Microsoft Purview Data Loss Prevention (DLP) policies evaluate content against configured sensitive information types, confidence levels, and instance-count thresholds. Matching content is then subject to the rule ' s configured actions and notifications.

First selection: Available to both internal and external users.

The exhibit shows that Policy1 has no action configured under the Actions section. Although user notifications are enabled, no access restriction or encryption action has been selected.

Therefore, Policy1 does not block internal or external access to matching files. Existing SharePoint or OneDrive permissions remain effective.

Second selection: No.

Policy1 defines three sensitive information types: SWIFT Code at Medium confidence, EU Debit Card Number at High confidence, and Credit Card Number at High confidence.

Each condition permits between 1 and 9 instances.

A file containing 18 credit card numbers exceeds the configured maximum of nine. Assuming no other sensitive information type satisfies the rule, the file does not match Policy1.

Because user notifications are triggered by matching DLP rules, no notification emails are generated.

Selecting three notification recipient categories does not independently trigger notifications when the DLP conditions are not met.

Therefore, the correct selections are available to both internal and external users and no.

Microsoft Defender for Office 365 evaluates custom outbound anti-spam policies according to policy priority, inclusion conditions, and exclusions.

Microsoft documents two important evaluation rules:

Different inclusion condition types, such as Users and Groups, use AND logic.

Exclusions override inclusions, and the first applicable policy takes precedence.

Statement 1: No.

User1 belongs to Group1 but is not the explicitly specified user (User3) in AntiSpam1. User1 is specified in AntiSpam2 but does not belong to Group2. Therefore, neither custom policy applies. The limits cannot be combined to produce 150.

Statement 2: No.

User2 belongs to both Group1 and Group2. However, AntiSpam1 specifies User3 and Group1 as combined inclusion conditions, and additionally excludes Group2. AntiSpam2 specifies User1 and Group2 as combined inclusion conditions. User2 does not satisfy either policy ' s complete requirements.

Statement 3: No.

User3 is explicitly included in AntiSpam1 but does not belong to Group1. User3 also belongs to the excluded Group2. AntiSpam2 explicitly excludes User3. Consequently, neither custom policy imposes the stated 100-recipient daily limit on User3.

All three users fall back to the default outbound anti-spam policy.

Technical clarification: Microsoft defines the daily message limit in outbound anti-spam policies as a maximum number of recipients per day, not necessarily the number of email messages.

Microsoft Reference: Microsoft Learn — Configure outbound spam policies, recipient conditions, and policy precedence .

The Microsoft 365 Copilot Agent usage report provides centralized reporting on the adoption and activity of agents used through Microsoft 365 Copilot Chat and supported Microsoft 365 applications.

Option B is correct because the report supports usage analysis over the previous 7 or 30 days and provides agent-specific activity information.

Administrators can access the report through the Microsoft 365 admin center by navigating to Reports, Usage, Microsoft 365 Copilot, and Agents.

The report includes information about active agents, active users, agent responses, and usage trends. Its daily time-series reporting helps administrators examine usage patterns, while agent-level details support comparisons between Agent1 and Agent2.

Option A is incorrect because Microsoft Defender for Cloud Apps app governance primarily focuses on application permissions, OAuth applications, and associated security risks rather than Copilot agent activity reporting.

Option C is incorrect because billing and usage information primarily addresses consumption and associated charges rather than providing the complete agent adoption and activity reporting requested.

Option D is incorrect because Microsoft Purview Audit provides event-level audit records. Although relevant activities may be recorded, it is not the most direct reporting solution for comparing agent usage.

Therefore, the Microsoft 365 Copilot Agent usage report is the appropriate selection.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-agents-new

Microsoft SharePoint Restricted Access Control enables administrators to restrict access to a SharePoint site and its content to members of designated Microsoft Entra security groups or Microsoft 365 groups.

Option B is correct because Restricted Access Control adds an additional authorization requirement without replacing the site ' s existing SharePoint permissions.

When Group1 is configured as the restricted access control group for Site1, users must satisfy two conditions before accessing its documents: they must belong to Group1 and possess appropriate existing SharePoint permissions.

