List the AI app and agent inventory: AI observability; Review interactions: Activity explorer; Identify SharePoint exposure concerns: Data risk assessments

Microsoft Purview Data Security Posture Management (DSPM) combines AI activity visibility, sensitive-data investigations, and exposure assessments within a centralized data security framework.

First selection: AI observability. This capability provides an inventory of AI applications and agents, including their activity, risk characteristics, and sensitive interactions. Administrators can identify recently used agents and investigate potentially risky AI applications.

Second selection: Activity explorer. DSPM Activity explorer enables administrators to investigate events associated with sensitive information. Its AI activities view provides visibility into AI interactions, prompts and responses where supported, sensitive information detections, and data loss prevention policy matches. This makes it suitable for examining whether confidential SharePoint information was involved in an AI interaction.

Third selection: Data risk assessments. This capability identifies potential data exposure and oversharing risks. Administrators can assess sensitive content and investigate SharePoint locations where excessive access permissions or sharing configurations may expose information.

The remaining options perform different functions. Posture provides an overall data security dashboard, Remediation actions supports implementing security controls, and Reports provides summarized security information.

Consequently, AI observability, Activity explorer, and Data risk assessments are the correct selections for the three investigation requirements.

Microsoft References:

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:

(device.deviceTrustType -eq " Workplace " ) -and

(device.deviceOSType -in [ " Windows " , " Android " ])

Statement 1: No.

Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.

Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.

Statement 2: Yes.

Device2 runs Windows 11 and is Microsoft Entra registered.

Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.

Statement 3: Yes.

The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.

Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.

Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.

Microsoft References:

Manage dynamic membership in administrative units .

Microsoft Entra dynamic membership rules and device attributes .

Microsoft Entra Conditional Access integrates with Microsoft Entra ID Protection to evaluate risky authentication attempts and enforce additional security requirements based on detected sign-in risk.

The Contoso technical requirement states that Group3 users accessing Microsoft 365 resources from anonymous IP addresses must complete multifactor authentication (MFA).

First selection: Sign-in risk.

Microsoft Entra ID Protection recognizes sign-ins from anonymous IP addresses, including anonymous VPNs and Tor exit nodes, as potential security risks.

Administrators can configure the Sign-in risk condition in CAPolicy1 to evaluate authentication attempts based on their calculated risk level. Microsoft recommends considering medium and high sign-in risk for MFA enforcement, depending on the organization ' s security requirements.

Second selection: Grant.

The Grant access control determines which authentication requirements must be satisfied before access is permitted.

Administrators should select Grant access and configure the built-in Multifactor authentication strength, or the corresponding Require multifactor authentication control where available.

Because CAPolicy1 already targets Group3 and all resources, these selections apply risk-based MFA requirements to the intended users and Microsoft 365 resources.

Technical qualification: Sign-in risk policies operate on calculated risk levels, not exclusively on anonymous IP addresses. Consequently, they may also trigger for other risky sign-ins and cannot guarantee that every anonymous-IP connection is challenged.

cCompleted PowerShell Script (Corrected for Execution):

Connect-MgGraph -Scopes " GroupMember.ReadWrite.All "

$members = Import-Csv -Path " C:\Temp\members.csv "

foreach ($member in $members) {

New-MgGroupMemberByRef -GroupId $groupId `

-OdataId " https://graph.microsoft.com/v1.0/directoryObjects/$($member.memberObjectId) "

}

Disconnect-MgGraph

Microsoft Graph PowerShell provides cmdlets for managing Microsoft Entra security group memberships, including bulk membership updates from CSV files.

First selection: Connect-MgGraph. This command establishes an authenticated Microsoft Graph session. The GroupMember.ReadWrite.All delegated permission authorizes modification of supported group memberships, subject to the signed-in user ' s administrative privileges.

Second selection: New-MgGroupMemberByRef. This cmdlet adds an existing Microsoft Entra directory object to a security group by creating a membership reference.

The -GroupId parameter identifies Group1, while -OdataId supplies the Microsoft Graph URL of the user object being added.

Import-Csv reads the user identifiers from C:\Temp\members.csv. The foreach loop processes each CSV record and adds the corresponding user to Group1.

Get-MgGroupMember and Get-MgGroupMemberByRef retrieve existing memberships rather than creating them. Update-MgGroup modifies group properties but is not the appropriate membership-reference operation.

Important correction: The original exhibit uses $member.ObjectId, but the CSV column is named memberObjectId. The script must reference $member.memberObjectId; otherwise, the object identifier will not be retrieved correctly.

Therefore, the correct dropdown answers are Connect-MgGraph and New-MgGroupMemberByRef.

