Question 720 A ZIP attachment is encrypted and cannot be fully inspected by the configured cloud scanner. What policy direction is suitable? A verified sender domain guarantees decrypted content integrity Treat every encrypted ZIP as proven safe Use appropriate handling of unscannable or encrypted attachments and educate recipients Always disable attachment protections for archives Explanation Correct Answer C:Unreadable payloads need controlled risk treatment. Incorrect Answers A:Authentication does not make payload safe. B:Encryption hides content from scanners. D:Broad bypasses increase threat exposure.
Question 721 A suspicious executable is stored in a SharePoint library, and the team expects Defender for Office 365 scanning outside email. What should be checked? Only an Exchange mailbox spam policy Only the tenant's inbound MX route Supported Safe Attachments protection for SharePoint, OneDrive and Teams and its configuration Only the Office 365 usage report Explanation Correct Answer C:Collaboration coverage is distinct from Exchange mail flow. Incorrect Answers A:Mailbox filtering is not file repository scanning. B:SharePoint uploads do not use SMTP MX. D:Adoption reports are not malware scanning.
Question 722 A malicious URL is blocked by a threat verdict but also appears in a tenant allow list. What should analysts review? Only the tenant service health notice Rely on the URL's threat reputation without investigating an explicit tenant allow override Only the recipient's file retention label Effective allow/block override precedence and reason for the exception Explanation Correct Answer D:Contradictory indicators can alter enforcement. Incorrect Answers A:Service advisories do not resolve allow entries. B:A malicious reputation verdict does not determine the final action when tenant allow/block exceptions may have different precedence. C:Retention does not set URL override precedence.
Question 723 A major phishing campaign begins immediately after a high-confidence phish action was relaxed. What evidence helps identify cause? Check only the current campaign verdict without comparing historical policy settings Only the recipient's Teams call history Defender policy audit history, previous settings and scope of changed action Only the company's public domain registration date Explanation Correct Answer C:Configuration drift can explain new delivery outcomes. Incorrect Answers A:Current detections show impact, but cannot establish which protection action was relaxed or who changed it. B:Calls do not show mail threat configuration. D:Registration age does not track policy edits.
Question 724 Executives require stricter impersonation controls than the rest of the company. What should the administrator do? Create appropriately targeted protection for priority accounts with evaluated policy precedence Give executives unrestricted sender allow lists Reduce protection for all other recipients to zero Require executives to use shared mailboxes only Explanation Correct Answer A:Targeting allows additional protection without global false positives. Incorrect Answers B:Broad trusted senders can be compromised. C:Lowering baseline protection is unnecessary. D:Mailbox type does not replace anti-phishing.
Question 725 Two anti-malware policies apply different actions to overlapping user groups. What should be tested? Every matching policy's action must be appended together Effective priority and recipient matching for the message in question Only user's Exchange archive quota matters Sender display names define recipient rule order Explanation Correct Answer B:Policy order determines relevant enforcement. Incorrect Answers A:Protection evaluation is not arbitrary action concatenation. C:Quota does not choose anti-malware rule. D:Names are not policy priority.
Question 726 A user entered credentials on a phishing site and outbound mail started flowing to new addresses. Which additional artifact matters? Only the user mailbox quota Only the organization's SPF record value New inbox forwarding rules or delegates and suspicious sign-in sessions Only Outlook background image Explanation Correct Answer C:Attackers may persist through mailbox settings. Incorrect Answers A:Quota does not authorize forwarding. B:SPF does not show unauthorized mailbox rules. D:Appearance cannot explain outbound abuse.
Question 727 Defender XDR correlates URL clicks and credential phishing across many mailboxes. What should responders do first? Reset every recipient's account with no analysis Disable every enterprise application permanently Ignore nonclickers' delivered messages entirely Prioritize exposed users by actual interactions and associated identity signals Explanation Correct Answer D:Not all recipients have identical compromise evidence. Incorrect Answers A:Scope-sensitive response should consider evidence. B:Broad disruption is not targeted campaign response. C:Unclicked malicious messages can still need cleanup.
Question 728 A delivered message was later confirmed malicious and originally had a clean verdict. Which feedback is relevant? Turn off mailbox auditing to avoid duplicate events Mark all future mail from that sender safe Delete the sender's domain from the tenant Submit or investigate the message as a false negative and review detection coverage Explanation Correct Answer D:Missed threats warrant product and policy feedback. Incorrect Answers A:Auditing supports investigation. B:One missed detection does not validate the sender. C:Tenant custom domain ownership is unrelated.
Question 729 A malicious message is reported, but Threat Explorer results have not appeared yet. Which issue should the analyst consider? A mailbox display name controls telemetry indexing No record means the message never existed An SPF policy automatically deletes Explorer data Telemetry processing latency, correct filters and product retention boundaries Explanation Correct Answer D:Investigation surfaces may lag recent mail events. Incorrect Answers A:Naming is not a data ingestion schedule. B:Ingestion or filtering can hide early evidence. C:Sender DNS cannot clear security history.
Question 730 A simulated phishing campaign targets employees handling regulated personal data. What should the campaign designer avoid? Providing postcampaign awareness materials Using controlled mock sign-in pages with no real credential collection Collecting real employee passwords or sensitive information as training evidence Configuring defined participants and time windows Explanation Correct Answer C:Simulation should measure behavior without exposing secrets. Incorrect Answers A:Education supports the training program. B:Safe simulations are appropriate. D:Scope control is a proper safeguard.
