Question 700 An admin temporarily allowed an urgent business sender but the exception expired today. What must be done before renewal? Review current risk evidence, scope and necessity rather than automatically extending the bypass Disable threat telemetry so the alert disappears Change every recipient's SMTP alias Renew all exceptions forever to avoid false positives Explanation Correct Answer A:Exceptions should have controlled lifetimes. Incorrect Answers B:Missing alerts do not make traffic safe. C:Aliases do not resolve allow override risk. D:Permanent bypass increases attack exposure.
Question 701 Teams users receive suspicious shared files, but the organization assumes an email security license covers every Teams file by default. What should be checked? Every email license automatically enables all collaboration threat features A Defender endpoint license guarantees every Teams message is scanned Product entitlement and supported Defender for Office 365 collaboration protection capabilities The mailbox storage quota decides Teams file scanning Explanation Correct Answer C:Coverage depends on service plans and configured protections. Incorrect Answers A:Feature entitlements differ. B:Endpoint and collaboration services are distinct. D:Storage quotas do not grant threat features.
Question 702 A link to a malicious document was distributed in Teams. What evidence should investigators correlate? Only the local printer's recent jobs Only Exchange transport rules Only the sender's email signature Defender collaboration detections, file information and user access activity Explanation Correct Answer D:Cloud file sharing can propagate malicious content. Incorrect Answers A:Print activity is not the shared file path. B:Teams sharing does not necessarily use SMTP. C:Signatures do not establish file maliciousness.
Question 703 An attack simulation campaign accidentally targets emergency operators during a live security incident. What operational response is appropriate? Pause the campaign and coordinate with incident leadership to prevent confusion Disable real phishing protection during simulation Delete all incident evidence so test metrics look clean Keep sending until every operator clicks Explanation Correct Answer A:Training should not interfere with active response. Incorrect Answers B:Testing should not remove production defense. C:Evidence preservation remains important. D:Continuing could disrupt real response.
Question 704 Employees who clicked simulations need different follow-up modules based on observed behavior. What should be configured? Appropriate training assignment logic and campaign outcome review An Exchange anti-malware policy bypass A new default verified domain A tenant-wide mailbox purge for all users Explanation Correct Answer A:Relevant education improves the risk-focused program. Incorrect Answers B:Bypasses weaken protection instead of training. C:Domain naming does not select lessons. D:Message deletion does not teach security behavior.
Question 705 Training results show high link-click rates but also high reporting rates. What should analysts present? Only a Secure Score value Only total campaign messages delivered One combined number with no definitions Separate metrics for clicks, credential submissions and prompt reports Explanation Correct Answer D:Each behavior provides different awareness evidence. Incorrect Answers A:Posture score does not substitute for simulation metrics. B:Delivery cannot show behavior. C:Aggregation hides important differences.
Question 706 A legitimate but compromised account suddenly sends thousands of messages and is auto-restricted. What response sequence matters? Unblock first because the employee recognizes the account Secure the account, inspect sending logs, remediate abuse, then unblock when justified Turn off outbound protection permanently Change the employee's Teams meeting name Explanation Correct Answer B:Unblocking without credential remediation can restart spam. Incorrect Answers A:Ownership does not show it is safe. C:Global disablement could enable more abuse. D:Meetings do not stop SMTP sending.
Question 707 The restricted entities page lists a connector rather than a user after suspicious relay activity. What should the admin investigate? Disable every mailbox archive Assume a named user has been locked out Connector trust configuration, originating traffic and authorized relay behavior Delete custom domains to reset connector restrictions Explanation Correct Answer C:Connector abuse differs from individual mailbox compromise. Incorrect Answers A:Archives do not fix relay abuse. B:Connector restrictions do not always imply user lockout. D:Domain removal is destructive and unnecessary.
Question 708 An organization wants to stop compromised employees sending spam, not just block spam reaching them. Which control is relevant? Mailbox retention tags only Inbound anti-spam policy only Outbound spam policy and sender restriction actions Safe Links click monitoring only Explanation Correct Answer C:Outbound enforcement targets tenant-originating abuse. Incorrect Answers A:Retention does not constrain outbound sending. B:Inbound policy protects recipient flow. D:URL protection cannot set sender restrictions.
Question 709 A user submission contains personal data, and security wants to route copies to an external analysis mailbox. What must be considered? Sender spoofing policy grants permission to export personal data Every reported message may be publicly posted Data handling approvals, submission destinations and access restrictions A user cannot report messages with personal information Explanation Correct Answer C:Security submissions can expose sensitive message contents. Incorrect Answers A:Mail authentication is not privacy authorization. B:Reporting requires privacy controls. D:Sensitive messages can still require controlled investigation.
Question 710 A legitimate invoice was incorrectly reported as phishing by users. What training opportunity exists? Explain the verified evidence and appropriate reporting behavior without discouraging future reports Disable the report button for the organization Punish every mistaken reporter immediately Treat every invoice as inherently safe Explanation Correct Answer A:Feedback improves detection and confidence. Incorrect Answers B:Removing reporting eliminates a detection channel. C:Fear can reduce useful reports. D:Business documents can still be malicious.
