MS-203: Microsoft 365 Messaging — Questions and Answers

Question 1: A user receives a Non-Delivery Report (NDR) with the enhanced status code '5.7.1'. Which of the following is the most common reason for this type of NDR?

The recipient's mailbox is full.
A temporary network issue occurred on the receiving server.
The recipient's email address does not exist.
The message was rejected due to a permissions issue or a mail flow rule. (Correct answer)

Correct answer: The message was rejected due to a permissions issue or a mail flow rule.

The status code '5.7.1' typically indicates that delivery is not authorized. This can happen for several reasons, such as the sender not having permission to send to a specific recipient or distribution group, or a mail flow (transport) rule is configured to block the message.

Question 2: Your organization has a hybrid Exchange environment with mailboxes both on-premises and in Exchange Online. You need to ensure that all outbound email from Exchange Online to your on-premises servers is encrypted using TLS. Which of the following is the BEST way to achieve this?

Create a mail flow rule to require TLS for messages sent to the on-premises domain.
Create an outbound connector from Office 365 to your organization's email server and enforce TLS. (Correct answer)
Configure a remote domain for the on-premises environment to require TLS.
Enable STARTTLS on the on-premises Receive connector.

Correct answer: Create an outbound connector from Office 365 to your organization's email server and enforce TLS.

Connectors are specifically designed to manage mail flow between Microsoft 365 and external environments, such as on-premises servers or partner organizations. When creating an outbound connector, you can enforce the use of Transport Layer Security (TLS) to secure the connection, which is the most direct and appropriate method for this requirement.

Question 3: A legal department needs to preserve all emails pertaining to an internal investigation codenamed "Project Falcon" for an indefinite period. The data is spread across multiple users' mailboxes. What is the most precise and efficient method in Microsoft Purview to accomplish this?

Create a retention policy that retains all content in Exchange for an indefinite period.
Create a Microsoft Purview eDiscovery (Standard) case, and create a hold associated with the case using the keyword "Project Falcon". (Correct answer)
Place the mailboxes of all involved users on Litigation Hold.
Instruct users to apply a "Legal Hold" retention label to all content related to "Project Falcon".

Correct answer: Create a Microsoft Purview eDiscovery (Standard) case, and create a hold associated with the case using the keyword "Project Falcon".

Using a hold associated with a Microsoft Purview eDiscovery case is the most precise method. It allows an administrator to define a query-based hold (e.g., using the keyword "Project Falcon") that preserves only the specific content matching the criteria across specified mailboxes. This avoids placing a broad hold on all content for the users, which is what Litigation Hold would do. Relying on users to apply labels is inefficient and prone to error.

Question 4: How do you disable automapping for a shared mailbox so it does not automatically appear in Outlook?

Remove-MailboxPermission -AutoMapping
Set-Mailbox -AutoMapping $false
Add-MailboxPermission with -AutoMapping $false (Correct answer)
Set-MailboxPermission -DisableAutoMap

Correct answer: Add-MailboxPermission with -AutoMapping $false

Adding the FullAccess permission with the -AutoMapping $false parameter prevents the shared mailbox from being auto-mapped in Outlook.

Question 5: What is the fundamental difference between applying a Microsoft Purview retention policy to a location versus applying a retention label to an item?

A retention policy applies to all items within a container, like a mailbox or site, while a retention label is applied to an individual item, like an email or document. (Correct answer)
A retention label can only delete content, whereas a retention policy can both retain and delete content.
A retention label is a legacy feature that has been replaced by retention policies.
A retention policy requires end-user interaction to be applied, while a retention label is always applied automatically.

Correct answer: A retention policy applies to all items within a container, like a mailbox or site, while a retention label is applied to an individual item, like an email or document.

A retention policy sets a default retention or deletion action for all content within a specified location, such as an entire Exchange mailbox. A retention label, however, is a tag applied to an individual item (email, document) that can override the container's default policy, and can be applied manually by users or automatically based on conditions.

Question 6: An administrator has just installed a new Exchange Server 2019 and needs to configure all the client-facing virtual directories, such as OWA, ECP, and ActiveSync, to use the public namespace 'mail.contoso.com'. Which of the following is the most efficient method to update the internal and external URLs for multiple virtual directories at once?

