Free Microsoft AB-900 Practice Exam with Questions & Answers

The correct selections are No, Yes, No . Microsoft defines Zero Trust as a security strategy and explicitly states that it isn’t a product or a service . Instead, it is an approach based on principles such as verify explicitly , use least privilege access , and assume breach . That makes statement 2 true.

Statement 1 is false because Zero Trust does not require an Azure subscription. Microsoft provides Zero Trust guidance across many environments, including Microsoft 365, Copilot, Azure, and hybrid scenarios. It is a strategy that can be implemented with different technologies and is not dependent on owning Azure specifically.

Statement 3 is also false because there is no single switch in the Microsoft 365 admin center to “enable Zero Trust” for an organization. Microsoft’s documentation presents Zero Trust as a set of policies, configurations, and deployment steps across services such as Microsoft Entra, Intune, Defender, and Microsoft 365 workloads, not as one admin-center toggle.

Top of Form

Bottom of Form

The correct answer is B . Microsoft documents that admins can block agents in the Microsoft 365 admin center, and when administrators block Microsoft agents such as Researcher and Analyst, those agents are made inaccessible to all users in the tenant. Microsoft’s agent management guidance also states that admins can manage agent lifecycle and access centrally, including blocking or removing agent availability across the organization.

Applied to this scenario, if an admin blocks Agent1 , the shared agent is no longer available for either the creator ( User1 ) or the recipient ( User2 ), and other users also cannot install or access it. This rules out options A and C, which both say the blocked agent remains accessible. It also rules out D, because blocking is a tenant admin action that removes availability broadly, not just for shared recipients while leaving the creator unaffected. Microsoft positions blocking as an organization-level control over agent access, so the best matching option is that Agent1 is removed from User1 and User2, and no users can install Agent1 .

The correct answer is D. an app registration . Microsoft Learn states that to delegate identity and access management functions to Microsoft Entra ID , an application must be registered with a Microsoft Entra tenant . When you register an application, you create its identity configuration in Microsoft Entra, and a corresponding service principal is created so the application can authenticate and integrate with the tenant. This is the standard Microsoft mechanism for allowing a third-party cloud service or app to authenticate to Microsoft Entra.

The other options do not provide the app identity required for authentication. Multifactor authentication (MFA) strengthens user sign-ins, but it does not onboard a third-party service as an application identity in Entra. Conditional Access enforces access policies after authentication and authorization decisions are being made; it does not create the application identity itself. A Microsoft 365 Copilot connector is used to bring external data into Microsoft 365 experiences, not to let a third-party cloud service authenticate to Microsoft Entra. Therefore, the correct configuration is an app registration .

The correct answer is C. the Microsoft 365 Copilot dashboard in Microsoft Viva Insights . Microsoft documents that the Microsoft Copilot Dashboard in Viva Insights provides detailed organizational reporting for Copilot usage and impact, including meeting-related metrics such as total meeting hours summarized or recapped , intelligent recap actions taken using Copilot , and summarize meeting actions taken using Copilot in Teams . Those metrics directly match the scenario in the question.

The other options are less suitable. The Microsoft 365 Apps usage report focuses on app usage generally, not detailed Copilot-in-Teams behavior. The Copilot readiness report is for readiness and deployment planning, not deep Teams usage metrics. The Microsoft 365 Copilot usage report in the admin center provides adoption information, but Microsoft’s detailed meeting-action and meeting-hours metrics are documented in the Viva Insights Copilot Dashboard . Therefore, for detailed Teams-specific Copilot reporting during a pilot, the best answer is the Microsoft 365 Copilot dashboard in Microsoft Viva Insights .

The correct answer is C. a custom Microsoft 365 Copilot agent . Microsoft Learn explains that Agent Builder in Microsoft 365 Copilot lets you create agents with specific instructions , dedicated knowledge sources , and starter prompts . Starter prompts are designed to help users understand the most common supported scenarios, which directly matches the requirement to provide users with a list of common queries. Microsoft also documents that an agent can be grounded in selected SharePoint sites, folders, or files , allowing the response scope to be targeted to the HR policy content in Site1 rather than broad enterprise or web data.

The other options do not fit the requirement. Copilot in Word is document-focused and is not intended to create a reusable, shared query experience grounded only in one SharePoint source. Copilot notebooks group materials and chats, but they are not the right tool for publishing a guided HR policy assistant with starter prompts. Researcher is designed for broader, multi-step research using work data and web content, so it does not satisfy the requirement to keep answers grounded only in Site1.

