Question 690 A trusted business portal uses a long redirect chain and Safe Links blocks the destination. What investigation should follow? Allow all shortened URLs permanently Inspect actual final destination, reputation and Safe Links verdict before targeted allow decision Globally disable URL scanning for every redirect Assume initial HTTPS guarantees a benign final site Explanation Correct Answer B:Redirect chains can hide risk or generate false positives. Incorrect Answers A:URL shorteners are not inherently safe. C:Open redirection is a common attack technique. D:TLS does not prove the destination harmless.
Question 691 A security analyst finds that one URL was blocked yesterday but allowed today. Which evidence can explain the difference? All block verdicts must be immutable forever Every verdict change proves an attacker altered DNS Verdict updates, policy changes, user scope and click telemetry over time Only a mailbox display-name change can modify URLs Explanation Correct Answer C:Reputation and enforcement can change. Incorrect Answers A:Threat intelligence evolves. B:Different causes are possible. D:Display names do not determine URL verdicts.
Question 692 Users report unusual delivery delays for emails with large attachments after a new detonation policy. What should be checked? Only the primary MX TTL Only a SharePoint retention label Only the user's MFA prompt frequency Safe Attachments processing and the selected action's delivery behavior Explanation Correct Answer D:Scanning decisions can affect message availability. Incorrect Answers A:DNS TTL does not explain per-attachment detonation. B:Labels do not determine email sandbox latency. C:MFA does not scan attachments.
Question 693 An Office document is blocked by endpoint macro policy after arriving as a clean email attachment. What does this show? A user can bypass endpoint controls by editing the subject Endpoint block means the entire email tenant is compromised Mail and endpoint controls provide distinct layers and verdicts Safe Attachments passing means all macros must run Explanation Correct Answer C:An email pass does not guarantee local macro execution. Incorrect Answers A:Email subject does not determine device macro execution. B:One document policy event is narrower. D:Runtime controls may block independently.
Question 694 A phishing message shows the CFO's name but originates from an unrelated domain. What evidence helps distinguish identity impersonation? Sender headers, authentication and anti-phishing impersonation verdicts Treat the Outlook contact-card picture as verified proof of the sender's organizational identity Only the recipient's mailbox quota Compare the displayed sender name with the global address list but ignore message-authentication results Explanation Correct Answer A:Display names are easy to spoof. Incorrect Answers B:Contact images are user-facing presentation information and cannot authenticate a spoofed sender domain or message. C:Quota is not message authenticity. D:Matching a familiar name does not distinguish a spoofed message from a legitimate authorized sender.
Question 695 An employee subscribed to legitimate marketing mail but bulk promotions are quarantined more aggressively after a policy change. What should be examined? Bulk complaint level and configured anti-spam bulk handling A new sensitivity label on unrelated documents A change to the user's MFA registration All promotional messages are necessarily credential phishing Explanation Correct Answer A:Bulk classification can be separate from malware. Incorrect Answers B:Classification is not bulk email filtering. C:MFA does not classify newsletters. D:Bulk mail can be legitimate.
Question 696 An anti-spam policy was tightened but messages from a previously allowed sender still pass. What is relevant? Only the user's Teams notification preferences Review only the standard spam verdict while leaving tenant allow entries and policy priority unexamined Only the tenant's default SharePoint site Effective allow overrides and the applicable protection policy precedence Explanation Correct Answer D:Allow settings can alter expected filtering. Incorrect Answers A:Teams settings cannot allow phishing email. B:Spam classification alone does not explain why a previously allowed sender bypasses the tightened protection action. C:Sites do not set sender overrides.
Question 697 A partner's verified invoice attachment is repeatedly classified malicious. What should the administrator do to seek a corrected verdict? Change all staff passwords as a workaround Submit the representative file or message for Microsoft analysis and track results Delete all evidence of the blocked attachment Disable every malware policy until the verdict changes Explanation Correct Answer B:Submission supports product-level false-positive review. Incorrect Answers A:Passwords cannot change a file verdict. C:Evidence is needed for investigation. D:Broad disablement creates unacceptable exposure.
Question 698 Two anti-phishing rules with overlapping recipient groups have different impersonation actions. What should be verified? Changing the mailbox display name always wins precedence The first message received each morning chooses the rule Policy application order, priority and target membership for affected recipients Every user receives both actions simultaneously by default Explanation Correct Answer C:Effective policy depends on precedence and scope. Incorrect Answers A:Names are not rule priority. B:Message order does not set policy priority. D:Policy evaluation uses defined application behavior.
Question 699 A phishing email has valid DKIM and aligned DMARC but Safe Links blocks its embedded URL. What conclusion is correct? Sender authentication passed while content or destination was still unsafe Valid DKIM guarantees every embedded link is benign Safe Links always indicates the DNS domain was unverified DMARC pass proves user intent was authorized Explanation Correct Answer A:Authentication and threat detection evaluate different properties. Incorrect Answers B:Message integrity is not URL safety. C:URL verdicts are not tenant ownership checks. D:A compromised legitimate sender can still deceive.
Question 700 An admin temporarily allowed an urgent business sender but the exception expired today. What must be done before renewal? Review current risk evidence, scope and necessity rather than automatically extending the bypass Disable threat telemetry so the alert disappears Change every recipient's SMTP alias Renew all exceptions forever to avoid false positives Explanation Correct Answer A:Exceptions should have controlled lifetimes. Incorrect Answers B:Missing alerts do not make traffic safe. C:Aliases do not resolve allow override risk. D:Permanent bypass increases attack exposure.
