Microsoft Microsoft Certifications MS-203 Questions & Answers

• Question 241:

  Joni Sherman reports that the Microsoft Outlook client on her Windows 10 device fails to start.

  You need to troubleshoot the issue.

  From the device, you start the Microsoft Remote Connectivity Analyzer.

  What should you run next?

  A. the Exchange ActiveSync test

  B. the Outlook Connectivity test

  C. the Service Account Access test

  D. the Microsoft Support and Recovery Assistant for Office 365 client

  Correct Answer: D

  Reference: https://www.sherweb.com/blog/office-365/microsoft-support-and-recovery-assistant/

• Question 242:

  You need to ensure that Allan Deyoung can create a new public folder for the sales department. Which two actions should you perform first? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. Add Allan Deyoung to the Organization Management role group

  B. Create a new public folder mailbox

  C. Add Allan Deyoung to the Recipient Management role group

  D. Create a new shared mailbox

  E. Modify Sales Policy

  Correct Answer: AB

  Reference: https://docs.microsoft.com/en-us/exchange/permissions-exo/feature-permissions https://docs.microsoft.com/en-us/exchange/collaboration-exo/public-folders/set-up-public-folders

• Question 243:

  Allan Deyoung must perform a message trace of the email messages sent by Isaiah Langer and provide a report that contains all the messages sent during the last 30 days.

  You need to ensure that Allan Deyoung can perform the message trace.

  What should you do?

  A. Add Allan Deyoung to the Organization Management role group

  B. Add Allan Deyoung to the Security Administrator role group

  C. For Allan Deyoung, set ElcProcessingDisabled to true

  D. For Isaiah Langer, set ElcProcessingDisabled to true

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/exchange/permissions-exo/feature-permissions

• Question 244:

  You need to email a list of configuration changes to the Exchange Online environment that were recently performed by Allan Deyoung. What should you do?

  A. Run the admin audit log report

  B. Run the external admin audit log report

  C. Export the admin audit log

  D. Run an administrator role group report

  E. Export the mailbox audit logs

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/exchange/security-and-compliance/exchange-auditing-reports/exchange-auditing-reports

• Question 245:

  You have a Microsoft 365 subscription that contains a verified domain named contoso.com.

  You have an app named App1 that sends meeting invitations on behalf of users. The invitations are sent from a Microsoft Exchange Online mailbox that has a sender address of [email protected] and a reply-to address of the user

  scheduling the meeting.

  You create an anti-phishing policy named Policy1 that includes all the users in contoso.com. Policy1 is configured to protect the domain against impersonation.

  You discover that email messages sent from App1 are quarantined.

  You need to ensure that App1 can send messages that impersonate any contoso.com user.

  How should you modify Policy1?

  A. Add [email protected] as a trusted sender.

  B. Enable spoof intelligence.

  C. Add [email protected] as an excluded user.

  D. Enable mailbox intelligence.

  Correct Answer: C

  Explanation:

  Configure anti-phishing policies in Microsoft Defender for Office 365

  Exclude these users, groups, and domains: To add exceptions for the internal recipients that the policy applies to (recipient exceptions), select this option and configure the exceptions. The settings and behavior are exactly like the conditions.

  Note: Use the Set-AntiPhishPolicy cmdlet to modify antiphish policies in your cloud-based organization.

  Parameters include: -ExcludedSenders

  This setting is part of impersonation protection and is only available in Microsoft Defender for Office 365.

  The ExcludedSenders parameter specifies an exception for impersonation protection that looks for the specified message sender. You can specify multiple email addresses separated by commas.

  Reference:

  https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure

  https://learn.microsoft.com/en-us/powershell/module/exchange/set-antiphishpolicy

• Question 246:

  You have a Microsoft 365 subscription that contains two users named User1 and User2.

  User1 reports to have received a suspicious email message that appears to have come from User2.

  You identify that the message was sent by an external user impersonating User2.

  You need to block email that contains the email address of an impersonated sender.

  What should you configure?

  A. a Tenant Allow/Block Lists rule

  B. an anti-phishing policy

  C. an anti-spam policy

  D. an Enhanced filtering rule

  Correct Answer: A

  Explanation:

  You can use the Microsoft 365 Defender portal to create block entries for spoofed senders in the Tenant Allow/Block List.

  You can also use PowerShell to create block entries for spoofed senders in the Tenant Allow/Block List

  In Exchange Online PowerShell, use the following syntax:

  New-TenantAllowBlockListSpoofItems -Identity Default -Action Block -SpoofedUser -SendingInfrastructure -SpoofType

  This example creates a block entry for the sender [email protected] from the source 172.17.17.17/24.

  PowerShell

  New-TenantAllowBlockListSpoofItems -Identity Default -Action Allow -SendingInfrastructure Reference: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/tenant-allow-block-list-email-spoof-configure

• Question 247:

  You have a Microsoft Exchange Online tenant that uses Microsoft Defender for Office 365.

  You have a Safe Attachments policy named Policy1.

  You have a partner company that has an email domain named fabrikam.com.

  You need to prevent email messages received from fabrikam.com from being scanned by Policy1.

  What should you do?

  A. Add the fabrikam.com domain to the Tenant Allow/Block List.

  B. Create a mail flow rule and set the X-MS-Exchange-Organization-SkipSafeAttachmentProcessing header to 0.

  C. Create a new Safe Attachments policy and exclude the fabrikam.com domain.

  D. Create a mail flow rule and set the X-MS-Exchange-Organization-SkipSafeAttachmentProcessing header to 1.

  Correct Answer: C

  Explanation:

  Use the Microsoft 365 Defender portal to create Safe Attachments policies

  On the Users and domains page that appears, identify the internal recipients that the policy applies to.

