Microsoft AB-650 Dumps Questions Answers

Microsoft 365 Copilot relies on secure WebSocket (WSS) connections to support real-time, bidirectional communication between client applications and Microsoft cloud services.

Option A is correct because the reported Network connectivity insight specifically identifies WebSocket connection failures for hosts within *.cloud.microsoft.

Microsoft documentation explains that this insight occurs when a network device or web proxy prevents successful WebSocket connections. Administrators should configure the affected proxy to permit WebSocket protocol connections, including the HTTP-to-WebSocket upgrade process, for the required Microsoft 365 endpoints.

Because the problem affects only Branch1, the configuration should be applied to the Branch1 web proxy policy. This resolves the connectivity issue without changing policies for other offices.

Option B is incorrect because the reported failure concerns WebSocket connectivity, not DNS resolution or regional endpoint selection.

Option C is incorrect as the best answer because TLS inspection can interfere with WebSocket connections, but the scenario does not establish that TLS inspection is the cause. Exempting endpoints from TLS inspection may be appropriate after further diagnosis, but allowing the required WebSocket protocol directly addresses Microsoft ' s reported insight.

Option D is incorrect because standard HTTPS connectivity already succeeds. Allowing HTTPS alone does not guarantee successful WebSocket protocol upgrades.

Therefore, the Branch1 proxy must allow WSS connections to the required Microsoft 365 hosts.

Microsoft References:

Microsoft 365 Network Insights .

Review Microsoft 365 network connection failures and WebSocket errors .

Microsoft Entra Conditional Access evaluates applicable policies based on user and group membership, targeted resources, and access controls. It supports nested security groups, and exclusions take precedence over inclusions within the same policy.

Statement 1: Yes.

User2 is a B2B collaboration guest who does not belong to any groups. CA2 includes all users, including B2B guests, and excludes Group1 and Group3. Because User2 belongs to neither excluded group, CA2 applies and blocks access to Payroll.

Statement 2: Yes.

User1 belongs to Group2, which is nested within Group1. Microsoft Entra Conditional Access evaluates nested group memberships, so User1 is treated as a member of Group1. Consequently, CA1 applies and requires MFA. CA2 does not apply because User1 is indirectly included in its Group1 exclusion.

Statement 3: No.

User3 belongs directly to Group1 and Group3. Although CA1 includes Group1, it explicitly excludes Group3. The exclusion overrides the inclusion, meaning CA1 does not require MFA for User3.

CA2 also excludes both Group1 and Group3. Therefore, neither policy imposes an MFA requirement or blocks User3 ' s access.

These conclusions assume no additional Conditional Access policies or other authentication requirements apply.

Microsoft Agent 365 provides centralized governance of tools and Model Context Protocol (MCP) servers that AI agents use to access external services and organizational data.

Option D is correct because the Microsoft 365 admin center ' s Tools management interface enables administrators to block an individual MCP server without disabling the agent or unrelated MCP servers.

In this scenario, MCP2 is currently marked Available but has not completed its security review. Allowing agents to invoke MCP2 could expose procurement information before appropriate security controls have been validated.

Administrators can navigate to the Microsoft 365 admin center, select Agents → Tools → Registry, locate MCP2, and select Block.

Blocking MCP2 changes its availability and prevents agents from using the tools exposed by that server. MCP1 remains available because it is a separate MCP server, and Agent1 itself is not disabled.

Option A is incorrect because agent management rules do not provide the direct server-specific blocking action requested.

Option B is incorrect because the Agent Registry manages agents, whereas the Tools Registry provides MCP server controls.

Option C is incorrect because policy templates are not the direct mechanism for blocking an individual MCP server.

Therefore, blocking MCP2 from Tools satisfies the requirements.

Microsoft References:

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-plugins-skills-mcp-servers

https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-tools-overview