Free Microsoft AB-900 Practice Exam with Questions & Answers

The correct answer is B. Data explorer. Microsoft Learn states that Data explorer in Microsoft Purview shows a current snapshot of items that have been classified as a sensitive information type in your organization. Microsoft’s sensitive information type documentation specifically lists examples such as social security numbers and credit card numbers, which means Data explorer is the appropriate portal feature for identifying files and emails that contain those data types. Data explorer is designed to help administrators see where sensitive data exists across supported Microsoft 365 locations.

The other options are less appropriate for this task. Information Protection reports focus more broadly on label and protection reporting. Information Protection policies are for configuring classification and protection behavior, not for finding existing files and emails containing SSNs or credit card numbers. Activity explorer is primarily used to review user and policy-related activities, such as label changes or DLP events, rather than to provide the direct sensitive-data inventory view requested here. Since the question asks to identify the files and emails containing specific sensitive information types, Microsoft’s documented answer is Data explorer.

The correct answer is D. the Analyst agent in Microsoft 365 Copilot . Microsoft Learn training for Microsoft 365 Copilot specifically distinguishes the Analyst agent as the tool for gathering insights from data and enhancing data presentations. Microsoft’s guidance also notes in the Researcher FAQ that when the task is spreadsheet-related , Analyst agent is better suited for Microsoft Excel related tasks . This makes Analyst the best choice for a quarterly sales reporting scenario that involves detecting performance trends , surfacing anomalies , and producing visual insights from multiple datasets.

The other options are less suitable. Researcher is intended for complex multi-step research and source-cited reports across web and work content, not specialized data analysis across files. Microsoft 365 Copilot Search is for finding information, not for deep quantitative analysis and anomaly summarization. Copilot in Excel is powerful for workbook-level analysis, but the question emphasizes broader insight generation across multiple files and asks for the best Copilot experience for trends, visuals, and anomaly summaries. Microsoft positions Analyst as the dedicated agent for that kind of data-analysis workflow.

The correct answer is C. Run the prompt. Scheduled prompts in Microsoft 365 Copilot are based on an existing Copilot prompt interaction. The practical workflow is to run the prompt first, then use the scheduling option for that prompt to define when and how often it should run, such as midnight. Saving a prompt is useful for reuse, but the question asks what task must be included to schedule a prompt execution. Creating an agent is a separate customization workflow and is not required to schedule a normal Copilot prompt. Creating a notebook is also unrelated; notebooks organize materials and chats but do not create a scheduled prompt run by themselves. The required action is to run the prompt so it can be scheduled.

Prevent users from sharing PII: Data Loss Prevention

Use machine learning to train a model: Information Protection

The correct selections are Data Loss Prevention and Information Protection . Microsoft states that Microsoft Purview Data Loss Prevention (DLP) helps organizations identify, monitor, and automatically protect sensitive information, including preventing people from sharing sensitive items such as PII in Microsoft 365 locations and other supported channels. That directly matches the requirement to stop users from sharing files that contain personally identifiable information.

For the second requirement, the correct choice is Information Protection because Microsoft Purview’s classification and labeling capabilities include trainable classifiers , which Microsoft describes as a tool you can train using machine learning to recognize types of sensitive or business content. Microsoft positions these classification capabilities under Microsoft Purview Information Protection and data classification. That makes Information Protection the best fit for “use machine learning to train a model that detects sensitive content.”

The other options are not the best match here. Communication Compliance monitors risky communications, DSPM for AI focuses on AI posture and exposure, and Insider Risk Management detects risky user behavior rather than blocking PII sharing or training classifiers.

The correct answer is B. data loss prevention (DLP) policies . Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices . Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.

Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft’s documented solution is DLP policies .

The correct selections are Yes, Yes, Yes . For statement 1, Microsoft Support explains that if you are not a site owner, you might still be able to invite other people to the site , although the invitation can generate an access request that a site owner approves or declines. Microsoft also states that site users have the opportunity to invite other people to collaborate on sites , unless that feature is disabled. That makes the statement true.

