You have a Microsoft 365 E5 subscription and use Microsoft Intune for managing mobile devices.
You need to access service health alerts from a mobile phone.
What should you use?
Intune Company Portal
the Intune app
the Microsoft 365 Admin mobile app
the Microsoft Authenticator app
Show answer and explanation
Correct answer: C. the Microsoft 365 Admin mobile app
The Microsoft 365 Admin mobile app is the companion to the web-based Microsoft 365 admin center for administrators who need to work from a phone or tablet. After signing in with an administrator account, the dashboard shows service health, and the app lets you monitor the status of every service, read details about disruptions and outages, and receive push notifications for service health, Message center posts and billing. The notification settings let you choose which service health alerts you receive, so it is the right tool for following service health alerts from a mobile phone.
Why the other options are wrong
A. Intune Company Portal is an end-user app for enrolling devices and installing company apps, and it does not show Microsoft 365 service health alerts.
B. The Intune app is a user-facing app for accessing company resources on a device enrolled in Intune, not for monitoring Microsoft 365 service health.
D. Microsoft Authenticator handles sign-in verification and multifactor authentication and has no service health information.
Question 2
You have a Microsoft 365 subscription.
You need to create a Conditional Access policy that blocks sign-ins for the following scenarios:
• Activity from anonymous IP address.
• Impossible travel between two geographical locations.
Which condition should you configure for the policy?
Locations
Insider risk
User risk
Sign-in risk
Show answer and explanation
Correct answer: D. Sign-in risk
Microsoft Entra ID Protection classifies its detections as either sign-in risk or user risk. Activity from anonymous IP address, Anonymous IP address and Impossible travel are all listed as sign-in risk detections, because they describe the probability that a particular authentication attempt was not made by the legitimate account owner. A Conditional Access policy that uses the Sign-in risk condition, with the grant control set to block access, therefore blocks sign-ins that ID Protection flags for these scenarios.
Why the other options are wrong
A. The Locations condition matches named locations such as IP ranges or countries and does not evaluate risk detections like anonymous IP use or impossible travel.
B. Insider risk uses risk levels from Microsoft Purview Insider Risk Management about user behavior, not sign-in detections.
C. User risk reflects the likelihood that an account is compromised, from detections such as leaked credentials, while anonymous IP address and impossible travel are sign-in risk detections.
Question 3
You are testing a data loss prevention (DLP) policy to protect the sharing of credit card information with external users.
During testing, you discover that a user can share credit card information with external users by using email. However, the user is prevented from sharing files that contain credit card information by using Microsoft SharePoint.
You need to prevent the user from sharing the credit card information by using email and SharePoint.
What should you configure?
the user overrides of the DLP policy rule
the locations of the DLP policy
the status of the DLP policy
the conditions of the DLP policy rule
Show answer and explanation
Correct answer: B. the locations of the DLP policy
Every DLP policy is scoped to one or more locations, such as Exchange email, SharePoint sites, OneDrive accounts, Teams and devices, and it only evaluates activity in the locations it includes. The policy already detects credit card numbers and blocks external sharing from SharePoint, which shows that its rule conditions, actions and status are working. Email with the same information goes through because the policy does not include the Exchange email location. Adding Exchange to the policy locations applies the same rule to outbound email, so credit card information is protected in both email and SharePoint.
Why the other options are wrong
A. User overrides only let users bypass a block, optionally with a justification, and cannot extend the policy to email it does not evaluate.
C. The policy is already enforcing in SharePoint, so its status is on, and changing status does not add email coverage.
D. The conditions already detect credit card information, as the SharePoint block shows, so the gap is the missing email location, not the conditions.
Each step includes the one before, so buying only adds new questions.
You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
2640% of the bankHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
65100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
ABOUT THIS PACK
What’s in the Microsoft AB-650 pack
65 questions mapped to the AB-650 exam objectives
Answers and explanations for every question, including the wrong options
A questions-only PDF for timed practice runs
Delivered by email shortly after checkout
Free monthly updates for as long as the exam is live
Pass or your money back
Microsoft sets the AB-650 exam price by country, and a failed attempt means paying it again. This pack is US$39, paid once, and refunded if you fail.
What makes the AB-650 hard
AB-650 is a Microsoft 365 administrator exam with AI services built into the role. Microsoft describes the candidate as someone who configures, manages, secures and governs Microsoft 365 tenants, workloads and AI services, including Microsoft 365 Copilot and agents, and works with architects and administrators across identity, security, compliance, endpoints and applications.
Governance and security is the biggest domain at 40 to 45%: Microsoft Entra users, guests, groups, roles with Privileged Identity Management, administrative units and bulk management with Microsoft Graph PowerShell; authentication methods, Password Protection, self-service password reset and Conditional Access with ID Protection and multifactor authentication; Defender for Office 365 alerts, threat policies and attack simulations; and Microsoft Purview DLP, sensitivity labels, retention and Data Security Posture Management for AI activity.
AI services carry 35 to 40%. That means Copilot tenant and data readiness, including oversharing, web search and Microsoft 365 Copilot Search, tenant Copilot settings, Copilot connectors and third-party AI providers, agent identities with Microsoft Entra Agent ID, the agent registry, Agent 365 monitoring and data protection, and AI cost and usage reporting through the Copilot Control System. The remaining 20 to 25% is tenant and workload administration: domains, licensing including AI licenses, Microsoft 365 Backup, service health, mailboxes, Teams and SharePoint, including preparing SharePoint and OneDrive for Copilot.
Microsoft notes that most questions cover features that are generally available, and that Preview features can appear if they are commonly used. The exam is offered in English.
This pack has 65 real exam questions for the AB-650, including the hotspot and drag-and-drop tasks and the Contoso case studies, so the question style is familiar before exam day.
About the exam
AB-650 (Administering Microsoft 365 and AI Services) leads to Microsoft 365 Certified: Microsoft 365 and AI Services Administrator Associate, and it is the only exam that certification requires. It validates your ability to administer Microsoft 365 and AI services, enabling secure and compliant productivity across the organization. A score of 700 or greater is required to pass. Associate certifications renew annually through a free online assessment on Microsoft Learn.
Questions before you buy
How quickly do I receive it?
Your PDF is prepared and sent to your email address after checkout, and you get a confirmation as soon as it is on its way.
Are updates included?
Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.
What if I fail the exam?
We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.
What is your pass rate?
99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.
Can I share it with colleagues?
Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.
