Pass the Microsoft Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate AB-650 Questions and answers with CertsForce

Microsoft Purview retention labels control how long content must be preserved and what action occurs after the configured retention period expires.

Option B is the intended examination answer, based on the default retention-period start date.

The exhibit shows Retention1 configured with a six-month retention period and the Retain and Delete action.

Microsoft documents that retention periods start from the content creation date by default, unless the label is explicitly configured to use another trigger.

File1 was created on January 1, 2025. Therefore, its six-month retention period ends on July 1, 2025.

The modification on January 10 does not reset the retention period under the default configuration. Similarly, deleting File1 on February 1 does not override the retention requirement.

Option A ignores the retention configuration. Option C would apply if retention began on the last modification date. Option D incorrectly calculates six months from the user-initiated deletion.

Important technical distinction: The question says permanently and unrecoverable. Microsoft ' s current SharePoint and OneDrive documentation states that retained content is subsequently moved through the Recycle Bin, where an additional 93-day recovery period can apply. Consequently, July 2025 represents the intended retention expiration and deletion processing date, not necessarily the final irreversible deletion date. Strictly interpreted, none of the options guarantees that outcome.

Microsoft References:

Microsoft Learn — Retention policies and labels .

Microsoft Learn — Retention behavior for SharePoint and OneDrive .

Microsoft Entra Password Protection helps prevent users from choosing weak or commonly used passwords by checking password changes against Microsoft ' s global banned-password list and an administrator-defined custom list.

Option A is correct because the Microsoft Entra Password Protection domain controller (DC) agent extends password validation to on-premises Active Directory Domain Services.

By default, configuring a custom banned-password list in Microsoft Entra ID protects cloud-based password changes but does not automatically extend the enforcement mechanism to domain controllers.

To implement on-premises protection, administrators must deploy the Password Protection DC agent to domain controllers and configure the supporting Microsoft Entra Password Protection proxy service. The proxy retrieves password protection policies from Microsoft Entra ID and makes them available to the DC agents.

Administrators must also enable password protection for Windows Server Active Directory and configure Enforced mode rather than Audit mode.

Option B is incorrect because the Microsoft Entra provisioning agent supports identity provisioning and synchronization scenarios.

Option C is incorrect because password writeback supports writing cloud-initiated password changes to on-premises Active Directory.

Option D is incorrect because password hash synchronization enables cloud authentication using synchronized password hashes; it does not enforce custom banned passwords during on-premises password changes.

Therefore, deploying the DC agent is the correct choice, with the additional deployment components and enforcement configuration required for operation.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy

https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-operations

Microsoft Purview Information Protection provides data classification, sensitivity labeling, and protection capabilities for organizational information. However, Information Protection alone does not provide the dedicated investigation workflow required to identify individual AI agent interactions containing confidential information in prompts or responses.

The more appropriate solution is Microsoft Purview Data Security Posture Management (DSPM), using its AI observability and Activity explorer capabilities.

Microsoft DSPM supports visibility into AI agent activities, including Microsoft Agent 365. It can identify interactions involving sensitive information through integrated data classification, audit telemetry, sensitive information types, and trainable classifiers.

Administrators can navigate to the Microsoft Purview portal, open DSPM, and use Discover → Activity explorer → AI activities to investigate AI interactions. The AI observability page also provides agent-specific visibility into potentially sensitive interactions and associated risks.

Microsoft Purview Information Protection contributes classification and labeling capabilities to this process, but simply using Information Protection does not independently deliver the required agent-interaction investigation.

Therefore, the proposed solution does not fully satisfy the requirement, making Option B (No) the appropriate answer.

Microsoft References:

https://learn.microsoft.com/en-us/purview/ai-agent-365

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

Microsoft 365 network connectivity insights help administrators evaluate how network configuration affects connectivity to Microsoft 365 services. Accurate office-location identification is essential for associating connectivity measurements with the appropriate branch.

Option C is correct because Microsoft 365 allows administrators to define office locations manually and associate each location with its corresponding local area network subnet ranges.

This configuration is particularly important when multiple branches exist in the same city. Because the branches have distinct IPv4 LAN subnets, Microsoft 365 can distinguish their connectivity measurements by using the configured subnet information.

Microsoft Learn explicitly supports the manual location configuration method when Windows Location Services is unavailable. Administrators can navigate to the Microsoft 365 admin center, access Network connectivity, and configure office locations with their respective LAN subnet information.

Option A is insufficient because simply running network tests does not establish the required persistent branch-specific subnet mapping.

Option B does not provide the local subnet information needed to distinguish branches reliably.

Option D conflicts with the stated requirement because Windows Location Services is disabled by policy. Furthermore, automatic geographic location discovery may not distinguish multiple offices in the same city.

Therefore, manually configuring both locations and their LAN subnet ranges meets the requirement.

Microsoft References:

https://learn.microsoft.com/en-us/Microsoft-365/Enterprise/office-365-network-mac-perf-overview?view=o365-worldwide

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .