Microsoft AB-650 Practice Test Questions Answers

Setting to modify

Correct Configuration

Logical operator between PII Identifiers and Medical Terms

Change and to or

Medical Terms → Match accuracy → min

Increase from 50 to 85 (High confidence)

Microsoft Purview Data Loss Prevention uses sensitive information types (SITs), Boolean operators, and confidence levels to determine whether content matches a DLP rule.

First selection: Change AND to OR.

The exhibit currently combines PII Identifiers and Medical Terms using an AND operator. This requires content to contain both a U.S. Social Security Number and an ICD-9-CM medical term before the rule matches.

Consequently, medical content without a Social Security Number will not trigger the policy.

Changing the operator to OR allows the rule to detect ICD-9-CM information independently, increasing the likelihood of identifying medical content.

Second selection: Increase minimum match accuracy to 85.

Microsoft defines high-confidence ICD-9-CM matches using corroborating dictionary evidence within a 300-character proximity.

Increasing the minimum match accuracy from 50 to 85 ensures that the medical terms condition matches only the high-confidence pattern.

This reduces false positives caused by ambiguous medical terminology, although some genuine matches with insufficient supporting evidence might be missed.

Important consideration: Changing AND to OR also permits Social Security Number-only matches. If the production requirement is to detect exclusively medical content, removing the unrelated PII condition would be more precise.

The two requested configuration changes provide broader medical-content detection while increasing classification confidence.

Microsoft References:

Microsoft Learn — DLP rules, conditions, and logical operators .

Microsoft Learn — ICD-9-CM sensitive information type definition .

Microsoft Learn — Sensitive information type confidence levels

Statement

Correct Answer

User2 can reference files in the Vendor Contracts folder by using Copilot Chat.

Yes

User1 has the access required for Microsoft 365 Copilot to ground responses in the Forecast files.

No

User1 has the access required for Microsoft 365 Copilot to ground responses in the Vendor Contracts files.

Yes

Microsoft 365 Copilot and Copilot Chat respect existing SharePoint permissions and Microsoft Purview sensitivity label encryption restrictions when accessing organizational content.

Statement 1: Yes.

User2 belongs to Group1 and has access to the Vendor Contracts folder through the Everyone except external users permission.

Although User2 does not have a paid Microsoft 365 Copilot license, Copilot Chat supports explicitly referencing accessible files, subject to supported experiences and file types. User2 can therefore reference supported Vendor Contracts files in a prompt.

However, Copilot Chat without a paid license does not automatically discover and ground responses across all organizational files through Microsoft Graph.

Statement 2: No.

User1 has a Microsoft 365 Copilot license and SharePoint access to Forecast. However, the Forecast documents are encrypted by a sensitivity label granting usage rights only to Group1.

Because User1 is outside Group1, the user lacks the necessary encryption permissions. Microsoft 365 Copilot cannot use those files for grounding.

Statement 3: Yes.

Vendor Contracts contains unlabeled files and grants access to Everyone except external users.

User1 is an internal user with a Microsoft 365 Copilot license and appropriate SharePoint access. No additional sensitivity-label encryption restricts the files.

Therefore, Copilot can use accessible Vendor Contracts files to ground responses.

Microsoft References:

Microsoft Support — Refer to specific files in Microsoft Copilot .

Microsoft Learn — Copilot data protection, permissions, and encryption .

Microsoft Learn — How Copilot Chat grounding works .

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access to privileged roles through eligible assignments and configurable role activation requirements.

Statement 1: Yes.

User1 has an eligible Global Administrator assignment. The PIM configuration specifies Require justification on activation: Yes. Therefore, User1 must submit a business justification when activating the role. The user must also satisfy the configured multifactor authentication requirement.

Statement 2: No.

User2 has an assigned (active) Global Administrator role rather than an eligible assignment. Active assignments provide permissions without requiring role activation. Consequently, the configured MFA-on-activation requirement does not apply to User2 in the manner described. Separate Conditional Access policies may still require MFA during sign-in.

Statement 3: No.

User3 has an eligible Global Administrator assignment. The activation maximum duration is eight hours, meaning each activation can remain active for no longer than eight hours.

However, this does not terminate the underlying eligibility. The eligible assignment is configured to expire after 15 days.

After an eight-hour activation expires, User3 can activate the role again, provided the eligible assignment remains valid and the activation requirements are satisfied.

The distinction between activation duration and eligibility duration is fundamental to Microsoft Entra PIM.

Microsoft References:

Microsoft Learn — Configure PIM role settings .

Microsoft Learn — Activate Microsoft Entra roles in PIM .

Microsoft Learn — Assign eligible and active roles .

Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti-spam policies.

The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.

Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only. It cannot override the Standard preset security policy.

Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group ' s members. These users can then be evaluated by Policy1, provided its recipient conditions match.

Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.

Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.

Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.

Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.

Therefore, Group1 must be excluded from the Standard preset security policy.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies

https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined

Microsoft 365 Copilot requires supported Microsoft 365 applications to provide integrated AI functionality in desktop Word, Excel, PowerPoint, and other Office applications.

The sales department already has Microsoft 365 E3 and Microsoft 365 Copilot licenses. Consequently, the primary issue is not the licensing configuration but the installed Office application version.

Option B is correct because deploying Microsoft 365 Apps provides the continuously updated desktop applications that support Copilot integration. Administrators must ensure that users are signed in with appropriately licensed Microsoft Entra accounts and that the applications receive supported feature updates.

Option A is incorrect because Office LTSC Professional Plus 2024 is a perpetual-license product that does not receive the continuously delivered Copilot capabilities provided through Microsoft 365 Apps.

Option C is incorrect because Microsoft 365 E5 is not required when users already have qualifying Microsoft 365 E3 licenses and Copilot licenses.

Option D is incorrect because Microsoft Graph connectors integrate external information sources with Microsoft 365 search and Copilot grounding. They do not enable Copilot inside unsupported desktop applications.

Option E is incorrect because participation in the Frontier program is not required to activate standard licensed Copilot functionality.

Therefore, Microsoft 365 Apps must be deployed to the devices.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-copilot-requirements

https://support.microsoft.com/en-us/office/lifecycle/office-2024-and-office-ltsc-2024-faq