Microsoft References:

Microsoft Learn — New-MgGroupMemberByRef .

Microsoft Graph — Add members to groups .

Microsoft Graph PowerShell authentication commands .

Microsoft 365 provides administrative interfaces for reporting service problems and communicating product-related feedback.

Option C: Product feedback in the Microsoft 365 admin center. The Product feedback experience helps administrators review feedback submitted about Microsoft 365 applications and Copilot. Feedback can document unexpected behavior, feature problems, and limitations that Microsoft uses to improve its products.

Administrators can also submit feedback through the Microsoft 365 administrative feedback mechanisms. However, Product feedback is primarily a feedback-management experience, not a substitute for a formal technical support request.

Option E: Service health in the Microsoft 365 admin center. This is the most direct choice for reporting a suspected Microsoft 365 service issue. Administrators can navigate to Health, select Service health, and choose Report an issue when the problem is not already listed as an active incident.

Microsoft can correlate the submitted report with signals from other tenants and determine whether the problem represents a broader service incident.

Option A provides adoption and consumption information rather than incident reporting.

Option B publishes administrative announcements, feature updates, and service communications.

Option D is not the documented primary reporting interface for Microsoft 365 service incidents.

For a production-impacting issue requiring assistance, administrators should additionally use the Microsoft 365 admin center ' s Help and support functionality.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/view-service-health

https://learn.microsoft.com/en-us/microsoft-365/copilot/extensibility/feedback

Administrative unit members: The Branch1 users and Group1; Role to assign to Helpdesk1: User Administrator

Microsoft Entra administrative units enable organizations to delegate administrative permissions to specific subsets of directory objects, avoiding tenant-wide administrative assignments.

First selection: The Branch1 users and Group1.

The administrative unit must contain both the individual Branch1 user objects and the Group1 security group.

Including Branch1 users enables delegated administrators to manage those users within the administrative unit ' s scope. Including Group1 enables administrators to manage the group ' s properties and membership.

Microsoft specifically distinguishes between adding a security group and adding its members to an administrative unit. Adding Group1 does not automatically add its users. Therefore, selecting Group1 alone would not satisfy the password-reset requirement.

Second selection: User Administrator.

The User Administrator role provides permissions to manage supported user properties, reset passwords for eligible nonprivileged users, and manage group memberships.

When assigned at the administrative-unit scope, the role restricts its administrative operations to the applicable objects within that unit.

The Helpdesk Administrator role supports password-related helpdesk tasks but does not grant the broader group membership management capability required.

The Groups Administrator role focuses on group management without the necessary user password-reset capability.

Privileged Role Administrator provides excessive permissions for the scenario.

Therefore, the administrative unit must contain the Branch1 users and Group1, with Helpdesk1 assigned the scoped User Administrator role.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/administrative-units

https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-members-add

Microsoft Entra administrative units provide role-based administrative delegation restricted to specific users, groups, or devices. They enable organizations to distribute administrative responsibilities without granting permissions across the entire tenant.

First selection: An administrator unit.

An administrative unit allows Contoso to organize Branch1 users and restrict Admin1 ' s administrative scope to those users.

To minimize administrative effort, configure dynamic user membership based on the Office location attribute:

(user.physicalDeliveryOfficeName -eq " Branch1 " )

This rule automatically includes users whose Office location is Branch1 and removes users when their relevant attribute no longer matches.

A Microsoft 365 group or security group alone cannot restrict the scope of a Microsoft Entra administrator role to its individual members.

Second selection: User Administrator.

The User Administrator role provides the necessary permissions to reset supported user passwords, assign or remove licenses, and modify user attributes.

Assigning this role to Admin1 at the scope of the Branch1 administrative unit, rather than at tenant scope, restricts those administrative operations to users within that unit.

The Helpdesk Administrator and Password Administrator roles provide password-management capabilities but do not grant the complete user and license administration permissions required.

Therefore, an administrative unit combined with an administrative-unit-scoped User Administrator role satisfies all requirements.

Group1: The Microsoft 365 Copilot usage report; Group2: The Microsoft 365 Copilot Chat usage report

Microsoft 365 provides separate reporting capabilities for licensed Copilot functionality and the broadly available Copilot Chat experience.

First selection: Microsoft 365 Copilot usage report.

Group1 contains users assigned Microsoft 365 Copilot licenses who interact with Copilot across Microsoft 365 applications and agents.

The Microsoft 365 Copilot usage report provides adoption and engagement information about these licensed experiences.

It includes enabled users, active users, usage by application, user activity information, and supported prompt-count metrics.

Administrators can use this report to evaluate whether licensed employees are actively using Copilot capabilities.

Second selection: Microsoft 365 Copilot Chat usage report.