  Exclude these users, groups, and domains: To add exceptions for the internal recipients that the policy applies to (recipient exceptions), select this option and configure the exceptions. The settings and behavior are exactly like the conditions.

  Reference:

  https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/safe-attachments-policies-configure

• Question 248:

  You have a Microsoft 365 E3 subscription that uses Microsoft Exchange Online.

  You need to ensure that Safe Links and Safe Attachments protection is enabled for users.

  What should you do?

  A. Enable the Strict protection preset security policy.

  B. Assign a Microsoft 365 E5 license to each user.

  C. Create an Enhanced Filtering for Connectors rule.

  D. Create an anti-malware policy and enable the common attachments filter.

  Correct Answer: A

  Explanation:

  Preset security policies in EOP and Microsoft Defender for Office 365

  Preset security policies provide a centralized location for applying all of the recommended spam, malware, and phishing policies to users at once. The policy settings are not configurable. Instead, they are set by us and are based on our

  observations and experiences in the datacenters for a balance between keeping harmful content away from users and avoiding unnecessary disruptions.

  Policies in preset security policies

  Preset security policies use the corresponding policies from the various protection features in EOP and Microsoft Defender for Office 365. These policies are created after you assign the Standard protection or Strict protection preset security

  policies to users. You can't modify the settings in these policies.

  Microsoft Defender for Office 365 policies: These policies are in organizations with Microsoft 365 E5 or Defender for Office 365 add-on subscriptions:

  *

  Safe Links policies named Standard Preset Security Policy, Strict Preset Security Policy, and Built-in Protection Policy.

  *

  Safe Attachments policies named Standard Preset Security Policy, Strict Preset Security Policy, and Built-in Protection Policy.

  *

  Anti-phishing policies in Defender for Office 365 named Standard Preset Security Policy and Strict Preset Security Policy, which include:

  The same spoof settings that are available in the EOP anti-phishing policies.

  Impersonation settings

  Note also:

  Exchange Online Protection (EOP) policies: These policies are in all Microsoft 365 organizations with Exchange Online mailboxes and standalone EOP organizations without Exchange Online mailboxes:

  Anti-spam policies named Standard Preset Security Policy and Strict Preset Security Policy.

  Anti-malware policies named Standard Preset Security Policy and Strict Preset Security Policy.

  Anti-phishing policies (spoofing protection) named Standard Preset Security Policy and Strict Preset Security Policy (spoof settings).

  Incorrect:

  Not B: To use Safe Links and Safe Attachments, one must have Microsoft 365 Advanced Threat Protection Plan 1 or 2.

  Reference: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/preset-security-policies

• Question 249:

  You have a Microsoft Exchange Online tenant that contains a mailbox named Sales.

  You need to create a copy of all the external email sent from the Sales mailbox to an alternate location.

  What should you create?

  A. a journaling rule

  B. a retention policy

  C. a records management file plan

  D. a data loss prevention (DLP) policy

  Correct Answer: A

  Explanation:

  Journaling in Exchange Online

  When possible, we recommend that you use Microsoft 365 retention to archive and manage data in-place to meet your compliance requirements. However, some organizations might need to use a third-party solution to receive a copy of

  emails for storage or other scenarios. Configure journaling to store that data outside Exchange.

  Journal rules

  The following are key aspects of journal rules:

  Journal rule scope: Defines which messages are journaled by the Journaling agent.

  Journal recipient: Specifies the SMTP address of the recipient you want to journal.

  Journaling mailbox: Specifies one or more mailboxes used for collecting journal reports.

  Incorrect:

  *

  a retention policy

  Managing content commonly requires two actions:

  *

  Retain content

  Prevent permanent deletion and remain available for eDiscovery

  *

  Delete content

  Permanently delete content from your organization

  With these two retention actions, you can configure retention settings for the following outcomes:

  Retain-only: Retain content forever or for a specified period of time.

  Delete-only: Permanently delete content after a specified period of time.

  Retain and then delete: Retain content for a specified period of time and then permanently delete it.

  These retention settings work with content in place that saves you the additional overheads of creating and configuring additional storage when you need to retain content for compliance reasons. In addition, you don't need to implement

  customized processes to copy and synchronize this data.

  Reference: https://learn.microsoft.com/en-us/exchange/security-and-compliance/journaling/journaling https://learn.microsoft.com/en-us/microsoft-365/compliance/retention

• Question 250:

  You have a Microsoft 365 subscription.

  A safe attachments policy that uses Dynamic Delivery is applied to all recipients who match your SMTP domains.

  You need to prevent attachments from being scanned when internal users send email to one another.

  What should you do?

  A. From the Exchange admin center, create a transport rule.

  B. From the Exchange admin center, modify the malware filter.

  C. From Microsoft 365 Defender, modify the safe attachments policy.

  D. From the Microsoft Purview compliance portal, modify the Compliance Manager settings.

  Correct Answer: A

  Explanation:

  Create a transport rule (or mail flow rule as they are called nowadays) to configure the message header: X-MS-Exchange-Organization-SkipSafeAttachmentProcessing.

  Reference: https://docs.microsoft.com/en-gb/archive/blogs/office365labs/eo-atp-considerations-reports-demonstrations