Microsoft Microsoft Certifications MS-203 Questions & Answers

• Question 11:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a hybrid deployment between a Microsoft Exchange Online tenant and an on-premises Exchange Server 2019 organization. The deployment uses Azure AD Connect. All incoming email is delivered to Exchange Online.

  You have 10 mail-enabled public folders hosted on an on-premises Mailbox server.

  Customers receive an error when an email message is sent to a public folder.

  You need to ensure that all the mail-enabled public folders can receive email messages from the internet. The solution must ensure that messages can be delivered only to valid recipients.

  Solution: Configure the accepted domains as an internal relay.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: Solution: Run the Sync-MailPublicFolder.ps1 script.

  Note: Configure Exchange Server public folders for a hybrid deployment

  In a hybrid deployment, your users can be in Exchange Online, on-premises, or both, and your public folders are either in Exchange Online or on-premises. Sometimes your online users may need to access public folders in your Exchange

  Server on-premises environment.

  An Exchange Online, Microsoft 365, or Office 365 user must be represented by a MailUser object in the Exchange on-premises environment in order to access Exchange Server public folders. This MailUser object must also be local to the

  target Exchange Server public folder hierarchy.

  Solution:

  Step 1: Download the scripts

  Step 2: Synchronize mail-enabled public folder objects to Exchange Online

  Step 3: Configure Exchange Online users to access Exchange Server on-premises public folders

  Step 1: Download the scripts

  Download the following files from Exchange 2013/2016 Public Folders Migration Scripts:

  Sync-ModernMailPublicFolders.ps1

  SyncModernMailPublicFolders.strings.psd1

  Step 2: Synchronize mail-enabled public folder objects to Exchange Online

  Azure AD Connect sync doesn't synchronize mail-enabled public folders to Exchange Online. Running the following script will synchronize the mail-enabled public folders across your on-premises environment and Exchange Online. On the Exchange server, run the following command in the Exchange Management Shell to synchronize mail-enabled public folders from your local on-premises Active Directory to Office 365: PowerShell .\Sync-ModernMailPublicFolders.ps1 -CsvSummaryFile:sync_summary.csv Reference: https://learn.microsoft.com/en-us/exchange/hybrid-deployment/set-up-modern-hybrid-public-folders

• Question 12:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft Exchange Online tenant that contains 1,000 users.

  A user named User1 receives a non-delivery report (NDR) when attempting to send an email message to an internal group named [email protected]. The NDR contains the following text: “5.7.1 Delivery not authorized.”

  You need to ensure that User1 can send email to [email protected] successfully.

  Solution: You instruct User1 to reduce the size of the email message.

  A. Yes

  B. No

  Correct Answer: B

• Question 13:

  You have a hybrid deployment between a Microsoft Exchange Online tenant and an Exchange Server 2019 organization.

  You need to enable journaling for outbound email.

  Where can you store the journal reports?

  A. an Exchange Server 2019 mailbox

  B. a mail-enabled public folder

  C. an Exchange Online mailbox

  D. a Microsoft SharePoint Online document library

  Correct Answer: B

• Question 14:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Exchange Online tenant that contains 2,000 mailboxes.

  A partner company named Fabrikam, Inc. uses a third-party messaging solution. The outbound SMTP server for Fabrikam uses an IP address of 131.107.2.22.

  You discover that several email messages from the fabrikam.com domain are erroneously marked as spam.

  You need to ensure that all the email messages sent from the fabrikam.com domain are delivered successfully to the user mailboxes of your company.

  Solution: You enable a DKIM signature.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  DKIM signature is used as protection from spoofing, not as spam protection.

  DKIM will not stop SPAM, but it will force spammers to use their own email addresses, instead of forged ones. It will stop them from stealing your email address to send email purporting to be from you.

  Note: Exchange Online Protection (EOP) and Exchange Online both support inbound validation of Domain Keys Identified Mail (DKIM) messages.

  DKIM validates that an email message wasn't spoofed by someone else, and was sent from the domain it says it came from. It ties an email message to the organization that sent it. DKIM verification is used automatically for all messages

  sent with IPv6. Microsoft 365 also supports DKIM when mail is sent over IPv4.

  DKIM validates a digitally signed message that appears in the DKIM-Signature header of the message headers. The results of a DKIM-Signature validation are stamped in the Authentication-Results header. The message header text appears

  similar to the following (where contoso.com is the sender):

  Authentication-Results: ; dkim=pass (signature was verified) header.d=example.com;

  Reference: https://luxsci.com/blog/7-common-misconceptions-about-dkim-in-the-fight-against-spam.html

  https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/support-for-validation-of-dkim-signed-messages?view=o365-worldwide

• Question 15:

  You have a Microsoft Exchange Online tenant that contains public folders.

