Independent: not affiliated with Microsoft. Free to try; the study bundle adds a study guide and two practice exams.
5 original questions, none of them in the practice exams.
Pick an answer. Show answer explains every option and links its Microsoft source.
5 questions / Explanations link Microsoft sources / Last updated Oct 26, 2026
Question 1
Multiple choice
Domain 1 / Task 1.3 Core security features of Microsoft 365 services
A retailer's staff work only in Canada and the United States. The security team has drafted a Conditional Access policy that blocks sign-ins to Microsoft 365 from every other country. Before enforcing it, the team wants two weeks of results showing which real sign-ins the policy would have blocked, without blocking or prompting anyone during those two weeks. What should the administrator do?
Show answerHide answer
Answer: A
Why
Report-only is a policy state for testing a Conditional Access policy before enabling it. At each sign-in the policy is evaluated but not enforced, so no one is blocked or prompted, and the result is logged on the Conditional Access and Report-only tabs of the sign-in log details; a sign-in the policy would have blocked shows as Report-only: Failure. When the results look right, the administrator moves the Enable policy toggle from Report-only to On.
Why not the others
BA policy that is on is enforced, so pilot users who sign in from other countries are blocked.
CThe What If tool simulates a sign-in that you describe and evaluates only policies that are on or in report-only mode; it does not report what happened to real sign-ins.
DAudit logs record changes to a policy, such as who created or edited it; they do not show which sign-ins the policy would block.
A biotech firm writes its clinical-trial reports in Word and emails them to two partner universities, which store the files on their own systems. Compliance wants every report to carry a header that reads Trial data - restricted, and wants only the firm's staff and named researchers at the two universities to be able to open a report, wherever the file is copied. What should the administrator configure?
Show answerHide answer
Answer: B
Why
Sensitivity labels can apply content markings, such as a header, and encryption that controls who can open a file and what they can do with it, including people in other organizations. The label is stored in the file's metadata and its protection stays with the content, so the reports remain protected after they are emailed or copied to the universities' systems.
Why not the others
ARestricted access control limits who can open the site; a report that is downloaded or emailed leaves that control behind, and no header is added.
CA header marking only labels the report; without encryption nothing limits who can open it, and publishing a label to the firm's staff controls only who can see and apply it.
DBlocking by recipient only limits who receives the message; it adds no header to the report files and puts no limit on who opens a copy the universities already hold.
A construction firm keeps signed subcontractor agreements in the same SharePoint library as drafts and scanned correspondence. A retention policy already keeps everything on the site for three years and then deletes it. Signed agreements must now be kept for ten years, while drafts and correspondence must still be deleted after three. The contracts team decides which files are signed agreements. What should the administrator add?
Show answerHide answer
Answer: C
Why
Retention labels assign retention settings to individual items, and users can apply a published label by hand. Where a label and the site's policy both cover an item, the longest retention period wins, so each agreement the contracts team labels is kept for ten years while the rest of the library stays under the three-year policy.
Why not the others
AMicrosoft describes eDiscovery holds as preservation for a legal investigation with no configurable end date, and advises against using them for long-term data lifecycle management.
BA sensitivity label classifies and protects content; it does not set how long content is kept.
DA retention policy applies the same settings to everything on the site, so the drafts and correspondence would also be kept for ten years because the longest retention period wins.
Domain 3 / Task 3.3 Basic administrative tasks for agents
After a reorganization, dozens of agents built with Agent Builder have no owner because the people who created them left the company. The administrator wants to block the ownerless agents that nobody uses and to make each former creator's manager the owner of the other ownerless agents, without acting on each agent by hand. Which two actions in the Microsoft 365 admin center should the administrator take? Choose two.
Show answerHide answer
Answers: D and E
Why
Agent management rules apply governance actions to many agents in one run. Block ownerless agents without usage blocks the unused agents, and Reassign ownerless agents created with Agent Builder to manager transfers ownership to the previous owner's manager, based on the Microsoft Entra ID hierarchy. Agents become ownerless when their creator leaves the organization.
Why not the others
ASharing controls who can share Agent Builder agents with others; it does not block agents or change their owners.
BUser access controls which people can access and install agents across the organization; it does not act on ownerless agents.
CThis rule rejects old publish requests that are waiting for approval; it does not block or reassign agents that already exist.
Domain 3 / Task 3.1 Features and capabilities of Copilot and agents
A bank's compliance team allows Copilot in Teams meetings only when a transcript of the meeting is saved, so that Copilot's meeting summaries can be compared with a record of what was said. Meeting organizers must not be able to switch Copilot to a mode that works without a transcript. Which value should the Teams administrator choose for the Copilot setting in the meeting policy assigned to the bank's employees?
Show answerHide answer
Answer: A
Why
With On with saved transcript required, meetings created by organizers who have the policy get the Copilot option During and after the meeting, and organizers cannot change it, so Copilot is available once someone starts transcription. It is also the default value. The other values let organizers choose Only during the meeting, which relies on speech-to-text data that is not saved after the meeting ends.
Why not the others
BOrganizers start with During and after the meeting but can change it to Only during the meeting or Off.
COn makes Only during the meeting the organizers' default, which works without a transcript, and organizers can change the option.
DOff only sets the organizers' default to Off; they can still change it to Only during the meeting or During and after the meeting.
The study bundle has two practice exams with 100 original questions, an answer key and an explanation for every answer, plus the 52-page study guide. Practice exam explanations are shorter than the ones on this page: a short paragraph per question, with no source links.
Study bundle
$19
100 practice questions / Study guide / Answer keys
Every bundle includes 6 months of access: download the PDFs, and any new editions, until 6 months after your purchase date. Your receipt has a license key. Enter it at overqual.com/download for the three PDFs, stamped with your email and order number. They are yours to keep.