9 free Microsoft AB-650 practice questions from the CertStash pack of 65, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 9 free here, all 65 in the pack, and each step includes the one before it.
Get all 65 questions (US$39) · Download the first 10 as a PDF
Question 1
You have a Microsoft 365 E5 subscription and use Microsoft Intune for managing mobile devices.
You need to access service health alerts from a mobile phone.
What should you use?
Show answer and explanation
Correct answer: C. the Microsoft 365 Admin mobile app
The Microsoft 365 Admin mobile app is the companion to the web-based Microsoft 365 admin center for administrators who need to work from a phone or tablet. After signing in with an administrator account, the dashboard shows service health, and the app lets you monitor the status of every service, read details about disruptions and outages, and receive push notifications for service health, Message center posts and billing. The notification settings let you choose which service health alerts you receive, so it is the right tool for following service health alerts from a mobile phone.
Why the other options are wrong
- A. Intune Company Portal is an end-user app for enrolling devices and installing company apps, and it does not show Microsoft 365 service health alerts.
- B. The Intune app is a user-facing app for accessing company resources on a device enrolled in Intune, not for monitoring Microsoft 365 service health.
- D. Microsoft Authenticator handles sign-in verification and multifactor authentication and has no service health information.
Question 2
You have a Microsoft 365 subscription.
You need to create a Conditional Access policy that blocks sign-ins for the following scenarios:
• Activity from anonymous IP address.
• Impossible travel between two geographical locations.
Which condition should you configure for the policy?
Show answer and explanation
Correct answer: D. Sign-in risk
Microsoft Entra ID Protection classifies its detections as either sign-in risk or user risk. Activity from anonymous IP address, Anonymous IP address and Impossible travel are all listed as sign-in risk detections, because they describe the probability that a particular authentication attempt was not made by the legitimate account owner. A Conditional Access policy that uses the Sign-in risk condition, with the grant control set to block access, therefore blocks sign-ins that ID Protection flags for these scenarios.
Why the other options are wrong
- A. The Locations condition matches named locations such as IP ranges or countries and does not evaluate risk detections like anonymous IP use or impossible travel.
- B. Insider risk uses risk levels from Microsoft Purview Insider Risk Management about user behavior, not sign-in detections.
- C. User risk reflects the likelihood that an account is compromised, from detections such as leaked credentials, while anonymous IP address and impossible travel are sign-in risk detections.
Question 3
You are testing a data loss prevention (DLP) policy to protect the sharing of credit card information with external users.
During testing, you discover that a user can share credit card information with external users by using email. However, the user is prevented from sharing files that contain credit card information by using Microsoft SharePoint.
You need to prevent the user from sharing the credit card information by using email and SharePoint.
What should you configure?
Show answer and explanation
Correct answer: B. the locations of the DLP policy
Every DLP policy is scoped to one or more locations, such as Exchange email, SharePoint sites, OneDrive accounts, Teams and devices, and it only evaluates activity in the locations it includes. The policy already detects credit card numbers and blocks external sharing from SharePoint, which shows that its rule conditions, actions and status are working. Email with the same information goes through because the policy does not include the Exchange email location. Adding Exchange to the policy locations applies the same rule to outbound email, so credit card information is protected in both email and SharePoint.
Why the other options are wrong
- A. User overrides only let users bypass a block, optionally with a justification, and cannot extend the policy to email it does not evaluate.
- C. The policy is already enforcing in SharePoint, so its status is on, and changing status does not add email coverage.
- D. The conditions already detect credit card information, as the SharePoint block shows, so the gap is the missing email location, not the conditions.
Question 4
You have a Microsoft 365 subscription that contains a distribution list named Group1.
Group1 does NOT have nested groups and is used by project members to send emails.
You need to provide the project members with group-based collaboration resources. The solution must meet the following requirements:
• Enable group owners to manage the membership of Group1
• Provide a shared calendar and shared files
• Support Microsoft Teams integration
• Minimize administrative effort
What should you do?
