MS-203: Microsoft 365 Messaging — Questions and Answers

Question 1: An administrator needs to add a naming policy that appends a department prefix to all newly created Microsoft 365 Groups. Where is this configured?

Microsoft 365 Admin Center > Settings > Org settings > Microsoft 365 Groups
Azure Active Directory > Groups > Naming policy (Correct answer)
PowerShell using New-TransportRule
Exchange Admin Center > Recipients > Groups

Correct answer: Azure Active Directory > Groups > Naming policy

Microsoft 365 Groups naming policies are configured in Azure Active Directory under Groups settings, where administrators can define prefix/suffix patterns and blocked words.

Question 2: Upon inspecting the headers of a failed email, a messaging administrator sees the authentication result 'dkim=fail (body hash did not verify)'. The sender has confirmed their DKIM public key is correct in DNS. What is the most likely cause for this specific failure?

The DKIM private key used to sign the message is corrupted.
The recipient's mail server does not support DKIM verification.
The message body was altered in transit after it was signed. (Correct answer)
The CNAME records for DKIM are pointing to the wrong location.

Correct answer: The message body was altered in transit after it was signed.

The 'body hash did not verify' error specifically means that the receiving server was able to retrieve the public key from DNS but that the hash of the message body it calculated does not match the hash value stored in the DKIM signature. This is most often caused by an intermediate system (like a gateway or mailing list server) altering the message content, such as by adding a disclaimer, after the original DKIM signature was applied.

Question 3: Which Microsoft 365 feature allows reading user mailbox access logs?

Yammer history
Exchange connectors
Mailbox insights
Audit logging (Correct answer)

Correct answer: Audit logging

Audit logging in Microsoft 365 allows administrators to track and review activities performed on user mailboxes, including who accessed a mailbox, when, and what actions were taken. This feature is vital for security, compliance, and forensic investigations, as it provides a detailed record of mailbox access, helping to identify unauthorized activity or investigate data breaches.

Question 4: Which setting in a mobile device mailbox policy enforces a minimum PIN length on connecting devices?

-MinPinLength (Correct answer)
-MinPasswordLength
-RequirePasswordLength
-PinLength

Correct answer: -MinPinLength

The -MinPinLength parameter in a mobile device mailbox policy specifies the minimum number of characters required for the device PIN.

Question 5: What tool can administrators use to manage users and licenses?

Excel
PowerPoint
Microsoft Teams
Microsoft 365 admin center (Correct answer)

Correct answer: Microsoft 365 admin center

The Microsoft 365 admin center is the primary portal for administrators to manage their entire Microsoft 365 subscription. This includes creating and managing user accounts, assigning and revoking licenses for various Microsoft 365 services, managing groups, and overseeing billing and service health. It serves as the central hub for tenant administration.

Question 6: An organization is migrating from on-premises Exchange to Exchange Online and currently uses Messaging Records Management (MRM) policies. To adopt a modern, unified information governance strategy, which Microsoft Purview feature is the recommended replacement for MRM?

Journaling Rules
eDiscovery Holds
Data Loss Prevention (DLP) Policies
Retention Policies and Retention Labels (Correct answer)

Correct answer: Retention Policies and Retention Labels

Microsoft Purview retention policies and retention labels are the modern, recommended features for information governance across the Microsoft 365 suite. They are designed to replace the legacy, Exchange-only Messaging Records Management (MRM) feature, offering a more unified and powerful set of capabilities for data lifecycle management.

Question 7: An administrator has successfully implemented SPF and DKIM. To complete the email authentication setup, they need to create a DMARC record. Which DMARC policy tag (`p=`) should be used to instruct receiving email servers to move messages that fail DMARC checks to the recipient's junk or spam folder?

p=quarantine (Correct answer)
p=reject
p=monitor
p=none

Correct answer: p=quarantine

The DMARC policy tag `p=quarantine` instructs the receiving server to accept the message but place it in a location other than the inbox, such as the spam or junk folder. `p=none` is for monitoring only, and `p=reject` instructs the server to block the message entirely.

