Authentic Microsoft Certification Exam AB-650 Questions Answers

Option

Correct Action

B

Change Mode from Audit to Enforced

D

Install the Microsoft Entra Password Protection DC Agent on all writable domain controllers

F

Install the Microsoft Entra Password Protection Proxy

Microsoft Entra Password Protection extends global and custom banned password policies to on-premises Active Directory Domain Services (AD DS).

Option B is correct. The exhibit shows that password protection for Windows Server Active Directory is enabled but operates in Audit mode. Audit mode records weak password attempts without rejecting them. Changing the setting to Enforced ensures passwords failing validation are rejected.

Option D is correct. Microsoft Entra Password Protection requires the DC Agent on every writable domain controller to provide consistent enforcement. The agent evaluates password changes and resets against the downloaded banned password policies.

Option F is correct. The Password Protection Proxy communicates with Microsoft Entra ID and enables domain controllers to retrieve updated global and custom banned password policies. This component is mandatory for on-premises deployment.

Option A is incorrect because the Default Domain Policy does not configure Microsoft Entra ' s banned password lists.

Option C is incorrect because the Application Proxy connector provides application connectivity, not password protection.

Option E is incorrect because the exhibit already shows Enforce custom list set to Yes.

Important: Microsoft recommends installing the Password Protection Proxy on a domain-joined member server rather than a domain controller in production. Installing it on a domain controller is supported for testing but creates additional security considerations.

Also, password protection evaluates new password changes and resets; it does not retroactively invalidate existing passwords.

Microsoft References:

Microsoft Learn — Enable on-premises Microsoft Entra Password Protection .

Microsoft Learn — Deploy Microsoft Entra Password Protection DC Agents and Proxy .

Microsoft Learn — Troubleshoot banned passwords being accepted .

cCompleted PowerShell Script (Corrected for Execution):

Connect-MgGraph -Scopes " GroupMember.ReadWrite.All "

$members = Import-Csv -Path " C:\Temp\members.csv "

foreach ($member in $members) {

New-MgGroupMemberByRef -GroupId $groupId `

-OdataId " https://graph.microsoft.com/v1.0/directoryObjects/$($member.memberObjectId) "

}

Disconnect-MgGraph

Microsoft Graph PowerShell provides cmdlets for managing Microsoft Entra security group memberships, including bulk membership updates from CSV files.

First selection: Connect-MgGraph. This command establishes an authenticated Microsoft Graph session. The GroupMember.ReadWrite.All delegated permission authorizes modification of supported group memberships, subject to the signed-in user ' s administrative privileges.

Second selection: New-MgGroupMemberByRef. This cmdlet adds an existing Microsoft Entra directory object to a security group by creating a membership reference.

The -GroupId parameter identifies Group1, while -OdataId supplies the Microsoft Graph URL of the user object being added.

Import-Csv reads the user identifiers from C:\Temp\members.csv. The foreach loop processes each CSV record and adds the corresponding user to Group1.

Get-MgGroupMember and Get-MgGroupMemberByRef retrieve existing memberships rather than creating them. Update-MgGroup modifies group properties but is not the appropriate membership-reference operation.

Important correction: The original exhibit uses $member.ObjectId, but the CSV column is named memberObjectId. The script must reference $member.memberObjectId; otherwise, the object identifier will not be retrieved correctly.

Therefore, the correct dropdown answers are Connect-MgGraph and New-MgGroupMemberByRef.

Microsoft References:

Microsoft Learn — New-MgGroupMemberByRef .

Microsoft Graph — Add members to groups .

Microsoft Graph PowerShell authentication commands .

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time privileged access through eligible role assignments. This capability allows administrators to grant temporary access to sensitive Microsoft Entra administrator roles without maintaining permanent privileged permissions.

When engineers are assigned as eligible for an administrator role, they do not immediately receive the role ' s active privileges. Instead, they must activate the role before performing privileged administrative tasks.

The activation process can require multifactor authentication, justification, approval, or other security controls, depending on the configured PIM role settings.

Administrators can define a maximum activation duration. Once the activation period expires, the active role assignment expires automatically, and the user must activate the role again before performing privileged operations.

Option A is incorrect because access packages manage access to resources but do not inherently implement just-in-time activation for Microsoft Entra administrator roles.

Option B is incorrect because administrative units restrict the scope of delegated administration without providing automatic role activation and expiration.

Option D is incorrect because active membership in a role-assignable group grants privileges without requiring activation.

Therefore, PIM eligible role assignments satisfy both requirements: explicit activation and automatic expiration.

Microsoft References:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure