Govern and secure Microsoft 365 tenants and workloads
Domain 2 of AB-650 accounts for 40-45% of the exam, the heaviest part of the syllabus. EarnYourCert has 166 original questions for this domain, all with explanations: 114 multiple choice, 21 yes/no and 31 completion or ordering items, like the real exam.
Domain 2 sample questions
8 questions from our 166-question bank for this domain. Try to answer before revealing the solution.
1. Executives' accounts must not be modified even by tenant-level User Administrators. What should you use?
- An access review of the User Administrator role
- Customer Lockbox enabled for the executives
- A dynamic group with the executive job titles
- A restricted management administrative unit
Show answer
Correct answer: D. In a restricted management administrative unit, only admins assigned at the unit scope can modify its members; tenant-level admins (except Global Administrator) can't.
2. Why should you exclude emergency access (break-glass) accounts from Conditional Access policies?
- To avoid being locked out of the tenant if a policy is misconfigured
- Because emergency accounts can't be licensed for Microsoft Entra ID P1
- Because Conditional Access applies only to guest accounts
- So that they can read every user's mailbox without approval
Show answer
Correct answer: A. Excluding monitored break-glass accounts prevents a faulty policy (or MFA outage) from locking all admins out of the tenant.
3. Users on unmanaged devices may read SharePoint files in the browser but must not download them. Which session control fits?
- Use app enforced restrictions
- Persistent browser session set to Always
- Require Temporary Access Pass for SharePoint
- Block access for all SharePoint users
Show answer
Correct answer: A. App enforced restrictions let SharePoint and Exchange Online provide limited, browser-only access (no download, print or sync) on unmanaged devices.
4. Users must sign in again every 8 hours on shared kiosk PCs. Which Conditional Access session control should you use?
- Authentication context
- App enforced restrictions
- Sign-in frequency
- Require compliant device
Show answer
Correct answer: C. Sign-in frequency defines how long before users must reauthenticate; persistent browser session controls whether sessions survive closing the browser.
5. A simulation must test whether users scan QR codes that lead to a fake sign-in page. Which technique fits?
- Drive-by URL to a cloned login page
- Credential harvest with a QR code payload
- Malware attachment
- OAuth consent grant with a QR code image
Show answer
Correct answer: B. Credential harvest simulations can use QR code payloads that lead to a fake login page; other techniques test attachments, drive-by URLs or OAuth consent.
6. Employees who fail a phishing simulation must automatically get a short course. What should you configure?
- Training assignment in the simulation settings
- A retention label for users who clicked the link
- A Privileged Identity Management access review
- A Teams policy package for repeat offenders
Show answer
Correct answer: A. Simulations can assign Microsoft training modules (or your own) to users who are compromised or click, with due dates and reminder notifications.
7. Which Microsoft 365 feature gives executives extra protection and lets you filter alerts and reports for them?
- Priority account protection
- Targeted release
- Message center
- Administrative units with restricted management for executives
Show answer
Correct answer: A. Priority accounts get differentiated protection and are tagged in Defender alerts, Explorer and reports.
8. Before rolling out Copilot, you want DSPM to show SharePoint sites with sensitive files that are broadly shared. What should you run?
- A data risk (oversharing) assessment
- A Service health incident report
- A message trace for the last 90 days
- An attack simulation with credential harvest
Show answer
Correct answer: A. DSPM data risk assessments scan sites for oversharing (sensitive items accessible to many users) and recommend fixes such as labels, restricted access or reviews.