Users outside Group1 are denied access even when they previously received direct permissions or sharing links.

This protection also applies to Microsoft 365 Copilot and organization-wide search experiences. Microsoft Copilot respects the effective SharePoint authorization boundaries, preventing unauthorized users from accessing restricted content through Copilot responses.

Option A is incorrect because Microsoft 365 Archive is intended for inactive content storage rather than enforcing group-based authorization.

Option C is incorrect because Restricted SharePoint Search controls content discoverability, not the underlying ability to open files.

Option D is incorrect because Restricted Content Discovery limits search and Copilot discovery without enforcing the required group-based access restrictions.

Restricted Access Control therefore satisfies the complete requirement while preserving the existing permission structure.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-access-control

Microsoft Defender for Office 365 processes email protection policies according to a defined precedence order. When Standard or Strict preset security policies are enabled, they take precedence over custom anti-spam policies.

The general processing order is Strict preset security policy, Standard preset security policy, applicable evaluation policies, custom policies, and finally default protection.

Although Policy1 has priority 0, this value establishes its precedence among custom anti-spam policies only. It cannot override the Standard preset security policy.

Option A is correct because excluding Group1 from Standard protection prevents the Standard preset security policy from applying to the group ' s members. These users can then be evaluated by Policy1, provided its recipient conditions match.

Administrators can configure this exception through the Microsoft Defender portal or the corresponding preset policy rule settings.

Option B is incorrect because disabling Standard protection would affect all recipients, violating the requirement to preserve Standard protection for other users.

Option C is incorrect because changing Policy1 to priority 1 lowers its precedence among custom policies and does not supersede Standard protection.

Option D is incorrect because adding exceptions to Policy1 does not change the precedence of Standard protection.

Therefore, Group1 must be excluded from the Standard preset security policy.

Microsoft References:

https://learn.microsoft.com/en-us/defender-office-365/preset-security-policies

https://learn.microsoft.com/en-us/defender-office-365/how-policies-and-protections-are-combined

Microsoft 365 groups provide integrated collaboration capabilities across Exchange Online, SharePoint Online, Microsoft Teams, Planner, and other Microsoft 365 workloads.

Option C is correct because upgrading an eligible distribution list to a Microsoft 365 group preserves its existing members and email addresses while enabling additional collaboration resources.

A Microsoft 365 group provides a shared mailbox, group calendar, SharePoint document library, and integration with Microsoft Teams. Group owners can manage membership without requiring administrators to perform routine membership changes.

Microsoft supports upgrading cloud-managed, simple, non-nested distribution lists to Microsoft 365 groups. Group1 has no nested groups, satisfying one important eligibility condition. Administrators must also confirm the remaining requirements before initiating the upgrade.

The upgrade can be initiated through the Exchange admin center. The distribution list owner can then approve the upgrade request.

Option A is incorrect because a SharePoint team site alone does not convert the existing distribution list or provide the complete Microsoft 365 group collaboration experience.

Option B is incorrect because dynamic security groups manage membership through attribute-based rules rather than providing shared collaboration resources.

Option D is incorrect because mail-enabled security groups provide email distribution and security permissions but not the shared files, calendar, and Teams integration required.

Therefore, upgrading Group1 is the most efficient solution.

Microsoft References:

Upgrade Distribution Lists to Microsoft 365 Groups .

Distribution list upgrade eligibility requirements .

Microsoft Defender XDR provides a unified incident investigation experience that correlates Microsoft Purview Data Loss Prevention alerts with security signals from other Microsoft Defender workloads.

Option C is correct because Microsoft Defender incidents combine related DLP alerts and security events into a single investigation context. This enables analysts to examine potentially connected activity instead of investigating each isolated alert independently.

Microsoft Defender can correlate DLP detections with signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and other integrated security services.

The incident investigation experience also supports remediation actions directly against affected entities. Depending on the relevant workload, authorization, and alert evidence, analysts can take actions such as resetting a user ' s password, disabling an account, applying a sensitivity label, removing file-sharing permissions, or isolating a compromised device.

Option A is incorrect because Activity explorer primarily provides visibility into user and data activities.

Option B is incorrect because Content explorer focuses on inspecting classified and sensitive content.