Editing the Active Directory Schema to change the default URL values.
Modifying the host headers directly in Internet Information Services (IIS) Manager.
Manually editing the settings for each virtual directory in the Exchange Admin Center (EAC).
Using a PowerShell script that iterates through the virtual directories and runs the appropriate Set-*VirtualDirectory cmdlets. (Correct answer)

Correct answer: Using a PowerShell script that iterates through the virtual directories and runs the appropriate Set-*VirtualDirectory cmdlets.

While you can configure each virtual directory URL individually through the EAC or with separate `Set-*VirtualDirectory` cmdlets, using a PowerShell script is the most efficient and least error-prone method for updating multiple virtual directories at once. Scripts can set both InternalUrl and ExternalUrl properties consistently across services like OWA, ECP, EWS, ActiveSync, etc.

Question 7: Your company uses a third-party anti-spam service. The service filters all inbound mail and then forwards it to your Exchange Online tenant. You notice that legitimate emails from this service are sometimes being incorrectly marked as spam by Exchange Online Protection (EOP). Which of the following is the most effective way to prevent EOP from filtering mail that has already been scanned by the trusted third-party service?

Add the service's domain to the safe senders list in the anti-spam policy.
Configure Enhanced Filtering for Connectors (Skip Listing) on the inbound connector from the service.
Create a mail flow rule to set the SCL to -1 for messages from the service's IP addresses. (Correct answer)
Create a remote domain for the third-party service and disable spam filtering.

Correct answer: Create a mail flow rule to set the SCL to -1 for messages from the service's IP addresses.

Creating a mail flow rule to set the Spam Confidence Level (SCL) to -1 (Bypass spam filtering) for messages originating from the trusted service's IP addresses is the standard and recommended method. This tells EOP to trust the verdict of the upstream filter and deliver the message without further spam scanning.

Question 8: How can an administrator configure a Microsoft 365 Group so that external users can be invited to collaborate?

Set-UnifiedGroup -RequireSenderAuthenticationEnabled $false and configure Azure AD B2B settings (Correct answer)
Set-UnifiedGroup -AllowExternalSenders $true
Set-OrganizationConfig -ExternalGroupMembershipEnabled $true
Set-MailboxFolderPermission -AccessRights PublishingEditor

Correct answer: Set-UnifiedGroup -RequireSenderAuthenticationEnabled $false and configure Azure AD B2B settings

Allowing external collaboration requires setting RequireSenderAuthenticationEnabled to $false on the group AND ensuring Azure AD external collaboration (B2B) settings allow guest invitations.

Question 9: A mail flow rule with priority 0 is configured to bypass spam filtering for messages from a specific partner domain and has the 'Stop processing more rules' action enabled. A second rule with priority 1 is configured to prepend '[EXTERNAL]' to the subject of all messages received from outside the organization. Why would an email from the partner domain NOT have the '[EXTERNAL]' subject tag?

The 'Stop processing more rules' action on the priority 0 rule prevented the priority 1 rule from being evaluated. (Correct answer)
Mail flow rules cannot modify the subject line of a message.
The priority 1 rule has a syntax error and is being skipped.
A spam filter action always takes precedence over a subject line modification.

Correct answer: The 'Stop processing more rules' action on the priority 0 rule prevented the priority 1 rule from being evaluated.

Mail flow rules are processed in order of priority, starting with 0. When a message matches the conditions of the priority 0 rule, the rule's actions are applied. Because the 'Stop processing more rules' action is enabled on this rule, Exchange Online halts any further rule evaluation for that message. Therefore, the priority 1 rule is never processed for that email.

Question 10: Upon inspecting the headers of a failed email, a messaging administrator sees the authentication result 'dkim=fail (body hash did not verify)'. The sender has confirmed their DKIM public key is correct in DNS. What is the most likely cause for this specific failure?

The CNAME records for DKIM are pointing to the wrong location.
The DKIM private key used to sign the message is corrupted.
The message body was altered in transit after it was signed. (Correct answer)
The recipient's mail server does not support DKIM verification.

Correct answer: The message body was altered in transit after it was signed.

The 'body hash did not verify' error specifically means that the receiving server was able to retrieve the public key from DNS but that the hash of the message body it calculated does not match the hash value stored in the DKIM signature. This is most often caused by an intermediate system (like a gateway or mailing list server) altering the message content, such as by adding a disclaimer, after the original DKIM signature was applied.