Group2 users do not have Microsoft 365 Copilot licenses but use the Copilot Chat experience available through Microsoft 365.

The Copilot Chat usage report tracks conversational AI adoption, including active users, total prompts submitted, average prompts per user, and individual activity trends.

This makes it the appropriate report for measuring engagement among users who rely on Copilot Chat without the paid Copilot license.

The Microsoft 365 apps usage report measures general application usage, while the Copilot readiness report focuses on eligibility and deployment preparation.

Therefore, the licensed group requires the Copilot usage report, while the unlicensed group requires the Copilot Chat usage report.

Reporting clarification: Microsoft ' s current report documentation describes standard 7-, 28-, 90-, and 180-day periods. The video specifies 30 days, but the latest reporting interface may use a 28-day period instead.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-365-copilot-usage

https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/microsoft-copilot-usage

Microsoft Exchange Online supports shared mailbox creation and delegated mailbox permission management through both the Microsoft 365 admin center and Exchange admin center (EAC).

First selection: Exchange admin center and Microsoft 365 admin center only.

Administrators can create shared mailboxes through either administrative interface.

In the Microsoft 365 admin center, navigate to Teams & groups → Shared mailboxes → Add a shared mailbox.

Alternatively, in the Exchange admin center, navigate to Recipients → Mailboxes → Add a shared mailbox.

Both interfaces support creating Mbox1 and configuring its basic mailbox properties.

Second selection: Exchange admin center and Microsoft 365 admin center only.

Both portals support granting Send As permissions.

In the Microsoft 365 admin center, select Mbox1 under Shared mailboxes and open Manage mailbox permissions.

In the Exchange admin center, select Mbox1 under Recipients, open Manage mailbox delegation, and configure Send As permissions for User1.

The Send As permission enables User1 to send messages that appear to originate directly from Mbox1 without displaying User1 as the sender.

The Microsoft Entra admin center manages identity objects, roles, groups, and authentication settings. It does not provide the Exchange mailbox creation and mailbox delegation interfaces required by this question.

Therefore, both tasks can be performed through the Exchange admin center and Microsoft 365 admin center.

Microsoft References:

Microsoft Learn — Shared mailboxes in Exchange Online .

Microsoft Learn — Create a shared mailbox .

Microsoft Learn — Configure shared mailbox permissions

Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access to privileged roles through eligible assignments and configurable role activation requirements.

Statement 1: Yes.

User1 has an eligible Global Administrator assignment. The PIM configuration specifies Require justification on activation: Yes. Therefore, User1 must submit a business justification when activating the role. The user must also satisfy the configured multifactor authentication requirement.

Statement 2: No.

User2 has an assigned (active) Global Administrator role rather than an eligible assignment. Active assignments provide permissions without requiring role activation. Consequently, the configured MFA-on-activation requirement does not apply to User2 in the manner described. Separate Conditional Access policies may still require MFA during sign-in.

Statement 3: No.

User3 has an eligible Global Administrator assignment. The activation maximum duration is eight hours, meaning each activation can remain active for no longer than eight hours.

However, this does not terminate the underlying eligibility. The eligible assignment is configured to expire after 15 days.

After an eight-hour activation expires, User3 can activate the role again, provided the eligible assignment remains valid and the activation requirements are satisfied.

The distinction between activation duration and eligibility duration is fundamental to Microsoft Entra PIM.

Microsoft References:

Microsoft Learn — Configure PIM role settings .

Microsoft Learn — Activate Microsoft Entra roles in PIM .

Microsoft Learn — Assign eligible and active roles .

Microsoft Purview supports service-side sensitivity auto-labeling for Exchange Online email, including inspection of supported email attachments.

Statement 1: Yes, conditionally.

When an active Exchange auto-labeling policy detects sensitive information in a supported Office attachment, it applies the configured sensitivity label to the email, even if the email body does not contain sensitive information.

File1.docx contains an IP address and uses a supported Word format. If that IP address satisfies the auto-labeling policy ' s conditions, the email receives Sensitivity1.

The sensitivity label ' s Auto-labeling for files and emails setting being None does not prevent a separately configured service-side auto-labeling policy from functioning.

Statement 2: No.

Microsoft documentation explicitly states that Exchange auto-labeling labels the email rather than its attachments. Therefore, File1.docx does not receive Sensitivity1 simply because its content triggered the email label.

Consequently, the configured watermark is not automatically added to File1.docx.

Statement 3: No.

File2.xml is not a supported Office attachment format for Exchange sensitivity auto-labeling. Additionally, the service-side labeling process does not apply document headers to attachments.

Therefore, File2.xml does not receive the configured header.