Question 8: An email message containing a previously unknown malware variant was delivered to several users' inboxes because it was not detected by the initial real-time scans. A few hours later, Microsoft's threat intelligence services are updated with a signature for this new threat. Which Exchange Online Protection feature retroactively removes the malicious message from the user inboxes?

Safe Links time-of-click verification
Zero-hour auto purge (ZAP) (Correct answer)
Connection filtering
Dynamic Delivery

Correct answer: Zero-hour auto purge (ZAP)

Zero-hour auto purge (ZAP) is an Exchange Online Protection feature that detects and neutralizes malicious spam, phishing, and malware messages that have already been delivered to mailboxes. If a post-delivery scan determines a message is malicious, ZAP will move it to the junk folder or quarantine.

Question 9: Your organization is concerned about malicious attachments in emails. You want to implement a solution where attachments are analyzed in a sandbox environment, but users receive the email body immediately to avoid workflow delays. A placeholder attachment should indicate that the original is being scanned. Which Microsoft Defender for Office 365 Safe Attachments policy action should you configure?

Block
Dynamic Delivery (Correct answer)
Replace
Monitor

Correct answer: Dynamic Delivery

The 'Dynamic Delivery' action in a Safe Attachments policy delivers the email message to the recipient without the attachments. A placeholder attachment is added, explaining that the original attachments are being scanned. If the attachments are found to be safe, they are reattached to the original message in the user's mailbox. This approach minimizes email delays while still providing robust protection.

Question 10: A legal department needs to preserve all emails pertaining to an internal investigation codenamed "Project Falcon" for an indefinite period. The data is spread across multiple users' mailboxes. What is the most precise and efficient method in Microsoft Purview to accomplish this?

Create a retention policy that retains all content in Exchange for an indefinite period.
Create a Microsoft Purview eDiscovery (Standard) case, and create a hold associated with the case using the keyword "Project Falcon". (Correct answer)
Place the mailboxes of all involved users on Litigation Hold.
Instruct users to apply a "Legal Hold" retention label to all content related to "Project Falcon".

Correct answer: Create a Microsoft Purview eDiscovery (Standard) case, and create a hold associated with the case using the keyword "Project Falcon".

Using a hold associated with a Microsoft Purview eDiscovery case is the most precise method. It allows an administrator to define a query-based hold (e.g., using the keyword "Project Falcon") that preserves only the specific content matching the criteria across specified mailboxes. This avoids placing a broad hold on all content for the users, which is what Litigation Hold would do. Relying on users to apply labels is inefficient and prone to error.

Question 11: A user clicks a link in an email that has been processed by a Microsoft Defender Safe Links policy. The URL in the browser's address bar starts with `https://nam01.safelinks.protection.outlook.com`. What is the primary function of this URL rewriting?

To check the destination URL against a blocklist and scan its content for threats at the time of the click. (Correct answer)
To ensure the link can only be clicked once by the recipient.
To add the original website to the user's trusted sites list.
To translate the website content into the user's default language.

Correct answer: To check the destination URL against a blocklist and scan its content for threats at the time of the click.

Safe Links rewrites URLs in inbound emails. When a user clicks the rewritten link, Microsoft Defender for Office 365 checks the original destination against a dynamic list of malicious sites. It also performs a real-time scan of the destination content for suspicious behavior. This 'time-of-click' verification protects users from links that appear safe on delivery but are later weaponized.

Question 12: An administrator configures a Microsoft Purview retention policy to delete all emails 7 years after they were created. A specific user's mailbox is also placed on Litigation Hold for an eDiscovery case. What happens to an 8-year-old email in this user's mailbox?

The email is moved to the user's archive mailbox.
The user is prompted to decide whether to delete or keep the email.
The email is preserved and cannot be permanently deleted until the Litigation Hold is removed. (Correct answer)
The email is permanently deleted by the retention policy.

Correct answer: The email is preserved and cannot be permanently deleted until the Litigation Hold is removed.

Microsoft Purview follows a key 'principle of retention' where preservation always wins over deletion. A Litigation Hold is a form of indefinite preservation. Therefore, even though the retention policy is configured to delete items older than 7 years, the Litigation Hold will override this deletion action and preserve the item until the hold is released.

Question 13: Which PowerShell cmdlet converts a regular user mailbox into a shared mailbox in Exchange Online?