Question 11: An administrator is running the Hybrid Configuration Wizard (HCW) to connect their on-premises Exchange organization to Exchange Online. They need to decide between 'Classic' and 'Modern' hybrid topology. What is the key advantage of choosing Modern Hybrid?

It does not require any inbound network connections from the internet to the on-premises Exchange servers. (Correct answer)
It provides more granular control over mail flow routing.
It is the only option that supports public folder migration.
It supports integration with third-party identity providers.

Correct answer: It does not require any inbound network connections from the internet to the on-premises Exchange servers.

Modern Hybrid uses the Hybrid Agent, which removes the requirement to publish on-premises Exchange Client Access Servers to the internet. The agent establishes an outbound connection to Exchange Online, simplifying the network and firewall configuration and enhancing security by not requiring inbound HTTPS connections for features like free/busy and mailbox moves.

Question 12: What type of information can be read from an email header?

Routing and security data (Correct answer)
Chat history
Calendar events
Files shared

Correct answer: Routing and security data

An email header contains crucial metadata about an email message, providing a detailed history of its journey from sender to recipient. This information includes routing details like the mail servers it passed through, sender and recipient IP addresses, and timestamps. It also contains security-related data such as authentication results (SPF, DKIM, DMARC), spam scores, and anti-malware scan results, which are vital for troubleshooting delivery issues and investigating security incidents.

Question 13: An administrator wants to prevent users from creating Microsoft 365 Groups unless they belong to a specific security group. Which PowerShell cmdlet should be used?

Set-OrganizationConfig -DefaultGroupAccessType
Set-AzureADDirectorySetting (Correct answer)
Set-UnifiedGroup -AccessType Private
Set-MsolCompanySettings

Correct answer: Set-AzureADDirectorySetting

Set-AzureADDirectorySetting (or its Microsoft Graph equivalent) is used to configure the GroupCreationAllowedGroupId setting that restricts Microsoft 365 Group creation to members of a specified security group.

Question 14: An email message containing a previously unknown malware variant was delivered to several users' inboxes because it was not detected by the initial real-time scans. A few hours later, Microsoft's threat intelligence services are updated with a signature for this new threat. Which Exchange Online Protection feature retroactively removes the malicious message from the user inboxes?

Connection filtering
Zero-hour auto purge (ZAP) (Correct answer)
Safe Links time-of-click verification
Dynamic Delivery

Correct answer: Zero-hour auto purge (ZAP)

Zero-hour auto purge (ZAP) is an Exchange Online Protection feature that detects and neutralizes malicious spam, phishing, and malware messages that have already been delivered to mailboxes. If a post-delivery scan determines a message is malicious, ZAP will move it to the junk folder or quarantine.

Question 15: An administrator needs to configure mail flow for a newly added domain, `subsidiary.contoso.com`. The company's primary email domain is `contoso.com`. Some mailboxes for the new domain exist in Exchange Online, while others are still on a non-Exchange on-premises server. Email for any non-existent user at `subsidiary.contoso.com` should be routed to the on-premises server. What type of accepted domain should be configured for `subsidiary.contoso.com`?

Authoritative
Internal Relay (Correct answer)
External Relay
Non-Authoritative

Correct answer: Internal Relay

An Internal Relay (or Non-Authoritative) domain is used when recipients for that domain may exist in Exchange Online or on an external email system. Exchange Online will first check for a recipient in its own directory. If the recipient is not found, it will relay the email to the other email system, which is configured via a connector.

Question 16: Which of the following RBAC components is the fundamental building block that defines a logical grouping of specific cmdlets and their parameters that can be run?

Management Role Scope
Management Role Assignment
Management Role (Correct answer)
Management Role Group

Correct answer: Management Role

A Management Role is a collection of management role entries. Each entry consists of a specific cmdlet (e.g., New-Mailbox) and the parameters that can be used with it. Role Groups are collections of these roles, and Scopes define where they can be applied.

Question 17: Your organization has configured an outbound connector to route all outgoing mail through a third-party cloud archiving service. Shortly after, you receive reports that external recipients are not receiving your emails, and bounce messages indicate an SPF failure. What is the most likely cause of this issue?

The organization's public SPF record in DNS has not been updated to include the third-party service. (Correct answer)
The third-party service does not support TLS encryption.
The organization's MX record is pointing to the wrong service.
The outbound connector in Exchange Online is disabled.

Correct answer: The organization's public SPF record in DNS has not been updated to include the third-party service.

