Question 710 A legitimate invoice was incorrectly reported as phishing by users. What training opportunity exists? Explain the verified evidence and appropriate reporting behavior without discouraging future reports Disable the report button for the organization Punish every mistaken reporter immediately Treat every invoice as inherently safe Explanation Correct Answer A:Feedback improves detection and confidence. Incorrect Answers B:Removing reporting eliminates a detection channel. C:Fear can reduce useful reports. D:Business documents can still be malicious.
Question 711 An impersonated domain detection appears but the message was delivered to Junk rather than quarantined. What settings matter? Only the user's password reset method Effective anti-phishing detection action and applicable policy scope The domain's typography in the email body The recipients' Teams meeting policy Explanation Correct Answer B:Actions vary by configured protection policy. Incorrect Answers A:Recovery settings are not mail disposition actions. C:Font styling does not set Defender action. D:Meeting settings cannot move messages to Junk.
Question 712 Users cannot see expected digest notifications for messages held under a new protection policy. What should be checked? Only the sender's DKIM public key Only Microsoft 365 license assignment date Quarantine policy notification settings and user eligibility for that disposition Only a mailbox auto-reply subject line Explanation Correct Answer C:Not every quarantine category sends the same notices. Incorrect Answers A:DKIM cannot configure quarantine digests. B:License timing alone does not prove notification eligibility. D:Auto-replies do not govern quarantine notifications.
Question 713 A shared mailbox receives suspicious external mail, and the admin assumes user-specific policies always protect it identically. What should be verified? Only the Exchange archive retention tag Only the shared mailbox display name Recipient scoping and effective anti-spam policy coverage for that mailbox Every shared mailbox automatically bypasses filtering Explanation Correct Answer C:Shared recipients can have different group targeting. Incorrect Answers A:Retention does not define anti-spam policy assignment. B:Names do not show policy coverage. D:Shared type is not a universal exception.
Question 714 A mail flow rule skips spam filtering for a partner domain, but that partner is compromised. What should be changed? Remove or narrowly constrain the bypass based on verified sender and threat evidence Keep bypass because the partner previously passed SPF Move the partner to a new address list Disable all inbound filtering tenant-wide Explanation Correct Answer A:Transport exceptions can override defenses. Incorrect Answers B:SPF cannot guarantee sender account integrity. C:Address lists do not revoke transport bypasses. D:Broad bypass worsens threat exposure.
Question 715 New threat intelligence flags earlier delivered messages that were not initially quarantined. What response mechanism matters? Only increasing mailbox quotas Only adjusting the sender's MX priority Only changing email signature standards Postdelivery remediation capabilities with verified target message scope Explanation Correct Answer D:Late verdicts can require action on existing messages. Incorrect Answers A:Storage does not remove malicious items. B:Mail route changes do not remove delivered mail. C:Signature formatting does not remediate phishing.
Question 716 A message trace confirms delivery but user claims they clicked and entered a password. What further evidence is needed? Only the domain's SPF record Message trace alone proves no credential compromise Only the recipient's archive size URL click and sign-in telemetry to assess credential harvesting impact Explanation Correct Answer D:Delivery records do not prove user interaction. Incorrect Answers A:SPF cannot show user interaction. B:Trace does not observe web credential entry. C:Storage cannot prove a click.
Question 717 Attackers use invoice.company-example.com while the brand protects only company-example.com from impersonation. What should admins assess? Change the user's mailbox archive quota Disable mail authentication on the parent domain Domain and subdomain protection scope plus actual authentication and impersonation configuration Every subdomain automatically inherits every application rule without validation Explanation Correct Answer C:Coverage may differ by protected domain configuration. Incorrect Answers A:Storage cannot detect domain impersonation. B:Disabling protection increases risk. D:Inherited behavior must be confirmed.
Question 718 A sender authenticated through a legitimate third-party relay triggers a spoof verdict during migration. How should an admin respond? Delete the existing SPF record and keep no replacement Ignore all users' reports of spoofing Globally allow all mail that fails DMARC Validate authorization and authentication alignment before creating scoped spoof overrides Explanation Correct Answer D:Legitimate relays can need careful configuration. Incorrect Answers A:Missing sender policy can worsen issues. B:Reports may show active impersonation. C:Broad failure bypass defeats anti-spoofing.
Question 719 Security wants to inspect embedded links in password-protected documents received by email. What limitation should be recognized? Safe Attachments is only a sender reputation tool A mailbox quota increase improves encrypted inspection Safe Links can always decrypt every attachment without a password Different protections inspect URLs and attachments, with encrypted content sometimes restricting analysis Explanation Correct Answer D:No single scanner guarantees analysis of inaccessible encrypted content. Incorrect Answers A:Detonation analyzes content behavior. B:Storage does not decrypt attachments. C:Encryption may prevent inspection.
Question 720 A ZIP attachment is encrypted and cannot be fully inspected by the configured cloud scanner. What policy direction is suitable? A verified sender domain guarantees decrypted content integrity Treat every encrypted ZIP as proven safe Use appropriate handling of unscannable or encrypted attachments and educate recipients Always disable attachment protections for archives Explanation Correct Answer C:Unreadable payloads need controlled risk treatment. Incorrect Answers A:Authentication does not make payload safe. B:Encryption hides content from scanners. D:Broad bypasses increase threat exposure.