Move-Mailbox -ToShared
New-Mailbox -Shared
Set-Mailbox -Type Shared (Correct answer)
Convert-Mailbox -Type Shared

Correct answer: Set-Mailbox -Type Shared

Set-Mailbox -Type Shared converts an existing user mailbox to a shared mailbox type.

Question 14: A user's mailbox is placed on Litigation Hold. The user performs several actions within their Outlook client. Which of the following user actions results in a copy of the original item being preserved in the Recoverable Items folder?

Creating a new draft email but never sending it.
Editing the subject line of a received email and saving the change. (Correct answer)
Reading an unread email.
Assigning a category to an email.

Correct answer: Editing the subject line of a received email and saving the change.

Litigation Hold uses a copy-on-write mechanism to preserve data. When a user attempts to change or delete a mailbox item, a copy of the original, unmodified item is saved in the Recoverable Items folder before the change is committed. Editing the subject of an email is a modification of the item, which triggers the copy-on-write process to preserve the original version. Actions like categorizing or reading an email only change metadata and do not trigger this preservation.

Question 15: After running the Hybrid Configuration Wizard, a user with an on-premises mailbox reports they cannot see the free/busy information for a user whose mailbox is in Exchange Online. An administrator needs to verify the external connectivity for the on-premises services required for hybrid features. Which tool is most appropriate for this task?

The `Test-NetConnection` PowerShell cmdlet
Microsoft Remote Connectivity Analyzer (ExRCA) (Correct answer)
Exchange Admin Center Message Trace
Azure AD Connect Health portal

Correct answer: Microsoft Remote Connectivity Analyzer (ExRCA)

The Microsoft Remote Connectivity Analyzer (ExRCA) is a web-based tool designed to test connectivity for various Exchange services from an external perspective, simulating how Microsoft 365 services connect. It includes specific tests for hybrid deployments that validate Autodiscover, Exchange Web Services (EWS), and other endpoints crucial for features like free/busy sharing.

Question 16: What type of information can be read from an email header?

Routing and security data (Correct answer)
Calendar events
Files shared
Chat history

Correct answer: Routing and security data

An email header contains crucial metadata about an email message, providing a detailed history of its journey from sender to recipient. This information includes routing details like the mail servers it passed through, sender and recipient IP addresses, and timestamps. It also contains security-related data such as authentication results (SPF, DKIM, DMARC), spam scores, and anti-malware scan results, which are vital for troubleshooting delivery issues and investigating security incidents.

Question 17: An organization needs to retain all Microsoft Teams channel messages for its 'Executives' user group for 10 years. All other users' Teams messages must be deleted after 3 years. What is the most effective way to configure this using Microsoft Purview retention policies?

Create a single retention policy for 3 years and apply a 10-year retention label to the Executives' Teams.
Create one retention policy for Teams scoped to all users for 10 years and use a mail flow rule to delete messages older than 3 years for non-executives.
Create two separate retention policies for Teams. Scope one policy to the Executives group for 10 years and a second policy to all other users for 3 years, excluding the Executives group. (Correct answer)
Use Messaging Records Management (MRM) policies to define the different retention periods for the user groups.

Correct answer: Create two separate retention policies for Teams. Scope one policy to the Executives group for 10 years and a second policy to all other users for 3 years, excluding the Executives group.

The most direct and effective method is to use two distinct Microsoft Purview retention policies. One policy is specifically scoped to the 'Executives' group with a 10-year retention period. The second policy is scoped to include all users but explicitly excludes the 'Executives' group, applying the 3-year deletion period. This prevents policy conflicts and precisely targets the correct user populations. MRM does not apply to Teams, and mail flow rules are not used for retention.

Question 18: Your organization has a hybrid Exchange environment with mailboxes both on-premises and in Exchange Online. You need to ensure that all outbound email from Exchange Online to your on-premises servers is encrypted using TLS. Which of the following is the BEST way to achieve this?

Configure a remote domain for the on-premises environment to require TLS.
Create an outbound connector from Office 365 to your organization's email server and enforce TLS. (Correct answer)
Enable STARTTLS on the on-premises Receive connector.
Create a mail flow rule to require TLS for messages sent to the on-premises domain.