Show answer and explanation
Correct answer: C. Upgrade Group1 to a Microsoft 365 group
Upgrading Group1 to a Microsoft 365 group keeps all of its members and its email address, so the project team continues to send mail exactly as before. A Microsoft 365 group adds a shared workspace with a group calendar and shared files in a SharePoint site, it can be connected to Microsoft Teams, and group owners manage its membership. Only cloud-managed, simple, non-nested distribution lists can be upgraded, and Group1 has no nested groups, so it meets the non-nested condition. The administrator sends an upgrade request from the Exchange admin center and the owner completes it, which is far less effort than building a new group and moving everyone across.
Why the other options are wrong
- A. Creating a new team site builds a separate workspace and membership from scratch instead of reusing Group1, which adds administrative effort.
- B. A dynamic security group calculates membership from rules, so owners cannot manage members, and it provides no shared calendar or files.
- D. A mail-enabled security group only adds email and permission assignment, with no shared calendar, group files or Teams workspace.
Question 5
You have a Microsoft 365 E5 subscription that uses Microsoft Defender for Office 365. Strict protection is enabled for all recipients.
The subscription contains a group named Group1 that contains all the mailboxes for your company’s marketing department.
Several marketing department mailboxes recently sent high volumes of external email after a credential was compromised.
You need to enforce a lower external message limit for Group1. The solution must automatically restrict senders that reach the limit.
What should you do?
Show answer and explanation
Correct answer: A. Create a custom anti-spam outbound policy.
A custom anti-spam outbound policy can be scoped to specific users, groups or domains, so it can target the members of Group1, and custom policies are applied before the default outbound policy. In its protection settings you can set a lower external message limit (the maximum number of external recipients per hour) and choose the restriction for users who reach the limit, such as Restrict the user from sending mail, which adds them to Restricted users automatically. Outbound spam policies are not part of preset security policies, so this is also the correct way to tighten limits for users already covered by Strict protection.
Why the other options are wrong
- B. The default outbound policy always applies to all senders and has no sender filters, so it cannot set a lower limit for Group1 only.
- C. The individual settings in preset security policies cannot be modified, and outbound spam policies are not part of preset security policies.
- D. The Standard preset security policy does not include outbound spam settings and offers no configurable external message limit.
- E. Inbound anti-spam policies filter incoming email and have no outbound message limits or sender restrictions.
Question 6
You have a Microsoft 365 subscription that contains a Microsoft SharePoint communication site named Site1 and a security group named Group1.
Some users that are outside of Group1 have direct permissions or sharing links to the content in Site1.
You need to ensure that users can access Site1 and its content only when they meet both of the following conditions.
• The user is a member of Group1.
• The user has SharePoint permissions to the content.
The solution must meet the following requirements:
• Apply only to Site1.
• Preserve the existing SharePoint permissions.
• Minimize administrative effort.
What should you do?
Show answer and explanation
Correct answer: C. Configure Restricted Access Control for Site1
Restricted Access Control (restricted site access) is configured per site and limits access to the site and its content to members of the specified Microsoft 365 or Microsoft Entra security groups. Users outside the control group cannot open the site or its files even if they already hold direct permissions or a sharing link. Membership in the group does not grant access by itself: a user needs both membership in the control group and SharePoint permissions to the content. Configuring it on Site1 with Group1 as the control group therefore enforces both conditions, leaves the existing SharePoint permissions untouched and needs only a single per-site setting once site-level access restriction is allowed for the tenant.
Why the other options are wrong
- A. Restricting sharing outside Restricted Access Control groups is a tenant-wide setting that only controls new sharing and does not block users who already have permissions or links.
- B. Restricted Content Discovery only hides a site from organization-wide search and Copilot and does not change who can open its content.
- D. Editing Site1 permissions would mean removing direct permissions and sharing links one by one, which changes existing permissions and takes significant effort.
Question 7
You have a Microsoft 365 subscription.
Several support engineers at your company require temporary access to Microsoft Entra administrator roles.
You need to configure role access for the engineers. The solution must meet the following requirements:
• The engineers must activate role access before role use.
• Role access must expire automatically after activation.
What should you do?
Show answer and explanation
Correct answer: D. Assign the engineers as eligible for the required roles by using Privileged Identity Management (PIM).