When you route outbound mail through a third-party service (a smart host), the final server that sends the message to the internet is no longer Microsoft 365, but the third-party service. The recipient's mail server will check the sender's SPF record to see if the IP address of that third-party service is authorized to send email for your domain. If the SPF record is not updated to include the third-party service's sending servers, the check will fail.

Question 18: Which cmdlet initiates a remote wipe of a mobile device from Exchange Online PowerShell?

Clear-MobileDevice (Correct answer)
Remove-MobileDevice -Wipe
Invoke-MobileDeviceWipe
Set-MobileDevice -Wipe

Correct answer: Clear-MobileDevice

Clear-MobileDevice sends a remote wipe command to a registered mobile device in Exchange Online.

Question 19: An administrator needs to investigate reports of intermittent, widespread email delays within the last 24 hours. They need a high-level, aggregated view of mail flow, including the status of connectors and any messages that are queued or deferred. Which tool in the Exchange admin center provides the best starting point for this type of investigation?

Message Trace
Non-delivered reports
Mail flow reports under 'Reports'
Mail flow dashboard (Correct answer)

Correct answer: Mail flow dashboard

The Mail flow dashboard in the modern Exchange admin center is designed to give administrators a quick, high-level overview of mail flow health. It includes insights into mail flow trends, connector status, queued messages, and auto-forwarding activity, making it the ideal starting point for diagnosing widespread, systemic issues like general delays rather than searching for a single message.

Question 20: A messaging administrator is configuring an anti-phishing policy in Microsoft Defender for Office 365 to protect senior executives from spear-phishing and whaling attacks. Which specific feature allows the administrator to define a list of high-profile users to protect from attacks where the sender's display name and address mimic the user?

First contact safety tip
Impersonation protection (Correct answer)
Spoof intelligence
Mailbox intelligence

Correct answer: Impersonation protection

Impersonation protection, a feature within Defender for Office 365 anti-phishing policies, is designed to combat spear-phishing and whaling. It allows administrators to explicitly define a list of 'protected users' (like executives) and 'protected domains' to detect and act on messages where attackers try to impersonate these specific entities.

Question 21: A user's mailbox is placed on Litigation Hold. The user performs several actions within their Outlook client. Which of the following user actions results in a copy of the original item being preserved in the Recoverable Items folder?

Editing the subject line of a received email and saving the change. (Correct answer)
Reading an unread email.
Creating a new draft email but never sending it.
Assigning a category to an email.

Correct answer: Editing the subject line of a received email and saving the change.

Litigation Hold uses a copy-on-write mechanism to preserve data. When a user attempts to change or delete a mailbox item, a copy of the original, unmodified item is saved in the Recoverable Items folder before the change is committed. Editing the subject of an email is a modification of the item, which triggers the copy-on-write process to preserve the original version. Actions like categorizing or reading an email only change metadata and do not trigger this preservation.

Question 22: A user clicks a link in an email that has been processed by a Microsoft Defender Safe Links policy. The URL in the browser's address bar starts with `https://nam01.safelinks.protection.outlook.com`. What is the primary function of this URL rewriting?

To check the destination URL against a blocklist and scan its content for threats at the time of the click. (Correct answer)
To translate the website content into the user's default language.
To add the original website to the user's trusted sites list.
To ensure the link can only be clicked once by the recipient.

Correct answer: To check the destination URL against a blocklist and scan its content for threats at the time of the click.

Safe Links rewrites URLs in inbound emails. When a user clicks the rewritten link, Microsoft Defender for Office 365 checks the original destination against a dynamic list of malicious sites. It also performs a real-time scan of the destination content for suspicious behavior. This 'time-of-click' verification protects users from links that appear safe on delivery but are later weaponized.

Question 23: What is a primary advantage of shared mailboxes over public folders for team email in Microsoft 365?

Shared mailboxes support calendar items; public folders do not
Shared mailboxes allow larger item sizes
Shared mailboxes do not require an additional license for up to 50 GB (Correct answer)
Shared mailboxes support nested folder hierarchies better

Correct answer: Shared mailboxes do not require an additional license for up to 50 GB

Shared mailboxes up to 50 GB do not require an assigned license, making them cost-effective for team collaboration.

Question 24: Which parameter in a mobile device mailbox policy requires that the device encrypt locally stored data?