Correct answer: Create an outbound connector from Office 365 to your organization's email server and enforce TLS.

Connectors are specifically designed to manage mail flow between Microsoft 365 and external environments, such as on-premises servers or partner organizations. When creating an outbound connector, you can enforce the use of Transport Layer Security (TLS) to secure the connection, which is the most direct and appropriate method for this requirement.

Question 19: A messaging administrator is configuring an anti-phishing policy in Microsoft Defender for Office 365 to protect senior executives from spear-phishing and whaling attacks. Which specific feature allows the administrator to define a list of high-profile users to protect from attacks where the sender's display name and address mimic the user?

Mailbox intelligence
Impersonation protection (Correct answer)
First contact safety tip
Spoof intelligence

Correct answer: Impersonation protection

Impersonation protection, a feature within Defender for Office 365 anti-phishing policies, is designed to combat spear-phishing and whaling. It allows administrators to explicitly define a list of 'protected users' (like executives) and 'protected domains' to detect and act on messages where attackers try to impersonate these specific entities.

Question 20: In Exchange Online, which policy is applied to a mobile device when no specific mobile device mailbox policy is assigned to the user?

The device is blocked until a policy is manually assigned
The built-in Default Mobile Device Mailbox Policy is applied (Correct answer)
The strictest available policy is applied automatically
No policy is applied and the device syncs without restrictions

Correct answer: The built-in Default Mobile Device Mailbox Policy is applied

Exchange Online automatically applies the Default Mobile Device Mailbox Policy to users who do not have a specific policy assigned.

Question 21: What happens to public folder data when you migrate from Exchange on-premises to Exchange Online?

It must be migrated using a separate public folder migration batch (Correct answer)
It is converted to shared mailboxes automatically
Public folders are not supported in Exchange Online
It is automatically migrated with mailboxes

Correct answer: It must be migrated using a separate public folder migration batch

Public folder data must be migrated separately using a public folder migration batch in Exchange Online.

Question 22: An administrator needs to configure a conference room mailbox to automatically accept meeting requests from a specific group of users (Project Managers) but require a delegate's approval for all other requests. Which settings should the administrator configure?

Set 'Accept or decline booking requests automatically' and configure the 'BookInPolicy' parameter in PowerShell with the Project Managers group. (Correct answer)
Set 'Accept or decline booking requests automatically' and configure 'Request in-policy' in the booking delegates settings.
Configure the 'AllBookInPolicy' parameter to $false and the 'BookInPolicy' parameter to the Project Managers group using PowerShell.
Configure 'Select delegates who can accept or decline booking requests' and specify the Project Managers group.

Correct answer: Set 'Accept or decline booking requests automatically' and configure the 'BookInPolicy' parameter in PowerShell with the Project Managers group.

To meet this requirement, the room mailbox should be set to process requests automatically. The 'BookInPolicy' parameter, configured via PowerShell, specifies which users or groups are allowed to book the resource automatically without delegate approval. All other requests will be forwarded to the delegate.

Question 23: What is the default behavior when a Microsoft 365 Group owner leaves the organization and no other owners remain?

Microsoft 365 automatically assigns the next most active member as owner (Correct answer)
The group is converted to a distribution group
The group becomes ownerless and Microsoft 365 notifies remaining members
The group is automatically deleted after 30 days

Correct answer: Microsoft 365 automatically assigns the next most active member as owner

Microsoft 365 uses activity-based heuristics to automatically assign ownership to the most active member when a group becomes ownerless to prevent orphaned groups.

Question 24: A user receives a Non-Delivery Report (NDR) with the enhanced status code '5.7.1'. Which of the following is the most common reason for this type of NDR?

The message was rejected due to a permissions issue or a mail flow rule. (Correct answer)
The recipient's email address does not exist.
The recipient's mailbox is full.
A temporary network issue occurred on the receiving server.

Correct answer: The message was rejected due to a permissions issue or a mail flow rule.

The status code '5.7.1' typically indicates that delivery is not authorized. This can happen for several reasons, such as the sender not having permission to send to a specific recipient or distribution group, or a mail flow (transport) rule is configured to block the message.