Option D is less appropriate because individual Defender alerts do not provide the same consolidated correlation and incident-management capabilities.

Option E supports DLP alert investigation but does not provide the same unified cross-product security correlation and remediation experience.

Therefore, Microsoft Defender incidents satisfy both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/defender-xdr/dlp-investigate-alerts-defender

Microsoft Entra ID provides role-based access control (RBAC) for administrative tasks, including the management of verified custom domain names.

Option D is correct because admin1@contoso.onmicrosoft.com holds the Domain Name Administrator role, which is the least-privileged Microsoft Entra built-in role capable of managing custom domains.

Microsoft explicitly documents that the Domain Name Administrator role includes permissions to add, verify, update, and delete custom domain names.

The scenario also satisfies the prerequisites for domain removal: contoso.com is not the default domain, and no users, groups, or applications reference it.

Furthermore, the administrator ' s user principal name uses contoso.onmicrosoft.com, rather than the domain being deleted. This avoids a dependency that would otherwise prevent removal.

Option A is incorrect because the License Administrator role manages licensing assignments and does not provide domain deletion permissions.

Option B is incorrect because the Global Administrator role can delete custom domains but grants significantly broader administrative privileges than necessary.

Option C is incorrect because the User Administrator role manages user and certain group-related operations but does not provide the required domain-management permissions.

Administrators can remove the domain through the Microsoft Entra admin center under Entra ID, Domain names, and Custom domain names.

Therefore, admin1@contoso.onmicrosoft.com is the correct account because it meets the requirement while following the principle of least privilege.

Microsoft Defender for Office 365 Plan 2 provides Automated Investigation and Response (AIR) capabilities to investigate malicious email messages and recommend or execute remediation actions.

Option D is correct because Microsoft explicitly identifies Soft delete as the only available remediation action when configuring automatic remediation for AIR message clusters.

By default, AIR remediation actions require approval from the Security Operations (SecOps) team. However, administrators can enable automatic remediation for selected message cluster types, allowing malicious messages to be remediated without manual approval.

Administrators can configure this feature in the Microsoft Defender portal by navigating to Settings → Email & collaboration → MDO automation settings.

The Message clusters section supports three categories:

Similar files

Similar URLs

Multiple similar attributes

Under Remediation action, administrators select Soft delete. AIR then automatically removes qualifying malicious messages from user mailboxes without requiring SecOps approval.

Soft deletion moves messages into the Recoverable Items structure, allowing recovery according to applicable mailbox retention settings.

Option A moves messages to Deleted Items, while Option B moves them to Junk Email. Neither is supported as the configurable automatic AIR remediation action.

Option C permanently removes messages and is not supported for this automatic remediation configuration.

Microsoft also specifies that clusters containing more than 10,000 messages require manual review rather than automatic remediation.

Therefore, Soft delete is the only correct option.

Microsoft 365 Copilot connectors integrate information from external systems into Microsoft 365 Copilot and Microsoft Search. Two principal connector architectures are available: synced connectors and federated connectors.

Option A is correct because synced Copilot connectors ingest external content into Microsoft Graph and make the indexed information available for search and Copilot grounding.

A synced connector can connect to external SaaS knowledge bases, retrieve documents and associated metadata, and store the indexed information in Microsoft ' s search infrastructure.

The connector also supports access control lists (ACLs), ensuring that users receive search results and Copilot responses only for content they are authorized to access in the source system.

Preserving source permissions requires configuring the connector to honor the knowledge base ' s original access control model rather than making the indexed content visible to everyone.

Option B is incorrect because a custom Power Platform connector provides integration with external APIs but does not inherently index knowledge base content into Microsoft Graph.

Option C is incorrect because federated Copilot connectors retrieve external data in real time without indexing the information into Microsoft 365. This directly conflicts with the indexing requirement.

Option D is incorrect because embedding exported files in a Copilot Studio agent does not provide the required Microsoft Graph indexing and synchronized source permissions.

Therefore, a synced Copilot connector satisfies both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/overview

https://learn.microsoft.com/en-us/microsoft-365/copilot/connectors/manage-access-permissions