-EnforceEncryption
-RequireEncryption
-RequireDeviceEncryption (Correct answer)
-StorageEncryption

Correct answer: -RequireDeviceEncryption

The -RequireDeviceEncryption parameter enforces storage encryption on mobile devices accessing Exchange Online.

Question 25: A junior administrator needs the ability to create and manage mailboxes, distribution groups, and mail contacts. However, according to the principle of least privilege, they should not be able to configure transport rules or other organization-wide settings. Which built-in management role group in Exchange Online is most appropriate for this administrator?

Organization Management
Help Desk
Recipient Management (Correct answer)
View-Only Organization Management

Correct answer: Recipient Management

The 'Recipient Management' role group contains roles that grant permissions to create and manage Exchange recipient objects like mailboxes, distribution groups, and contacts. The 'Organization Management' group has far too many permissions, 'View-Only' doesn't allow changes, and 'Help Desk' is more limited, typically for tasks like resetting user passwords.

Question 26: An administrator needs to configure a conference room mailbox to automatically accept meeting requests from a specific group of users (Project Managers) but require a delegate's approval for all other requests. Which settings should the administrator configure?

Set 'Accept or decline booking requests automatically' and configure the 'BookInPolicy' parameter in PowerShell with the Project Managers group. (Correct answer)
Configure the 'AllBookInPolicy' parameter to $false and the 'BookInPolicy' parameter to the Project Managers group using PowerShell.
Configure 'Select delegates who can accept or decline booking requests' and specify the Project Managers group.
Set 'Accept or decline booking requests automatically' and configure 'Request in-policy' in the booking delegates settings.

Correct answer: Set 'Accept or decline booking requests automatically' and configure the 'BookInPolicy' parameter in PowerShell with the Project Managers group.

To meet this requirement, the room mailbox should be set to process requests automatically. The 'BookInPolicy' parameter, configured via PowerShell, specifies which users or groups are allowed to book the resource automatically without delegate approval. All other requests will be forwarded to the delegate.

Question 27: What is the primary purpose of a Management Role Assignment Policy in Exchange Online?

To define the scope of influence for a management role group (e.g., a specific OU).
To grant end-users permissions to configure settings on their own mailboxes and owned distribution groups. (Correct answer)
To assign administrative permissions for managing the entire Exchange organization.
To link management roles to specific cmdlets in PowerShell.

Correct answer: To grant end-users permissions to configure settings on their own mailboxes and owned distribution groups.

Management Role Assignment Policies are used to control what settings end-users can modify on their own mailboxes, such as editing their profile information or managing distribution groups they own. They are distinct from the management role groups that assign permissions to administrators.

Question 28: A user reports they can read emails in a shared mailbox but cannot delete items. Which permission is missing?

ExternalAccount
DeleteItems
SendAs
FullAccess (Correct answer)

Correct answer: FullAccess

FullAccess permission is required to delete items in a shared mailbox; read-only access does not include deletion rights.

Question 29: Which of the following permissions allows a delegate to send an email that appears to come directly from another user's mailbox, with no indication that it was sent by a delegate?

Full Access
Send As (Correct answer)
Read and Manage
Send on Behalf

Correct answer: Send As

The 'Send As' permission allows a delegate to send messages that appear to have been sent directly by the mailbox owner. The 'From:' line will show the mailbox owner's email address only. 'Send on Behalf' includes both the delegate's and the owner's names in the 'From:' line.

Question 30: A user has been granted Full Access permission to a shared mailbox. However, when they open Outlook, the shared mailbox does not automatically appear in their folder pane. What is the most likely reason for this issue?

The shared mailbox is hidden from the Global Address List (GAL).
The user needs to be a member of the Recipient Management role group.
The user was granted permission via a mail-enabled security group. (Correct answer)
The Send As permission was not also granted to the user.

Correct answer: The user was granted permission via a mail-enabled security group.

The auto-mapping feature in Exchange Online, which automatically adds mailboxes to a user's Outlook profile, only works for individual users who are directly granted Full Access permission. It does not work when permissions are granted via any type of group, including a mail-enabled security group.

Question 31: An organization wants to give users the ability to release messages quarantined as 'Spam' but prevent them from releasing messages quarantined as 'High-confidence phish'. Users should only be able to request the release of high-confidence phish messages for an administrator to review. Where must this granular control be configured?