Question 25: Which Exchange Online PowerShell cmdlet is used to view all Microsoft 365 Groups in an organization?

Get-AzureADGroup -Filter "groupTypes/any(c:c eq 'Unified')"
Get-UnifiedGroup (Correct answer)
Get-MsolGroup -GroupType Security
Get-DistributionGroup -RecipientTypeDetails GroupMailbox

Correct answer: Get-UnifiedGroup

Get-UnifiedGroup is the Exchange Online PowerShell cmdlet specifically designed to retrieve Microsoft 365 Groups (formerly Office 365 Groups) and their properties.

Question 26: An organization with an on-premises Exchange Server 2013 environment wants to configure a hybrid deployment to migrate mailboxes to Microsoft 365. According to Microsoft's prerequisites, what is the minimum required update level for the Exchange 2013 servers?

Rollup Update 8
The latest Cumulative Update (CU) (Correct answer)
Any Cumulative Update released within the last two years
Service Pack 1 (SP1)

Correct answer: The latest Cumulative Update (CU)

Microsoft's official prerequisite for configuring a hybrid deployment is that the on-premises Exchange servers must be running the latest available Cumulative Update (CU). While the immediately previous release is sometimes supported for flexibility, the strong recommendation and requirement is to be on the latest CU to ensure compatibility, security, and access to all features.

Question 27: What tool can administrators use to manage users and licenses?

Microsoft Teams
PowerPoint
Microsoft 365 admin center (Correct answer)
Excel

Correct answer: Microsoft 365 admin center

The Microsoft 365 admin center is the central portal for administrators to manage their organization's Microsoft 365 services. It provides comprehensive tools for various administrative tasks, including creating and managing user accounts, assigning and revoking licenses, and configuring service settings. This centralized hub simplifies the administration of users and their access to Microsoft 365 applications.

Question 28: An administrator needs to investigate reports of intermittent, widespread email delays within the last 24 hours. They need a high-level, aggregated view of mail flow, including the status of connectors and any messages that are queued or deferred. Which tool in the Exchange admin center provides the best starting point for this type of investigation?

Non-delivered reports
Message Trace
Mail flow reports under 'Reports'
Mail flow dashboard (Correct answer)

Correct answer: Mail flow dashboard

The Mail flow dashboard in the modern Exchange admin center is designed to give administrators a quick, high-level overview of mail flow health. It includes insights into mail flow trends, connector status, queued messages, and auto-forwarding activity, making it the ideal starting point for diagnosing widespread, systemic issues like general delays rather than searching for a single message.

Question 29: How do you enable mail support for a public folder in Exchange Online?

New-MailPublicFolder
Add-PublicFolderPermission -MailEnabled
Enable-MailPublicFolder (Correct answer)
Set-PublicFolder -MailEnabled $true

Correct answer: Enable-MailPublicFolder

Enable-MailPublicFolder is the cmdlet used to mail-enable an existing public folder.

Question 30: An administrator needs to configure mail flow for a newly added domain, `subsidiary.contoso.com`. The company's primary email domain is `contoso.com`. Some mailboxes for the new domain exist in Exchange Online, while others are still on a non-Exchange on-premises server. Email for any non-existent user at `subsidiary.contoso.com` should be routed to the on-premises server. What type of accepted domain should be configured for `subsidiary.contoso.com`?

Authoritative
External Relay
Non-Authoritative
Internal Relay (Correct answer)

Correct answer: Internal Relay

An Internal Relay (or Non-Authoritative) domain is used when recipients for that domain may exist in Exchange Online or on an external email system. Exchange Online will first check for a recipient in its own directory. If the recipient is not found, it will relay the email to the other email system, which is configured via a connector.

Question 31: How long does Exchange Online wait before sending a wipe command after a device is reported lost (using the inactivity lock timeout feature)?

It defaults to 24 hours automatically
It is configured per policy using -MaxInactivityTimeLock (Correct answer)
It defaults to 15 minutes automatically
It requires manual admin intervention each time

Correct answer: It is configured per policy using -MaxInactivityTimeLock

The -MaxInactivityTimeLock parameter in the mobile device mailbox policy defines the idle timeout before the device locks, and wipe thresholds are set separately.

