broad allow overrides with expiration and evidence review Disable alerting for the entire domain forever Change recipient email aliases to bypass controls Keep the allow indefinitely because the domain was once safe Explanation Correct Answer A:Allow rules can undermine updated threat verdicts. Incorrect Answers B:Suppression hides new threats. C:Aliases do not resolve unsafe trust assumptions. D:Sender compromise can change risk.
Question 664 A compromised account sends high-volume suspicious messages to external recipients. Which Microsoft 365 policy family is relevant? Only an MFA registration campaign Only inbound anti-malware scan policy Only a mailbox retention policy Outbound spam protection and restricted sender controls Explanation Correct Answer D:Outbound policies help contain abusive sending. Incorrect Answers A:Enrollment alone does not stop current spam transmission. B:Inbound scanning does not directly govern outbound abuse. C:Retention does not restrict sending volume.
Question 665 A legitimate user cannot send mail after a wave of compromised-account spam activity and appears in a restricted list. What should be done? Change only the sender's display name Disable all outbound spam limits tenant-wide Investigate the restricted user or entity, secure the account, then follow approved unblock procedure Delete all anti-spam alert records immediately Explanation Correct Answer C:Unblocking without remediation could restart abuse. Incorrect Answers A:Cosmetic changes do not clear suspicious sending. B:Broad disablement increases compromise impact. D:Removing evidence does not secure the account.
Question 666 A security team wants employees to submit suspicious email directly to a central investigation queue. Which feature should be deployed? A general mailbox auto-reply for all suspicious senders A tenant DNS ownership verification record A retention label applied to the Inbox Supported user-reported message submission settings with reporting destinations Explanation Correct Answer D:Structured submissions help analysts triage suspected phishing. Incorrect Answers A:Replies can disclose addresses and do not classify messages. B:Domain proof cannot submit messages. C:Retention does not create a reporting action.
Question 667 A user reports a suspicious email as phishing, but automated detection initially marked it clean. What should analysts do? Disable the reporting add-in to reduce alerts Dismiss all user reports whenever initial filtering passes Review reported message evidence and update verdict or submit it as appropriate Automatically mark every user-reported message malicious Explanation Correct Answer C:User reports may reveal missed threats. Incorrect Answers A:Removing reports weakens a detection channel. B:Automated filters are not infallible. D:Some reports are false positives.
Question 668 A team wants alerts when high-confidence malware detections surge in Exchange Online. What should it configure? Only an Exchange signature format policy Only the organization's SharePoint quota alert Only a tenant billing notification Defender alert policy conditions and notifications for the relevant detection type Explanation Correct Answer D:Alert policies route security signals to responders. Incorrect Answers A:Signatures do not alert on outbreaks. B:Storage usage is not malware telemetry. C:Billing events do not identify infected messages.
Question 669 Several overlapping phishing alert policies create duplicate notifications. What should an admin examine? Only the mailbox retention schedule Only the user's preferred language Only the company's public mail MX record Alert conditions, thresholds, scopes and delivery recipients across the policies Explanation Correct Answer D:Overlapping rules can amplify a single event. Incorrect Answers A:Retention cannot deduplicate security alerts. B:Language does not eliminate duplicate policy matches. C:SMTP routes do not select alert recipients.
Question 670 A message passes SPF but is still classified high-confidence phishing by Defender. How should the result be interpreted? Authentication pass is one signal; phishing models also assess content and behavior SPF pass proves the content is safe MX routing directly controls the phishing verdict DKIM presence eliminates impersonation risk Explanation Correct Answer A:Legitimate infrastructure can send malicious messages. Incorrect Answers B:Sender authorization does not attest harmlessness. C:Inbound routes do not guarantee message safety. D:Signed messages can be socially engineered.