In a mail flow rule
In the Tenant Allow/Block List
In the Anti-spam policy actions
In a Quarantine policy (Correct answer)

Correct answer: In a Quarantine policy

Quarantine policies define what actions users can take on their own quarantined messages, based on the reason the message was quarantined (e.g., spam, bulk, phish, malware). An administrator can create custom quarantine policies to grant different permission levels, such as allowing release for spam but only allowing 'request release' for high-confidence phish.

Question 32: How can you prevent users from sending emails directly from a shared mailbox rather than 'on behalf of' it?

Set-Mailbox -HiddenFromAddressListsEnabled $true
Set-Mailbox -MessageCopyForSendOnBehalfEnabled $false
Remove the SendAs permission (Correct answer)
Remove the FullAccess permission

Correct answer: Remove the SendAs permission

Removing the SendAs permission prevents users from sending as the shared mailbox identity directly.

Question 33: What tool can administrators use to manage users and licenses?

Microsoft 365 admin center (Correct answer)
Microsoft Teams
PowerPoint
Excel

Correct answer: Microsoft 365 admin center

The Microsoft 365 admin center is the primary portal for administrators to manage their entire Microsoft 365 subscription. This includes creating and managing user accounts, assigning and revoking licenses for various Microsoft 365 services, managing groups, and overseeing billing and service health. It serves as the central hub for tenant administration.

Question 34: What feature helps prevent users from sending sensitive data?

App locker
Anti-virus settings
Data Loss Prevention (Correct answer)
Backup policies

Correct answer: Data Loss Prevention

Data Loss Prevention (DLP) policies in Microsoft 365 are designed to identify, monitor, and protect sensitive information from being accidentally or intentionally shared outside the organization. DLP can detect specific types of sensitive data (e.g., credit card numbers, social security numbers) in emails and documents, then block or warn users before the data leaves the secure environment.

Question 35: A user reports to the messaging administrator that an important email sent to an external partner was never received. The partner's IT team insists the message never reached their mail servers. Which tool should the administrator use FIRST to determine the final delivery status of the message from the Microsoft 365 perspective?

Message trace in the Exchange admin center (Correct answer)
Mail flow dashboard in the Exchange admin center
Microsoft Defender 365 audit log
Service Health dashboard in the Microsoft 365 admin center

Correct answer: Message trace in the Exchange admin center

Message trace is the primary tool for following email messages as they travel through a Microsoft 365 organization. It allows an administrator to see if a message was received, rejected, deferred, or delivered by the service, and to view the detailed events that occurred for that message. This is the most direct and effective first step for troubleshooting a specific missing email.

Question 36: What does MFA stand for in Microsoft 365?

Mail Folder Analytics
Microsoft File Archive
Message File Access
Multi-Factor Authentication (Correct answer)

Correct answer: Multi-Factor Authentication

MFA stands for Multi-Factor Authentication, a security method that requires users to provide two or more verification factors to gain access to an account. This typically combines something the user knows (like a password) with something they have (like a phone or a token) or something they are (like a fingerprint). MFA significantly enhances security by making it much harder for unauthorized individuals to compromise an account, even if they obtain one factor.

Question 37: Which of the following components in Exchange Online is used to control settings for messages sent TO external domains, such as managing out-of-office replies, delivery reports, and message formatting like TNEF (winmail.dat)?

Mail Flow Rules
Connectors
Remote Domains (Correct answer)
Accepted Domains

Correct answer: Remote Domains

Remote Domains are used to define settings for mail sent to domains outside of your Exchange Online organization. You can create a default remote domain entry ('*') for all external domains and specific entries for particular domains to control settings like allowing automatic replies (out-of-office), message format (Rich Text, HTML, Plain Text), and character sets.

Question 38: An organization is migrating from on-premises Exchange to Exchange Online and currently uses Messaging Records Management (MRM) policies. To adopt a modern, unified information governance strategy, which Microsoft Purview feature is the recommended replacement for MRM?

Journaling Rules
Data Loss Prevention (DLP) Policies
eDiscovery Holds
Retention Policies and Retention Labels (Correct answer)

Correct answer: Retention Policies and Retention Labels

Microsoft Purview retention policies and retention labels are the modern, recommended features for information governance across the Microsoft 365 suite. They are designed to replace the legacy, Exchange-only Messaging Records Management (MRM) feature, offering a more unified and powerful set of capabilities for data lifecycle management.