Privileged Identity Management provides just-in-time access to Microsoft Entra roles. An eligible assignment gives the engineers no privileges until they activate the role, and activation can require steps such as multifactor authentication, a justification or approval. When activating, the user selects a duration within the maximum activation duration that administrators configure, and after that period the role is no longer active and must be activated again. Assigning the engineers as eligible for the required roles therefore meets both requirements: activation before use and access that expires automatically.
Why the other options are wrong
- A. An administrative unit only limits the scope of a role assignment, and the assignment stays permanently active with no activation step.
- B. Active membership in a role-assignable group grants the roles immediately and continuously, with no activation before use.
- C. An access package grants its resources for the lifetime of the assignment once delivered, with no activation step before each use.
Question 8
You have a Microsoft 365 subscription that has an initial domain named contoso.onmicrosoft.com and two verified custom domains named contoso.com and fabrikam.com.
The fabrikam.com domain is the default domain.
The contoso.com domain uses managed authentication, and has 750 references across unused user accounts, application identifier URIs, and mail-enabled security groups.
You need to remove contoso.com from the subscription. The solution must minimize manual changes to Microsoft Entra objects.
What should you do?
Show answer and explanation
Correct answer: C. Update or remove the mail-enabled security group references, and then use the -ForceDelete option for contoso.com.
The ForceDelete option removes a custom domain asynchronously and renames the remaining references, such as user UPNs and email addresses, group email addresses and application identifier URIs, to the initial onmicrosoft.com domain. It works only when there are fewer than 1,000 references and the domain does not use federated authentication, and contoso.com has 750 references and uses managed authentication. However, references for which Exchange is the provisioning service, including mail-enabled security groups and distribution lists, must first be updated or removed in the Exchange admin center. Cleaning up only those group references and then running ForceDelete removes contoso.com while keeping manual changes to a minimum.
Why the other options are wrong
- A. Renaming every user, group and application reference by hand creates the most manual work, while ForceDelete can rename most of them automatically.
- B. ForceDelete fails while Exchange-provisioned references such as mail-enabled security groups still use the domain.
- D. A domain that is set as the primary (default) domain cannot be deleted, so making contoso.com the default blocks its removal.
Question 9
You have a Microsoft 365 subscription.
Your company has multiple branch offices, including a branch office named Branch1. The users in Branch1 connect to Microsoft 365 by using a corporate web proxy.
On the Network connectivity page in the Microsoft 365 admin center, Branch1 displays the following network insight:
“We’re detecting WebSocket (WSS) connection failures to the domain: *.cloud.microsoft, which causes Copilot to not work correctly for your users.” HTTPS access to Microsoft 365 apps from Branch1 succeeds.
You need to resolve the insight without changing connectivity for the other branch offices.
What should you configure?
Show answer and explanation
Correct answer: A. the Branch1 web proxy policy to allow required protocols for the hosts in *.cloud.microsoft
The insight reports WebSocket (WSS) connection failures to hosts in *.cloud.microsoft, which breaks Copilot scenarios, while HTTPS access from Branch1 already works. Microsoft's remediation for this insight is to check the network devices or web proxy infrastructure and make sure the WebSocket protocol is allowed for connections to hosts in *.cloud.microsoft and its subdomains. Because Branch1 users reach Microsoft 365 through their own corporate web proxy, updating the Branch1 web proxy policy to allow the required protocols for those hosts fixes the failing WebSocket traffic without touching connectivity for any other branch office.
Why the other options are wrong
- B. Name resolution is already working, since HTTPS access to Microsoft 365 apps from Branch1 succeeds, and DNS settings do not control whether the proxy permits WebSocket traffic.
- C. Exempting the hosts from TLS inspection addresses a different network insight about TLS interception and does not permit the WebSocket protocol that is failing.
- D. HTTPS access from Branch1 already succeeds, so allowing HTTPS again does nothing for the failing WebSocket connections.
That was 9 of 65.
The full Microsoft AB-650 pack has all 65 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 26 free as one PDF by email. Get the Half Pack →