Question 32: Where can administrators read the delivery status of an email?

OneDrive dashboard
Exchange admin center (Correct answer)
Power BI
Azure DevOps

Correct answer: Exchange admin center

The Exchange admin center (EAC) is the web-based management console for Exchange Online in Microsoft 365. Administrators can use the EAC to perform various messaging-related tasks, including managing mailboxes, mail flow rules, and critically, running message traces. The message trace feature within the EAC allows administrators to check the delivery status of specific emails, providing details on whether a message was delivered, rejected, or quarantined.

Question 33: Which of the following components in Exchange Online is used to control settings for messages sent TO external domains, such as managing out-of-office replies, delivery reports, and message formatting like TNEF (winmail.dat)?

Mail Flow Rules
Remote Domains (Correct answer)
Connectors
Accepted Domains

Correct answer: Remote Domains

Remote Domains are used to define settings for mail sent to domains outside of your Exchange Online organization. You can create a default remote domain entry ('*') for all external domains and specific entries for particular domains to control settings like allowing automatic replies (out-of-office), message format (Rich Text, HTML, Plain Text), and character sets.

Question 34: How do you disable automapping for a shared mailbox so it does not automatically appear in Outlook?

Remove-MailboxPermission -AutoMapping
Set-MailboxPermission -DisableAutoMap
Add-MailboxPermission with -AutoMapping $false (Correct answer)
Set-Mailbox -AutoMapping $false

Correct answer: Add-MailboxPermission with -AutoMapping $false

Adding the FullAccess permission with the -AutoMapping $false parameter prevents the shared mailbox from being auto-mapped in Outlook.

Question 35: A developer needs to configure a line-of-business application running on an on-premises server to send email notifications to external recipients using the company's domain. The application does not support modern authentication. The administrator wants to securely allow this relay through Microsoft 365. Which of the following is the most appropriate configuration?

Configure an outbound connector from Office 365 to a partner organization.
Use SMTP AUTH with a licensed mailbox and basic authentication.
Create an inbound connector of the type 'On-premises' that is scoped to the application server's public IP address. (Correct answer)
Configure a mail flow rule to allow relay from the application's email address.

Correct answer: Create an inbound connector of the type 'On-premises' that is scoped to the application server's public IP address.

For SMTP relay from on-premises devices or applications, the recommended and secure method is to create an inbound connector. This connector should be configured to accept mail from your organization's email server and be restricted by the specific public IP address(es) of the sending server or application. This allows relay without requiring authentication on the application itself.

Question 36: What is a selective wipe in the context of Exchange ActiveSync mobile device management?

A wipe that only removes items older than 30 days
A wipe that targets a specific folder on the device
A wipe that resets only the email application
A wipe that removes only corporate data and the EAS profile without affecting personal data (Correct answer)

Correct answer: A wipe that removes only corporate data and the EAS profile without affecting personal data

A selective wipe removes only the corporate EAS profile and associated data, leaving personal data on the device intact.

Question 37: A mail flow rule with priority 0 is configured to bypass spam filtering for messages from a specific partner domain and has the 'Stop processing more rules' action enabled. A second rule with priority 1 is configured to prepend '[EXTERNAL]' to the subject of all messages received from outside the organization. Why would an email from the partner domain NOT have the '[EXTERNAL]' subject tag?

The priority 1 rule has a syntax error and is being skipped.
Mail flow rules cannot modify the subject line of a message.
The 'Stop processing more rules' action on the priority 0 rule prevented the priority 1 rule from being evaluated. (Correct answer)
A spam filter action always takes precedence over a subject line modification.

Correct answer: The 'Stop processing more rules' action on the priority 0 rule prevented the priority 1 rule from being evaluated.

Mail flow rules are processed in order of priority, starting with 0. When a message matches the conditions of the priority 0 rule, the rule's actions are applied. Because the 'Stop processing more rules' action is enabled on this rule, Exchange Online halts any further rule evaluation for that message. Therefore, the priority 1 rule is never processed for that email.

Question 38: An organization wants to give users the ability to release messages quarantined as 'Spam' but prevent them from releasing messages quarantined as 'High-confidence phish'. Users should only be able to request the release of high-confidence phish messages for an administrator to review. Where must this granular control be configured?