For statement 2, Microsoft Learn states that in SharePoint you can give people permissions to a site by adding individual users, security groups, or Microsoft 365 groups to one of the three SharePoint groups, including the Members group. That directly supports the statement.

For statement 3, Microsoft documents that site ownership and membership can be managed by adding or removing owners, members, site owners, site members, and site visitors . For group-connected sites, Microsoft also documents that owners can manage group ownership and remove owner status. Therefore, a site owner can remove another site owner, provided at least one owner remains.

The correct answers are C and D . Microsoft Learn explains that agents created with Agent Builder in Microsoft 365 Copilot allow you to define specific instructions that extend Microsoft 365 Copilot for a business scenario. Microsoft also documents that you can add knowledge sources such as specific public websites and SharePoint content so the agent can reason over targeted information instead of relying only on the default chat experience. Those two capabilities directly match the needs in options C and D.

Option A is incorrect because grouping chats is a Copilot notebook scenario, not the reason to build an agent. Option B is incorrect in the context of creating an agent in the Microsoft 365 Copilot app . Agent Builder supports declarative agents with instructions, knowledge, and capabilities, but Microsoft Learn describes custom AI model control as part of custom engine agents built with tools such as Copilot Studio, SDKs, or Foundry, not as a standard Agent Builder feature in the Microsoft 365 Copilot app. Therefore, when the task is specifically to create an agent in the app, the valid reasons are custom instructions and reasoning over a specific website .

The correct answers are A and D because both tasks are supported directly in the Exchange admin center (EAC) . Microsoft Learn states that administrators can manage mail flow rules in Exchange Online from the EAC under Mail flow > Rules , which includes creating and managing transport rules for organizational email handling. Microsoft Learn also states that administrators can create shared mailboxes in the EAC under Recipients > Mailboxes , where a shared mailbox can be added and then delegated to users.

Option B is incorrect because adding a custom domain is normally done in the Microsoft 365 admin center , specifically on the Domains page. Although Exchange can later work with accepted domains and related mail flow settings, the act of adding and verifying a custom domain is not an Exchange admin center task. Option C is incorrect because license assignment is handled through Microsoft 365 or Microsoft Entra administrative tools, not the Exchange admin center.

The correct answer is C. the Microsoft 365 admin center . Microsoft Learn documents a specific Copilot image generation setting in the Microsoft 365 admin center under Copilot > Settings > Copilot actions > Copilot image generation . Microsoft states that when this scenario is allowed, users can ask Copilot to create, design, and edit images. When it is not allowed, Copilot does not generate images and instead responds with stock or brand images. This directly matches the requirement to prevent users from generating images by using Copilot.

The other options are incorrect because Microsoft does not document this control as being managed from Defender, Purview, or Entra for this scenario. Microsoft also separately notes that organizations can control access to Designer image generation through policy, but the admin experience for managing the Microsoft 365 Copilot scenario itself is explicitly surfaced in the Microsoft 365 admin center . Therefore, for an exam question focused on where an admin should go to disable image generation in Copilot, the best and documented answer is the Microsoft 365 admin center .

The correct selections are No, No, Yes . Microsoft states that for Microsoft 365 Copilot , customer prompts, responses, and Microsoft Graph grounding data aren’t used to train foundation models . Microsoft also explains that Copilot processes organizational data within the service boundary and applies the same commitments that protect Microsoft 365 customer data. That makes statements 1 and 2 No . Microsoft further documents that Microsoft 365 Copilot grounds responses using Microsoft Graph and only surfaces data that the user is permitted to access , so it respects existing identity, access, and permission controls in the tenant. That makes statement 3 Yes .

This behavior is a core part of Copilot’s enterprise design. Microsoft describes Copilot as inheriting your organization’s existing Microsoft 365 permissions model, including access controls on content in SharePoint, OneDrive, Exchange, Teams, and other Microsoft 365 services. So Copilot does not grant new access; it works within the permissions already assigned to the signed-in user.