AB-650 Exam Dumps - Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate Questions and Answers

Microsoft Purview Data Security Posture Management (DSPM) provides centralized visibility into sensitive information and its use across Microsoft 365 workloads, including interactions with Microsoft 365 Copilot.

DSPM includes reporting and investigation capabilities that help administrators understand how users interact with organizational information through AI applications.

The AI activity exploration capabilities provide information about Copilot interactions, including associated users, referenced files, sensitivity labels, and potentially sensitive information.

Because the financial files are classified with the Confidential sensitivity label, administrators can investigate activity involving labeled content and determine which users referenced sensitive organizational files during Copilot interactions.

DSPM minimizes administrative effort by providing predefined dashboards, reports, and integrated investigation workflows instead of requiring administrators to construct individual audit searches.

Option A is incorrect because Microsoft Entra audit logs primarily record identity and directory administrative activities, rather than providing detailed Copilot file-reference investigations.

Option C is incorrect because Content explorer identifies and examines classified organizational content. It is not the primary solution for correlating Copilot interactions with users and referenced files.

Option D is incorrect because Data Lifecycle Management manages retention and deletion requirements rather than providing dedicated AI interaction monitoring.

Therefore, Data Security Posture Management is the appropriate solution.

Microsoft References:

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

https://learn.microsoft.com/en-us/purview/ai-m365-copilot

You can add a Microsoft Entra cloud user to: Group1, Group2, and Group3; You can add Group5 to: Group1 and 3 only

Microsoft Entra group membership is governed by group type, membership assignment method, and source of authority.

First selection: Group1, Group2, and Group3.

The exhibit identifies Group1 and Group2 as cloud-managed Microsoft 365 groups using assigned membership. Microsoft 365 groups support user membership regardless of whether the group ' s Security enabled property is set to Yes or No.

Group3 is a cloud-managed security group with assigned membership, so administrators can also add a Microsoft Entra user directly.

Group4 uses dynamic membership, meaning users are included automatically according to configured rules rather than manually assigned.

Group5 originates from Windows Server Active Directory. Its membership is managed by the authoritative on-premises directory.

Second selection: Group1 and Group3 only.

Microsoft Entra supports nesting security groups within other compatible security groups. Consequently, Group5 can be added as a member of Group3.

Microsoft 365 groups do not support groups as members, and dynamic group membership cannot be manually modified.

The first answer above reflects Microsoft ' s documented group membership behavior rather than simply reproducing the recording ' s selected response.

Microsoft References:

https://learn.microsoft.com/en-us/graph/api/group-post-members

Microsoft Entra pass-through authentication (PTA) enables users to authenticate to Microsoft 365 using their existing on-premises Active Directory credentials while ensuring that password validation occurs against the on-premises Active Directory environment.

With pass-through authentication, Microsoft Entra ID receives the cloud sign-in request and communicates with a pass-through authentication agent installed on an on-premises, domain-joined Windows Server.

The agent validates the submitted credentials against Active Directory Domain Services and returns the authentication result to Microsoft Entra ID.

This approach allows organizations to maintain password validation against their existing domain controllers while providing users with access to Microsoft 365 cloud services.

Option B is incorrect because Microsoft Entra seamless single sign-on reduces authentication prompts for domain-joined users but does not independently determine where password validation occurs.

Option C is incorrect because certificate-based authentication uses X.509 certificates rather than authenticating users through their existing domain passwords.

Option D is incorrect because password hash synchronization enables Microsoft Entra ID to validate passwords in the cloud using synchronized password hashes. It does not satisfy the requirement that password authentication occur against the on-premises domain.

Pass-through authentication therefore meets both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta

Microsoft 365 network connectivity insights help administrators evaluate how network configuration affects connectivity to Microsoft 365 services. Accurate office-location identification is essential for associating connectivity measurements with the appropriate branch.

Option C is correct because Microsoft 365 allows administrators to define office locations manually and associate each location with its corresponding local area network subnet ranges.

This configuration is particularly important when multiple branches exist in the same city. Because the branches have distinct IPv4 LAN subnets, Microsoft 365 can distinguish their connectivity measurements by using the configured subnet information.

Microsoft Learn explicitly supports the manual location configuration method when Windows Location Services is unavailable. Administrators can navigate to the Microsoft 365 admin center, access Network connectivity, and configure office locations with their respective LAN subnet information.

Option A is insufficient because simply running network tests does not establish the required persistent branch-specific subnet mapping.

Option B does not provide the local subnet information needed to distinguish branches reliably.

Option D conflicts with the stated requirement because Windows Location Services is disabled by policy. Furthermore, automatic geographic location discovery may not distinguish multiple offices in the same city.

Therefore, manually configuring both locations and their LAN subnet ranges meets the requirement.

Microsoft References:

https://learn.microsoft.com/en-us/Microsoft-365/Enterprise/office-365-network-mac-perf-overview?view=o365-worldwide