Question 680 The company plans a phishing simulation during a payroll cutoff and sensitive incident response period. What governance should be checked? Approved campaign timing, stakeholder coordination and clear exercise boundaries Run the campaign secretly against emergency responders with no approvals Remove every alert notification for the full day Replace normal threat protections with simulation payloads Explanation Correct Answer A:Uncoordinated simulation can disrupt real operations. Incorrect Answers B:Critical operations should not be jeopardized. C:Suppressing detection can obscure actual attacks. D:Test design should not disable security.
Question 681 Many employees report the same simulated fake sign-in page. What should the team measure? Only the organization's MX uptime Only the count of messages sent Reporting rate and reporting speed as well as click or submission metrics Only the number of protected sensitivity labels Explanation Correct Answer C:User reports can indicate successful awareness. Incorrect Answers A:Mail availability does not measure reporting behavior. B:Delivery volume misses behavior. D:Classification cannot show simulation response.
Question 682 Security wants to remove a known malicious message from hundreds of mailboxes after a new verdict. What should it do? Delete every message sharing the sender's common first name Use an authorized Defender investigation and remediation action with scope verification Globally disable mail delivery for a day Change all user passwords instead of addressing messages Explanation Correct Answer B:Coordinated remediation can address affected messages. Incorrect Answers A:Display names are not safe unique indicators. C:Service disruption is not targeted cleanup. D:Password resets do not remove the delivered lure.
Question 683 A malicious message has identical subject to a legitimate monthly newsletter. What indicator improves targeted remediation? Remove every email from the same calendar month Treat every attachment of the same size as malicious Delete all mail with that subject alone Combine message identifiers, sender authentication and other stable threat indicators Explanation Correct Answer D:Multifactor matching reduces accidental deletion. Incorrect Answers A:Time alone is too broad. B:File size is not a reliable indicator. C:Popular subjects can match legitimate mail.
Question 684 A user submits a false-positive complaint, and an admin needs Microsoft's analysis of the disputed message. Which workflow matters? Only reduce the tenant's spam threshold arbitrarily Only reply to the sender from a personal address Only delete the quarantined item immediately Appropriate admin submission for message review and verdict feedback Explanation Correct Answer D:Submission analysis can inform false-positive handling. Incorrect Answers A:Threshold changes do not investigate one message. B:Replies do not request product verdict review. C:Deletion prevents useful inspection.
Question 685 A sender is blocked due to reputation but the partner verifies an account takeover. What must change in the response? Only change the sender's display name Treat the account as potentially compromised and validate restoration before allowing traffic Disable all outbound spam enforcement tenant-wide Always unblock any verified partner domain immediately Explanation Correct Answer B:A compromised partner may send authenticated malicious mail. Incorrect Answers A:Branding cannot remediate credential theft. C:Global changes do not fix the partner. D:Ownership does not ensure the account is currently safe.
Question 686 A connector used for trusted on-premises mail begins relaying suspicious traffic. What configuration should be audited? Disable the trusted connector globally and delete its configuration before investigating source authentication, permitted IPs and relay logs Permit the connector by sender email domain alone and ignore whether its allowed source IPs or certificates have changed Increase inbound mail delivery thresholds on the connector to reduce delays while leaving suspicious relay sources unrestricted Connector source constraints, authentication and abuse evidence Explanation Correct Answer D:Overly broad trust can enable unauthorized relay. Incorrect Answers A:Emergency containment may be warranted, but deleting the connector before collecting evidence loses the configuration and does not diagnose abuse. B:A visible From domain is not sufficient evidence of a trusted relay source; connector constraints and authentication must be checked. C:Rate limits may affect throughput but do not validate which source systems are permitted or why unauthorized relay activity began.
Question 687 A recently created executive account has no communication history, yet anti-phishing policy expects mailbox intelligence. What should admins consider? Mailbox intelligence instantly learns years of unseen contacts Historical signals may be limited for new mailboxes; rely on additional protected-user controls Disabling all impersonation controls fixes sparse history A DMARC policy alone detects every impersonation attempt Explanation Correct Answer B:A cold start can reduce behavior-based context. Incorrect Answers A:It cannot invent previous correspondence. C:Removal weakens other detections. D:DMARC cannot identify all display-name spoofing.
Question 688 Two departments receive the same link but only one sees the Safe Links protection experience. What should be compared? Effective Safe Links policy assignment, priority and applicable user scopes Only the number of Teams chats in each department Only the recipients' archive mailbox quotas Only the sender's custom domain registrar Explanation Correct Answer A:Different policies can apply to different recipients. Incorrect Answers B:Chat count does not determine policy. C:Quota does not choose URL protection. D:Registrar choice does not select a recipient policy.
Question 689 A malicious link embedded in a Word document is clicked after the file is opened. Which protection scope should admins verify? Only the sender's mailbox type Only the mail transport rule's subject condition Verify Safe Attachments malware scanning alone and assume it covers every URL click inside Office files Supported Safe Links protection for Office application URL clicks and the deployed policy Explanation Correct Answer D:Email-body protection may not cover every click path. Incorrect Answers A:Mailbox type does not prove in-document URL inspection. B:Subject rules do not evaluate document links. C:Attachment scanning evaluates file threat content but is not a substitute for supported Safe Links protection of subsequent document URL clicks.
Question 690 A trusted business portal uses a long redirect chain and Safe Links blocks the destination. What investigation should follow? Allow all shortened URLs permanently Inspect actual final destination, reputation and Safe Links verdict before targeted allow decision Globally disable URL scanning for every redirect Assume initial HTTPS guarantees a benign final site Explanation Correct Answer B:Redirect chains can hide risk or generate false positives. Incorrect Answers A:URL shorteners are not inherently safe. C:Open redirection is a common attack technique. D:TLS does not prove the destination harmless.