In a mail flow rule
In the Anti-spam policy actions
In a Quarantine policy (Correct answer)
In the Tenant Allow/Block List

Correct answer: In a Quarantine policy

Quarantine policies define what actions users can take on their own quarantined messages, based on the reason the message was quarantined (e.g., spam, bulk, phish, malware). An administrator can create custom quarantine policies to grant different permission levels, such as allowing release for spam but only allowing 'request release' for high-confidence phish.

Question 39: Which report in the Microsoft 365 admin center shows shared mailbox usage including email activity?

Email Activity Report
Active Users Report
Mailbox Usage Report (Correct answer)
Exchange Online Report

Correct answer: Mailbox Usage Report

The Mailbox Usage report in the Microsoft 365 admin center displays quota consumption and activity data for shared mailboxes.

Question 40: What is the purpose of setting -PasswordRecoveryEnabled $true in a mobile device mailbox policy?

It allows users to recover their Exchange account password from the device
It enables backup codes for two-factor authentication
It stores the device PIN in Exchange Online for admin recovery (Correct answer)
It stores encrypted device recovery keys in Azure AD

Correct answer: It stores the device PIN in Exchange Online for admin recovery

When PasswordRecoveryEnabled is true, Exchange stores the device's recovery password, allowing administrators to retrieve it if needed.

Question 41: An organization is preparing for a remote move migration to Exchange Online. For the migration to succeed, Exchange Online needs to connect to an endpoint on the on-premises Exchange servers to pull mailbox data. Which service must be enabled on the on-premises Exchange Client Access servers to facilitate this?

The POP3 Backend Service
The Unified Messaging Call Router
The Autodiscover Publishing Service
The Mailbox Replication Service (MRS) Proxy (Correct answer)

Correct answer: The Mailbox Replication Service (MRS) Proxy

The Mailbox Replication Service (MRS) Proxy is the component that receives and processes remote move requests from Exchange Online. It must be enabled on the Exchange Web Services (EWS) virtual directory of the on-premises Client Access servers to allow the cloud-based MRS to connect and pull mailbox data.

Question 42: Your organization has configured an outbound connector to route all outgoing mail through a third-party cloud archiving service. Shortly after, you receive reports that external recipients are not receiving your emails, and bounce messages indicate an SPF failure. What is the most likely cause of this issue?

The organization's public SPF record in DNS has not been updated to include the third-party service. (Correct answer)
The organization's MX record is pointing to the wrong service.
The outbound connector in Exchange Online is disabled.
The third-party service does not support TLS encryption.

Correct answer: The organization's public SPF record in DNS has not been updated to include the third-party service.

When you route outbound mail through a third-party service (a smart host), the final server that sends the message to the internet is no longer Microsoft 365, but the third-party service. The recipient's mail server will check the sender's SPF record to see if the IP address of that third-party service is authorized to send email for your domain. If the SPF record is not updated to include the third-party service's sending servers, the check will fail.

Question 43: What does MFA stand for in Microsoft 365?

Multi-Factor Authentication (Correct answer)
Mail Folder Analytics
Message File Access
Microsoft File Archive

Correct answer: Multi-Factor Authentication

MFA stands for Multi-Factor Authentication, a security method that requires users to provide two or more verification factors to gain access to an account. This typically combines something the user knows (like a password) with something they have (like a phone or a token) or something they are (like a fingerprint). MFA significantly enhances security by making it much harder for unauthorized individuals to compromise an account, even if they obtain one factor.

Question 44: A company, Contoso, Ltd., wants to route all outbound email through a third-party cloud service for advanced compliance archiving before final delivery to the internet. As the messaging administrator, what combination of configurations is required in Exchange Online to implement this solution?

Only an outbound connector configured to route all mail through a smart host.
An inbound connector from the partner organization and a mail flow rule.
A remote domain entry for '*' and an outbound connector.
An outbound connector to the partner organization and a mail flow rule to redirect messages. (Correct answer)

Correct answer: An outbound connector to the partner organization and a mail flow rule to redirect messages.