The correct answer is C. Microsoft Graph . Microsoft documents that Microsoft 365 Copilot combines large language models with content and context from the Microsoft Graph to generate grounded responses. Microsoft Graph provides access to organizational data and signals across Microsoft 365 services, including SharePoint , OneDrive , Exchange , Teams , calendars, chats, files, and other work content. When SharePoint data is relevant to the prompt and the user already has permission to access it, Copilot uses Microsoft Graph as the layer that retrieves and grounds that corporate data for the response.

The other options are incorrect for this question. Microsoft Intune is used for endpoint and device management. Microsoft Defender is used for threat protection and security operations. Microsoft Purview provides compliance, governance, data protection, and risk management capabilities. While Copilot honors Purview protections and Microsoft 365 permissions, the specific service it uses to access and ground responses in SharePoint-based corporate data is Microsoft Graph . Therefore, the correct answer is Microsoft Graph .

The correct answer is A. Data access governance in the SharePoint admin center . Microsoft Learn documents Data access governance reports in the SharePoint admin center as the reporting solution used to understand data exposure, including permission structure and sharing link activity . Microsoft specifically states that the site permissions snapshot report provides visibility across SharePoint and OneDrive sites , helping administrators understand current permissions exposure, and that separate reports are created for SharePoint and OneDrive . Microsoft also documents sharing links activity reports as part of Data access governance for monitoring link-sharing activity, and notes that OneDrive support is available through PowerShell for those reports. Together, this is the Microsoft reporting capability aligned with permissions and active sharing links for OneDrive content.

The other options do not fit this requirement. Microsoft 365 admin center reports focus mainly on usage and activity reporting, not detailed permissions and sharing-link governance. Defender Audit is for security investigation activity, and Purview eDiscovery is for legal and investigative content search, not for generating OneDrive permissions and sharing-link governance reports. Therefore, the best Microsoft-documented answer is Data access governance in the SharePoint admin center .

The correct answers are C and D . Microsoft Learn explains that agents created with Agent Builder in Microsoft 365 Copilot allow you to define specific instructions that extend Microsoft 365 Copilot for a business scenario. Microsoft also documents that you can add knowledge sources such as specific public websites and SharePoint content so the agent can reason over targeted information instead of relying only on the default chat experience. Those two capabilities directly match the needs in options C and D.

Option A is incorrect because grouping chats is a Copilot notebook scenario, not the reason to build an agent. Option B is incorrect in the context of creating an agent in the Microsoft 365 Copilot app . Agent Builder supports declarative agents with instructions, knowledge, and capabilities, but Microsoft Learn describes custom AI model control as part of custom engine agents built with tools such as Copilot Studio, SDKs, or Foundry, not as a standard Agent Builder feature in the Microsoft 365 Copilot app. Therefore, when the task is specifically to create an agent in the app, the valid reasons are custom instructions and reasoning over a specific website .

The correct selections are No, Yes, Yes . Microsoft documents that the Audit page in the Microsoft Defender portal can be used to search the unified audit log for user and admin actions in the organization. Microsoft also states that audit log search in the Defender portal is the same as audit log search in the Microsoft Purview portal , which means both portals can be used to review administrative actions taken in Microsoft 365.

Microsoft further explains that Microsoft Purview Audit enables organizations to search for audit records of activities that users and admins perform across Microsoft services, making it a correct tool for this requirement.

By contrast, Search & intelligence in the Microsoft 365 admin center is not the feature used to investigate administrator actions through the unified audit log. It is not Microsoft’s documented audit search tool for this purpose. Therefore, for this hotspot the right answers are No for Search & intelligence, Yes for Audit in Microsoft Defender, and Yes for Audit in Microsoft Purview.

To use Microsoft 365 Copilot Chat to reason over web data, you need a Microsoft 365 Copilot license. Answer: No

To use the Researcher agent in Microsoft 365 Copilot, you need a Microsoft 365 Copilot license. Answer: Yes

To add an agent in the Microsoft 365 Copilot app, you need a Microsoft 365 Copilot license. Answer: No

The correct selections are No, Yes, No . Microsoft documents that Microsoft 365 Copilot Chat is available at no additional cost for eligible Entra account users with qualifying Microsoft 365 licenses, and that it includes secure AI chat grounded in the web . That means a separate Microsoft 365 Copilot add-on license is not required just to use Copilot Chat over web data.

Statement 2 is Yes because Microsoft states that Researcher is part of the core default experience for Microsoft 365 Copilot licensed users . In other words, access to the Researcher agent requires the Microsoft 365 Copilot license.

Statement 3 is No because Microsoft documents that users can access agents and create them in the Microsoft 365 Copilot app through Copilot Chat, and Microsoft 365 service descriptions state that web-grounded agents are available at no extra cost for commercial users with a qualifying Microsoft 365 license. A Copilot add-on license is required for certain advanced capabilities, but not simply to add an agent in the app in general.