An administrator can create usernames that contain the: contoso221018.onmicrosoft.com, east.contoso221018.onmicrosoft.com, and contoso.com domains; Exchange Online can receive inbound email messages sent to the: contoso221018.onmicrosoft.com domain only

Microsoft 365 supports multiple verified domains within a tenant. These domains can be used for Microsoft Entra user principal names, while Exchange Online email routing depends on additional service configuration and DNS records.

The exhibit shows three domains with different status indicators: the default contoso221018.onmicrosoft.com domain is Healthy, contoso.com has Incomplete setup, and east.contoso221018.onmicrosoft.com has No services selected.

First selection: All three domains.

The intended interpretation is that the domains have been added to the tenant and are available for identity naming. A custom domain can be used for a user ' s sign-in name once domain ownership has been verified, even if other Microsoft 365 service configuration is incomplete.

Second selection: The default onmicrosoft.com domain only.

The default tenant domain provides Exchange Online ' s fallback email-routing namespace. In the exhibit, the custom domain has incomplete service configuration, while the additional subdomain has no services selected.

However, there is an important technical limitation: these administrative status indicators alone do not conclusively establish the live external MX records or every Exchange Online accepted-domain setting. Those configurations must be inspected to verify actual inbound mail routing.

The selections above represent the intended examination interpretation, not independent proof of the tenant ' s current DNS configuration.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain

https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain

Microsoft SharePoint Restricted Content Discovery is designed to limit the discoverability of content from specific SharePoint sites in organization-wide search and Microsoft 365 Copilot experiences.

Option D is correct because Restricted Content Discovery can be enabled individually for Site1 without modifying its existing access permissions.

This capability is particularly useful when an organization is reviewing overshared SharePoint content and needs time to correct inappropriate permissions.

When Restricted Content Discovery is enabled, the affected site ' s content is excluded from general organization-wide discovery experiences, subject to exceptions for content that users own or have recently interacted with.

This behavior satisfies the requirement to maintain access to recently used files while limiting broader discovery.

Option A is incorrect because Restricted SharePoint Search uses an allowed-site approach and is not the appropriate site-specific control for the stated requirements.

Option B is incorrect because Restricted Access Control changes the effective access restrictions rather than simply limiting content discovery.

Option C only delegates administrative management of Restricted Content Discovery. It does not independently activate the restriction for Site1.

Option E adds a search bookmark and does not restrict document discovery.

Administrators can configure this through the SharePoint admin center or by using Set-SPOSite with -RestrictContentOrgWideSearch $true.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery

Modify the password protection policy: User1 only; Invite an external user: User1, User2, User3, and User4

Microsoft Entra ID uses role-based access control (RBAC) to authorize administrative operations. The two activities in this question have different permission requirements.

First selection: User1 only.

Modifying the tenant-wide password protection policy requires privileged authorization. The Global Administrator role held by User1 includes the permissions required to configure Microsoft Entra Password Protection, including the custom banned-password list and smart lockout settings.

The Authentication Policy Administrator role can also manage these settings, but none of the other listed users holds that role. User2 ' s Security Administrator role does not provide this specific permission, while User4 ' s Password Administrator role concerns password administration rather than configuration of the tenant-wide password protection policy.

Second selection: User1, User2, User3, and User4.

Microsoft Entra external collaboration settings allow users to invite external guests. Under the default configuration, organizational users can invite external users, including users without administrative roles.

User1 can invite guests as a Global Administrator, and User2 also has the Guest Inviter role. User3 and User4 can invite external users under the default invitation settings.

Therefore, all four users qualify for the second activity.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference

https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure

Microsoft Purview supports service-side sensitivity auto-labeling for Exchange Online email, including inspection of supported email attachments.

Statement 1: Yes, conditionally.

When an active Exchange auto-labeling policy detects sensitive information in a supported Office attachment, it applies the configured sensitivity label to the email, even if the email body does not contain sensitive information.

File1.docx contains an IP address and uses a supported Word format. If that IP address satisfies the auto-labeling policy ' s conditions, the email receives Sensitivity1.

The sensitivity label ' s Auto-labeling for files and emails setting being None does not prevent a separately configured service-side auto-labeling policy from functioning.

Statement 2: No.

Microsoft documentation explicitly states that Exchange auto-labeling labels the email rather than its attachments. Therefore, File1.docx does not receive Sensitivity1 simply because its content triggered the email label.

Consequently, the configured watermark is not automatically added to File1.docx.

Statement 3: No.

File2.xml is not a supported Office attachment format for Exchange sensitivity auto-labeling. Additionally, the service-side labeling process does not apply document headers to attachments.

Therefore, File2.xml does not receive the configured header.

Microsoft Purview Data Loss Prevention (DLP) provides controls to prevent Microsoft 365 Copilot from processing sensitive organizational content when generating responses.

Option D is correct because the Contoso technical requirement explicitly states that Microsoft 365 Copilot responses must not use content from project documents stored on SharePoint Site1.

Microsoft Purview supports a dedicated Microsoft 365 Copilot and Copilot Chat DLP policy location. Administrators can configure a DLP rule using the Content contains → Sensitivity labels condition and the Prevent Copilot from processing content action.

This prevents Copilot from processing files with the specified sensitivity labels or incorporating their contents into generated responses, even when users have SharePoint permissions.

For Contoso, the project documents can be identified using their distinctive project-code format, PR-123456789, and classified with an appropriate sensitivity label. The DLP policy can then exclude those labeled documents from Copilot processing.

Option A is incorrect as a complete solution because sensitivity labels and auto-labeling policies classify and protect documents but do not independently enforce the required Copilot processing restriction.

Option B is incorrect because Insider Risk Management detects potentially risky user activities.

Option C is incorrect because Information Barriers restrict communication and collaboration between designated user segments.

Technical consideration: The DLP policy requires an appropriate sensitivity label to be applied to the project documents. DLP rules for Copilot cannot directly exclude stored files merely by matching their project-code pattern.

Therefore, a DLP policy is the required enforcement mechanism.

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .