Question 550
A Microsoft 365 business user needs to address: A worker downloads an unknown third-party Cowork skill file asking for broad access to confidential files. Which action best meets the requirement?
Explanation
Correct Answer
Reject or quarantine untrusted skill content and use approved alternatives. This addresses the described need: A worker downloads an unknown third-party Cowork skill file asking for broad access to confidential files. It follows because skills execute instructions and can introduce security risk if their origin or permissions are untrusted. Validate the change by checking: No unreviewed skill gains access to confidential organizational sources. It does not eliminate this limitation: Even approved custom skills require continuing maintenance and periodic review.
Incorrect Answers
Develop a reviewed custom skill with source rules, output schema and review gates. This would address a different problem: A team repeats a specialized compliance-report structure each month that built-in Cowork skills do not capture. It is not the direct fix for: A worker downloads an unknown third-party Cowork skill file asking for broad access to confidential files. The response appropriate to the stated constraints is: Reject or quarantine untrusted skill content and use approved alternatives. Its success is checked through: No unreviewed skill gains access to confidential organizational sources.
Use the approved research skill with clear scope, date bounds and citation requirements. This would address a different problem: A business analyst asks Cowork to investigate a complex industry trend across sources and produce a sourced report. It is not the direct fix for: A worker downloads an unknown third-party Cowork skill file asking for broad access to confidential files. The response appropriate to the stated constraints is: Reject or quarantine untrusted skill content and use approved alternatives. Its success is checked through: No unreviewed skill gains access to confidential organizational sources.
Use the supported Excel skill with explicit columns and verified input assumptions. This would address a different problem: A sales coordinator requests a forecast spreadsheet with formulas and assumes a chat summary will suffice. It is not the direct fix for: A worker downloads an unknown third-party Cowork skill file asking for broad access to confidential files. The response appropriate to the stated constraints is: Reject or quarantine untrusted skill content and use approved alternatives. Its success is checked through: No unreviewed skill gains access to confidential organizational sources.