  You need to search all the public folders for items that contain product codes. Users must NOT be able to delete items identified in the search.

  What should you do?

  A. From the Exchange admin center, create a mail flow rule.

  B. From the Exchange admin center, start a message trace.

  C. From the Microsoft 365 compliance center, configure an eDiscovery case.

  D. From the Microsoft 365 compliance center, configure Endpoint data loss prevention (Endpoint DLP).

  Correct Answer: C

• Question 16:

  Your company has the offices and subnets shown in the following table.

  

  Each office has an IT department.

  You have a Microsoft Exchange Online tenant.

  You need to ensure that only users in the IT department who sign in from the London office can access the Exchange admin center.

  What should you use?

  A. a Conditional Access policy

  B. named locations

  C. a client access rule

  D. a custom role group

  Correct Answer: B

  Named locations

  Locations are named in the Azure portal under Azure Active Directory > Security > Conditional Access > Named locations. These named network locations may include locations like an organization's headquarters network ranges, VPN

  network ranges, or ranges that you wish to block. Named locations can be defined by IPv4/IPv6 address ranges or by countries.

  Incorrect:

  Not A: First define a named location, then use it in a Conditional Access policy.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

• Question 17:

  You have a Microsoft Exchange Online tenant that has a verified domain named contoso.com.

  From the Azure Active Directory admin center, you invite a new guest user named user1 @fabrikam.com.

  You need to ensure that you can send email to User1 by selecting the name of the user from the global address list (GAL).

  What should you do?

  A. From the Exchange admin center, create a mail contact.

  B. From the Azure Directory admin center, modify the Proxy address attribute of User1.

  C. From the Microsoft 365 admin center, assign an Exchange Online license to User1.

  D. From Exchange Online PowerShell, run the Set-User cmdlet.

  E. From Exchange Online PowerShell, run the Set-MailUser cmdlet.

  Correct Answer: A

• Question 18:

  You plan to use the Microsoft Office 365 Import service to import PST files.

  You need to create a new user account to perform the import. The solution must use the principle of least privilege.

  Which two roles should you assign to the user account? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. the Mailbox Import Export role in Exchange Online

  B. the Global reader role in Azure Active Directory (Azure AD)

  C. the Organization Management role group in Exchange Online

  D. the Global administrator role in Microsoft 365

  E. the Recipient Management role group in Exchange Online

  Correct Answer: AD

  You have to be assigned the Mailbox Import Export role in Exchange Online to import PST files to Microsoft 365 mailboxes. Additionally, to create import jobs in the Microsoft 365 compliance center, one of the following must be true:

  *

  You have to be a global administrator in your organization.

  *

  Etc.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/importing-pst-files-to-office-365

• Question 19:

  You have a Microsoft 365 subscription that uses a default domain named contoso.com.

  Users report that email messages from a domain named fabrikam.com are identified as spam even though the messages are legitimate.

  You need to prevent messages from fabrikam.com from being identified as spam.

  What should you do?

  A. Create a new remote domain.

  B. Edit a spam filter policy.

  C. Enable the safe list on a connection filter.

  D. Enable the Zero-hour auto purge (ZAP) email protection feature.

  Correct Answer: C

  Safe list: The safe list is a dynamic allow list in the Microsoft datacenter that requires no customer configuration. Microsoft identifies these trusted email sources from subscriptions to various third-party lists. You enable or disable the use of the safe list; you can't configure the source email servers on the safe list. Spam filtering is skipped on incoming messages from the email servers on the safe list.

  Incorrect:

  *

  Remote Domains are an organizational setting that allow you to control certain message types such as “Out of Office” and “Non-Delivery Reports”.

  *

  In Microsoft 365 organizations with mailboxes in Exchange Online, zero-hour auto purge (ZAP) is an email protection feature that retroactively detects and neutralizes malicious phishing, spam, or malware messages that have already been delivered to Exchange Online mailboxes.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-the-connection-filter-policy?view=o365-worldwide

• Question 20:

  You have a Microsoft Exchange Online tenant that contains a user named User1.

  User1 needs to be able to search mailboxes and purge email.

  To which role group should you add User1?

  A. eDiscovery Manager

  B. Organization Management

  C. Compliance Data Administrator

  D. Security Administrator

  Correct Answer: B

  To delete messages, you have to be a member of the Organization Management role group or be assigned the Search And Purge role in the compliance center.

  Incorrect:

  Not A: To create and run a Content search, you have to be a member of the eDiscovery Manager role group or be assigned the Compliance Search role in the Microsoft 365 compliance center.

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-and-delete-messages-in-your-organization?view=o365-worldwide