Microsoft 365 and AI Services Administrator Associate (AB-650)

A is correct.

Explanation: Adding a group to an administrative unit brings only the group object into the management scope, not its members. The technician can reset passwords only for in-scope nonadministrator users. To fix this, the administrator must add the users directly or use dynamic user membership to place them in scope.

B is incorrect: A dynamic administrative unit supports exactly one object type, and a dynamic device rule matches devices rather than the required user accounts.

C is incorrect: A tenant-wide assignment reaches beyond the specific office, which defeats the purpose of scoping the delegated role to one slice of the directory.

D is incorrect: Group members are two steps removed from the administrative unit, so the group's presence does not automatically bring its members into management scope.

A is correct.

Explanation: Access to Content explorer is two-tiered. A role can open the tab, but viewing the actual list of classified items and their contents requires a separate, more restrictive permission. An empty view can mean that the required content-level permission is missing, not that the labeling failed.

B is incorrect: Activity explorer history is a separate reporting surface limited to 30 days, and it does not explain an empty Content explorer list.

C is incorrect: Content explorer shows items with sensitivity labels, retention labels, or matching sensitive information types, so it is not limited to retention labels.

D is incorrect: Policy priority and label list order affect settings and downgrade detection, not whether the Content explorer list is visible to the administrator.

C is correct.

Explanation: The Copilot location is available only in the Custom template, and selecting it automatically disables every other location in that policy. Exchange coverage therefore has to stay in a separate policy. Using a custom Copilot-only policy alongside the existing Exchange policy meets both requirements without creating a conflict.

A is incorrect: Selecting the Copilot location disables every other location in the policy, so Exchange cannot be selected alongside it in one policy.

B is incorrect: An Exchange policy does not cover Copilot prompts, and prompt DLP evaluates only text entered directly, not the uploaded file contents.

D is incorrect: Adding SharePoint and OneDrive is not possible in the same policy, because the Copilot selection disables every other location automatically.

C is correct.

Explanation: Applicable Conditional Access policies combine with AND logic. The MFA policy applies to all client apps, which includes the legacy client Exchange ActiveSync. Legacy authentication clients cannot present MFA claims, so the grant control cannot be satisfied and the sign-in is blocked by the enforced policy.

A is incorrect: The device policy is Not applied, but the MFA policy still applies to the session, and all applicable policies must be satisfied.

B is incorrect: Legacy authentication clients cannot present MFA or device claims, so no prior token claim can satisfy the MFA requirement in this specific scenario.

D is incorrect: The device policy selects only modern clients, so it does not apply to the legacy sign-in. The block comes entirely from the MFA policy.

A is correct.

Explanation: Microsoft Entra normalizes the password, matches banned terms, and scores the result. Each banned term earns one point and each remaining character earns one point. Here the total is well above the five-point minimum, so the banned term alone does not cause rejection. The password passes the scoring check.

B is incorrect: Cloud accounts have no audit-only mode. Banned-password checks are always active, and enforcement is the only mode available for Microsoft Entra ID.

C is incorrect: Microsoft Entra evaluates every cloud password change or reset against the combined banned list, so the list is not limited to resets.

D is incorrect: Matching uses normalization and fuzzy matching with an edit distance of one, not exact matching, so a substring can still be matched and scored.

D is correct.

Explanation: Automated investigation and response (AIR) remediation actions are not taken automatically. A SecOps team member must review and approve or reject each pending action. If nobody acts, the pending action times out after one week, so a pending recommendation is not proof that the messages are already gone.

A is incorrect: A recommendation and a completed action are different stages. A pending soft delete does not mean that the messages are already removed.

B is incorrect: ZAP and AIR are independent remediation paths. A ZAP action completing says nothing about whether a separate AIR recommendation was approved.

C is incorrect: Pending actions time out after one week rather than running automatically. They require explicit review and approval before the action executes.

B is correct.

Explanation: Scope and method readiness are separate conditions. Group2 is nested in Group1, so the user is already in scope. The user has only one registered method, which does not meet the current two-method requirement, so the user must register another eligible method before resetting.

A is incorrect: Microsoft Entra supports nested groups for SSPR, so enabling Group1 already includes Group2 members, and no scope error was reported by the user.

C is incorrect: A temporary block follows failed identity-proof attempts within defined limits. Nothing in the scenario indicates failed attempts, and the registration shortfall explains the failure.

D is incorrect: Lowering the requirement is not the correct fix. A policy change also does not automatically reenroll users or prompt them to add methods.

A is correct.

Explanation: Exact data match narrows matches to values present in a securely hashed reference table. Because the roster is a known, fixed list, EDM confirms specific values instead of only a format. Actual precision still depends on the schema, proximity settings, and test results, so Relecloud must validate it.

B is incorrect: Keywords and regular expressions recognize a shape, so they cannot confirm that a number is actually in the Woodgrove Bank roster.

C is incorrect: Trainable classifiers learn from examples and suit free-form content with varied structure, not a fixed list of known values like an account roster.

D is incorrect: Document fingerprinting is a supported auto-labeling detection method, but it is not the technique used for matching against a fixed, enumerable list.

D is correct.

Explanation: A blank device ID means the event did not carry device information. It does not mean Intune marked the device noncompliant. Chrome 111 or later needs CloudApAuthEnabled or the supported extension, and private browsing or disabled cookies can also make the device check fail. You must verify these prerequisites.

A is incorrect: Intune shows Compliant. A blank value means the browser did not pass device identity to Microsoft Entra, not that the device is noncompliant.

B is incorrect: What If has a client-app category input but no Edge-versus-Chrome selector, so it cannot reproduce or confirm a browser-specific runtime result.

C is incorrect: A Temporary Access Pass is for onboarding and recovery. It does not supply device identity to the browser or fix a missing device claim.

D is correct.

Explanation: A retention label applies to individual items, so it can mark case files for seven years while the site keeps its three-year policy. An auto-apply label policy applies the label automatically by conditions such as a sensitive information type, so no one has to tag files manually.

A is incorrect: A seven-year site policy over-retains everything in the site. A shorter label cannot shorten an active retain action from the container policy.

B is incorrect: A published label policy only makes the label available for manual application, which depends on someone remembering to apply it to files.

C is incorrect: A container-level policy cannot give specific records longer retention, and a second three-year policy does not create the required seven-year period.