Question 39: What tool can administrators use to manage users and licenses?

PowerPoint
Microsoft 365 admin center (Correct answer)
Excel
Microsoft Teams

Correct answer: Microsoft 365 admin center

The Microsoft 365 admin center is the central portal for administrators to manage their organization's Microsoft 365 services. It provides comprehensive tools for various administrative tasks, including creating and managing user accounts, assigning and revoking licenses, and configuring service settings. This centralized hub simplifies the administration of users and their access to Microsoft 365 applications.

Question 40: Your organization is concerned about malicious attachments in emails. You want to implement a solution where attachments are analyzed in a sandbox environment, but users receive the email body immediately to avoid workflow delays. A placeholder attachment should indicate that the original is being scanned. Which Microsoft Defender for Office 365 Safe Attachments policy action should you configure?

Replace
Block
Monitor
Dynamic Delivery (Correct answer)

Correct answer: Dynamic Delivery

The 'Dynamic Delivery' action in a Safe Attachments policy delivers the email message to the recipient without the attachments. A placeholder attachment is added, explaining that the original attachments are being scanned. If the attachments are found to be safe, they are reattached to the original message in the user's mailbox. This approach minimizes email delays while still providing robust protection.

Question 41: What is the mailbox size limit for a shared mailbox before an Exchange Online Plan 2 license is required?

25 GB
50 GB (Correct answer)
100 GB
10 GB

Correct answer: 50 GB

Shared mailboxes are limited to 50 GB without a license; exceeding this requires an Exchange Online Plan 2 license.

Question 42: Which cmdlet is used to create a new public folder mailbox in Exchange Online?

Add-PublicFolderMailbox
New-PublicFolder -Mailbox
Set-PublicFolder -New
New-Mailbox -PublicFolder (Correct answer)

Correct answer: New-Mailbox -PublicFolder

New-Mailbox -PublicFolder creates a public folder mailbox in Exchange Online.

Question 43: After running the Hybrid Configuration Wizard, a user with an on-premises mailbox reports they cannot see the free/busy information for a user whose mailbox is in Exchange Online. An administrator needs to verify the external connectivity for the on-premises services required for hybrid features. Which tool is most appropriate for this task?

Azure AD Connect Health portal
The `Test-NetConnection` PowerShell cmdlet
Microsoft Remote Connectivity Analyzer (ExRCA) (Correct answer)
Exchange Admin Center Message Trace

Correct answer: Microsoft Remote Connectivity Analyzer (ExRCA)

The Microsoft Remote Connectivity Analyzer (ExRCA) is a web-based tool designed to test connectivity for various Exchange services from an external perspective, simulating how Microsoft 365 services connect. It includes specific tests for hybrid deployments that validate Autodiscover, Exchange Web Services (EWS), and other endpoints crucial for features like free/busy sharing.

Question 44: A developer needs to configure a line-of-business application running on an on-premises server to send email notifications to external recipients using the company's domain. The application does not support modern authentication. The administrator wants to securely allow this relay through Microsoft 365. Which of the following is the most appropriate configuration?

Configure a mail flow rule to allow relay from the application's email address.
Create an inbound connector of the type 'On-premises' that is scoped to the application server's public IP address. (Correct answer)
Use SMTP AUTH with a licensed mailbox and basic authentication.
Configure an outbound connector from Office 365 to a partner organization.

Correct answer: Create an inbound connector of the type 'On-premises' that is scoped to the application server's public IP address.

For SMTP relay from on-premises devices or applications, the recommended and secure method is to create an inbound connector. This connector should be configured to accept mail from your organization's email server and be restricted by the specific public IP address(es) of the sending server or application. This allows relay without requiring authentication on the application itself.

Question 45: A company, Contoso, Ltd., wants to route all outbound email through a third-party cloud service for advanced compliance archiving before final delivery to the internet. As the messaging administrator, what combination of configurations is required in Exchange Online to implement this solution?

Only an outbound connector configured to route all mail through a smart host.
An outbound connector to the partner organization and a mail flow rule to redirect messages. (Correct answer)
An inbound connector from the partner organization and a mail flow rule.
A remote domain entry for '*' and an outbound connector.

Correct answer: An outbound connector to the partner organization and a mail flow rule to redirect messages.