To route outbound mail to a third-party service (a partner organization), you must first create an outbound connector that specifies the service's smart host address. Then, a mail flow rule is needed to identify all outbound messages and redirect them through that specific connector.

Question 45: Your company uses a third-party anti-spam service. The service filters all inbound mail and then forwards it to your Exchange Online tenant. You notice that legitimate emails from this service are sometimes being incorrectly marked as spam by Exchange Online Protection (EOP). Which of the following is the most effective way to prevent EOP from filtering mail that has already been scanned by the trusted third-party service?

Create a mail flow rule to set the SCL to -1 for messages from the service's IP addresses. (Correct answer)
Configure Enhanced Filtering for Connectors (Skip Listing) on the inbound connector from the service.
Create a remote domain for the third-party service and disable spam filtering.
Add the service's domain to the safe senders list in the anti-spam policy.

Correct answer: Create a mail flow rule to set the SCL to -1 for messages from the service's IP addresses.

Creating a mail flow rule to set the Spam Confidence Level (SCL) to -1 (Bypass spam filtering) for messages originating from the trusted service's IP addresses is the standard and recommended method. This tells EOP to trust the verdict of the upstream filter and deliver the message without further spam scanning.

Question 46: What is a mail flow rule also known as?

Transport rule (Correct answer)
Retention rule
Display rule
Team rule

Correct answer: Transport rule

In Microsoft 365, a mail flow rule is also commonly known as a transport rule. These rules allow administrators to define specific conditions and actions for messages flowing through their organization's email system. Transport rules can be used to apply disclaimers, encrypt emails, block certain content, or redirect messages, providing granular control over email behavior and security.

Question 47: What is the fundamental difference between applying a Microsoft Purview retention policy to a location versus applying a retention label to an item?

A retention label can only delete content, whereas a retention policy can both retain and delete content.
A retention policy requires end-user interaction to be applied, while a retention label is always applied automatically.
A retention label is a legacy feature that has been replaced by retention policies.
A retention policy applies to all items within a container, like a mailbox or site, while a retention label is applied to an individual item, like an email or document. (Correct answer)

Correct answer: A retention policy applies to all items within a container, like a mailbox or site, while a retention label is applied to an individual item, like an email or document.

A retention policy sets a default retention or deletion action for all content within a specified location, such as an entire Exchange mailbox. A retention label, however, is a tag applied to an individual item (email, document) that can override the container's default policy, and can be applied manually by users or automatically based on conditions.

Question 48: A user reports to the messaging administrator that an important email sent to an external partner was never received. The partner's IT team insists the message never reached their mail servers. Which tool should the administrator use FIRST to determine the final delivery status of the message from the Microsoft 365 perspective?

Microsoft Defender 365 audit log
Service Health dashboard in the Microsoft 365 admin center
Mail flow dashboard in the Exchange admin center
Message trace in the Exchange admin center (Correct answer)

Correct answer: Message trace in the Exchange admin center

Message trace is the primary tool for following email messages as they travel through a Microsoft 365 organization. It allows an administrator to see if a message was received, rejected, deferred, or delivered by the service, and to view the detailed events that occurred for that message. This is the most direct and effective first step for troubleshooting a specific missing email.

Question 49: Which public folder permission role allows a user only to read items but not create or modify them?

None
Author
Contributor
Reviewer (Correct answer)

Correct answer: Reviewer

The Reviewer role grants read-only access to public folder contents without any create or edit rights.

Question 50: Where can you read about current service health for Microsoft 365?

Microsoft Learn
Exchange message trace
Microsoft 365 Admin Center (Correct answer)
Security & Compliance Center

Correct answer: Microsoft 365 Admin Center

The Microsoft 365 Admin Center is the central portal for administrators to manage their Microsoft 365 services. It provides a dedicated "Service health" dashboard where administrators can view the current status, incidents, and planned maintenance for all their subscribed Microsoft 365 services. This allows them to stay informed about potential service disruptions and communicate effectively with users.

MS-203: Microsoft 365 Messaging

MS-203 certifies Microsoft 365 Messaging Administrators who manage secure, efficient email collaboration using Exchange Online and Microsoft 365. The exam covers Exchange Online management, mail transport architecture, and messaging security.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds