Question 670 A message passes SPF but is still classified high-confidence phishing by Defender. How should the result be interpreted? Authentication pass is one signal; phishing models also assess content and behavior SPF pass proves the content is safe MX routing directly controls the phishing verdict DKIM presence eliminates impersonation risk Explanation Correct Answer A:Legitimate infrastructure can send malicious messages. Incorrect Answers B:Sender authorization does not attest harmlessness. C:Inbound routes do not guarantee message safety. D:Signed messages can be socially engineered.
Question 671 A phishing message contains a QR code to a credential-harvesting site rather than a clickable URL. What should investigators examine? Only SPF pass or fail Only the visible text in the email body Applicable Defender message protections and the QR code destination or decoded URL Only the recipient's mailbox size Explanation Correct Answer C:Attackers can hide links in images. Incorrect Answers A:Sender authentication does not evaluate QR destination. B:The real destination may be in the QR image. D:Storage cannot identify image-based phishing.
Question 672 Finance receives an apparent supplier bank-change request from a legitimate but compromised sender mailbox. Which defense perspective matters? Use only a spam keyword filter for the word invoice Change the tenant's default domain to the supplier's domain Assume DKIM pass proves the request is authorized Behavioral and impersonation analysis plus out-of-band payment verification Explanation Correct Answer D:An authenticated sender can still be compromised. Incorrect Answers A:Simple keyword matches cannot prove fraud. B:Domain changes are not payment verification. C:Cryptographic mail signing does not verify business intent.
Question 673 A new mail flow bypasses expected attachment detonation because it enters through an unanticipated route. What should be verified? A user's Teams license automatically enables Safe Attachments Applicable protection policy scope, recipients and supported message route Defender endpoint onboarding replaces mail detonation The attached filename determines policy ownership Explanation Correct Answer B:A policy can only enforce on covered traffic. Incorrect Answers A:A collaboration license alone does not prove feature coverage. C:Endpoint sensors do not substitute for email policies. D:Names alone are not policy targeting.
Question 674 A high-profile user regularly communicates with one external partner, and lookalike impersonation attempts appear. Which signal can help identify unusual sender relationships? A SharePoint site title similar to the partner A longer mailbox archive retention period Mailbox intelligence within supported anti-phishing protection Only an MX TTL reduction Explanation Correct Answer C:Historical communication patterns help detect impersonation. Incorrect Answers A:Site titles do not identify email sender patterns. B:Archives do not classify sender relationships. D:DNS TTL cannot detect display-name impersonation.
Question 675 A service provider sends authorized mail using a name matching a protected executive, triggering anti-phishing alerts. What should the admin do? Disable all impersonation detection globally Delete all messages that resemble the executive's name Validate sender authentication and scope a supported exception narrowly if justified Allow every sender with that display name Explanation Correct Answer C:Exceptions require evidence and minimal blast radius. Incorrect Answers A:A legitimate provider does not negate spoofing risk. B:Broad deletion would disrupt legitimate mail. D:Display names can be imitated.
Question 676 Security wants to test employee phishing resilience without delivering uncontrolled real malware. Which Defender capability is relevant? Disabling all Safe Links protection during the test Sending unreviewed live malware attachments to all staff Running a storage retention purge as a test Attack simulation training with approved payloads and campaign targets Explanation Correct Answer D:Simulation provides controlled exercises and learning evidence. Incorrect Answers A:Safety controls should be retained appropriately. B:Real malware introduces unacceptable operational risk. C:Retention deletion does not assess phishing awareness.
Question 677 An organization wants to test payroll staff with an impersonation scenario while avoiding unrelated departments. What should be configured? A tenant-wide credential reset before the exercise A blanket external guest invitation policy An Exchange email retention label for all users Attack simulation target population and suitable training campaign settings Explanation Correct Answer D:Scoping ensures the exercise reaches the intended cohort. Incorrect Answers A:Password resets do not select phishing participants. B:Guest access is unrelated to payroll simulations. C:Retention does not target simulation recipients.
Question 678 A phishing simulation report lists employees who clicked a test link. What does that metric demonstrate? No click guarantees immunity from all phishing The number of clicks is an endpoint malware infection count Interaction with the controlled simulated lure, not proof of real credential theft Every click represents a live attacker compromise Explanation Correct Answer C:Simulation clicks are awareness signals. Incorrect Answers A:One test cannot prove permanent resilience. B:Training metrics are not device detections. D:Test campaigns are controlled assessments.
Question 679 Several employees repeatedly enter data into simulated phishing pages. What follow-up is most appropriate? Targeted training, coaching and measurement of behavioral improvement Publicly shame users by publishing their passwords Delete campaign results immediately Disable all Microsoft 365 access indefinitely Explanation Correct Answer A:Education addresses identified high-risk behavior. Incorrect Answers B:Shaming and disclosure harm security. C:Evidence supports program improvement. D:Broad exclusion is not a proportional training response.
Question 680 The company plans a phishing simulation during a payroll cutoff and sensitive incident response period. What governance should be checked? Approved campaign timing, stakeholder coordination and clear exercise boundaries Run the campaign secretly against emergency responders with no approvals Remove every alert notification for the full day Replace normal threat protections with simulation payloads Explanation Correct Answer A:Uncoordinated simulation can disrupt real operations. Incorrect Answers B:Critical operations should not be jeopardized. C:Suppressing detection can obscure actual attacks. D:Test design should not disable security.