To route outbound mail to a third-party service (a partner organization), you must first create an outbound connector that specifies the service's smart host address. Then, a mail flow rule is needed to identify all outbound messages and redirect them through that specific connector.

Question 46: An administrator configures a Microsoft Purview retention policy to delete all emails 7 years after they were created. A specific user's mailbox is also placed on Litigation Hold for an eDiscovery case. What happens to an 8-year-old email in this user's mailbox?

The email is moved to the user's archive mailbox.
The email is permanently deleted by the retention policy.
The email is preserved and cannot be permanently deleted until the Litigation Hold is removed. (Correct answer)
The user is prompted to decide whether to delete or keep the email.

Correct answer: The email is preserved and cannot be permanently deleted until the Litigation Hold is removed.

Microsoft Purview follows a key 'principle of retention' where preservation always wins over deletion. A Litigation Hold is a form of indefinite preservation. Therefore, even though the retention policy is configured to delete items older than 7 years, the Litigation Hold will override this deletion action and preserve the item until the hold is released.

Question 47: An administrator has successfully implemented SPF and DKIM. To complete the email authentication setup, they need to create a DMARC record. Which DMARC policy tag (`p=`) should be used to instruct receiving email servers to move messages that fail DMARC checks to the recipient's junk or spam folder?

p=none
p=quarantine (Correct answer)
p=monitor
p=reject

Correct answer: p=quarantine

The DMARC policy tag `p=quarantine` instructs the receiving server to accept the message but place it in a location other than the inbox, such as the spam or junk folder. `p=none` is for monitoring only, and `p=reject` instructs the server to block the message entirely.

Question 48: Which public folder permission role allows a user only to read items but not create or modify them?

Author
Reviewer (Correct answer)
None
Contributor

Correct answer: Reviewer

The Reviewer role grants read-only access to public folder contents without any create or edit rights.

Question 49: An organization needs to retain all Microsoft Teams channel messages for its 'Executives' user group for 10 years. All other users' Teams messages must be deleted after 3 years. What is the most effective way to configure this using Microsoft Purview retention policies?

Create two separate retention policies for Teams. Scope one policy to the Executives group for 10 years and a second policy to all other users for 3 years, excluding the Executives group. (Correct answer)
Use Messaging Records Management (MRM) policies to define the different retention periods for the user groups.
Create a single retention policy for 3 years and apply a 10-year retention label to the Executives' Teams.
Create one retention policy for Teams scoped to all users for 10 years and use a mail flow rule to delete messages older than 3 years for non-executives.

Correct answer: Create two separate retention policies for Teams. Scope one policy to the Executives group for 10 years and a second policy to all other users for 3 years, excluding the Executives group.

The most direct and effective method is to use two distinct Microsoft Purview retention policies. One policy is specifically scoped to the 'Executives' group with a 10-year retention period. The second policy is scoped to include all users but explicitly excludes the 'Executives' group, applying the 3-year deletion period. This prevents policy conflicts and precisely targets the correct user populations. MRM does not apply to Teams, and mail flow rules are not used for retention.

Question 50: An organization needs to prevent employees from emailing documents containing credit card numbers to external recipients. However, the policy must allow for legitimate business cases where a user can send the information after providing a reason. Which combination of actions should an administrator configure in the Data Loss Prevention (DLP) policy rule?

Set an 'Exception' for the finance department and set the action to 'Encrypt the message content'.
Set the action to 'Restrict access' and enable 'User notifications'.
Set the action to 'Audit only' and configure an 'Incident report'.
Set the action to 'Restrict access' to block external users, and enable 'User overrides' with a business justification. (Correct answer)

Correct answer: Set the action to 'Restrict access' to block external users, and enable 'User overrides' with a business justification.

To meet the requirement, the policy must first block the action ('Restrict access' for people outside the organization). Then, to allow for exceptions with a reason, the 'User overrides' option must be enabled, which can be configured to require a business justification. This combination blocks the action by default but gives users a way to proceed if necessary, while logging their reason for audit purposes.

MS-203: Microsoft 365 Messaging

MS-203 certifies Microsoft 365 Messaging Administrators who manage secure, efficient email collaboration using Exchange Online and Microsoft 365. The exam covers Exchange Online management, mail transport architecture, and messaging security.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

learn.microsoft.com — Eligibility, renewal, score validity, passing score, score release, exam format, exam information · verified Nov 2026
home.pearsonvue.com — Test delivery · verified Nov 2026