Free Microsoft AB-900 Practice Exam with Questions & Answers | Set: 2

The correct answer is A. the SharePoint admin center . Microsoft documents that the SharePoint admin center includes Data access governance reports and site-level sharing reports that help administrators identify where content is shared externally. Microsoft also documents that every standard Microsoft Teams team is connected to a SharePoint site for file storage and collaboration. Because Teams files and many sharing scenarios for teams are backed by SharePoint sites, the SharePoint admin center is the correct place to investigate which sites are shared externally, including Teams-connected SharePoint sites .

The other options are less suitable for this requirement. The Teams admin center is primarily for Teams policy, user, device, and workload administration, but it is not the main portal Microsoft documents for identifying externally shared site content. The Microsoft 365 admin center focuses on broad tenant administration and usage reporting, and the Microsoft Defender portal is for security investigation rather than SharePoint/Teams sharing governance. For identifying externally shared SharePoint sites and Teams-connected sites, Microsoft’s documented reporting path is the SharePoint admin center .

The correct answer is B. the Microsoft Purview DSPM for AI solution . Microsoft documents that Data Security Posture Management for AI (DSPM for AI) in Microsoft Purview provides a central place to secure data for AI apps and proactively monitor AI use , including Copilots and agents . Microsoft also states that DSPM for AI helps organizations identify where sensitive content is used in AI interactions , review Copilot prompts and responses , analyze usage patterns , assess exposure and oversharing risks, and get recommendations for protections such as sensitivity labels and DLP policy coverage.

The other options do not fit this requirement. Microsoft Viva Insights focuses on productivity and work-pattern analytics, not sensitive-data protection in Copilot interactions. Microsoft Security Copilot is a security assistant for analysts, not the Purview governance solution that analyzes sensitive content use in Copilot and recommends data protections. Insider Risk Management is for identifying risky user behavior, not for broad AI interaction posture analysis and protection recommendations. Microsoft specifically positions DSPM for AI as the “front door” for discovering, monitoring, and protecting AI-related data usage in Microsoft 365 Copilot.

The correct answer is D. Data Lifecycle Management . Microsoft Learn states that Microsoft Purview retention policies and retention labels, managed under Data Lifecycle Management , support three core outcomes: retain-only , delete-only , and retain and then delete . The requirement in this question is exact: keep email for seven years and then permanently delete it. That is a textbook retain and then delete retention configuration, which Microsoft documents as part of Purview’s retention capabilities. Microsoft also recommends using Microsoft 365 retention policies and labels for retaining and deleting emails rather than relying on older Exchange-only approaches in most modern compliance scenarios.

The other options do not meet the requirement. Information Protection focuses on labeling and protecting sensitive information. Insider Risk Management is used to detect and investigate risky user behavior. Data Loss Prevention helps prevent inappropriate sharing or exfiltration of sensitive data. None of those are designed to enforce a timed seven-year retention period followed by automatic permanent deletion. The Microsoft Purview solution explicitly built for that lifecycle requirement is Data Lifecycle Management .

The correct answer is D. the Microsoft 365 admin center . Microsoft Learn states that users with a Microsoft 365 Copilot license can use Copilot capabilities, and Microsoft specifically points administrators to the Microsoft 365 admin center and its setup guidance to assign the required licenses to users. Microsoft also documents that the Researcher and Analyst agents were deployed to existing users with Microsoft 365 Copilot licenses and that administrators govern these agents through the Microsoft 365 admin center .

The other portals are not the primary place for this task. Microsoft Entra admin center focuses on identity and access, Microsoft Purview focuses on compliance and governance, and Microsoft Defender focuses on security operations and threat protection. None of those is the main admin experience Microsoft documents for assigning Microsoft 365 Copilot access and managing the availability of Researcher and Analyst. Because the goal is to enable a user to use Microsoft 365 Copilot and its Microsoft-provided agents, the correct administrative tool is the Microsoft 365 admin center .

The correct answer is B. the Microsoft Defender portal. Microsoft Purview DLP policies can generate alerts when rule conditions are matched. Microsoft states that DLP alerts can be investigated and managed in both Microsoft Defender XDR and the Microsoft Purview portal, but the Defender XDR dashboard is the recommended location for investigating and managing DLP alerts. That fits the requirement to view alert details and understand how the alert relates to other alerts, because Defender provides the incident and alert investigation experience. Microsoft Intune is used for endpoint and app management. Microsoft Entra is used for identity and access administration. The Microsoft 365 admin center is used for tenant administration and reporting, not DLP alert correlation.

provide control over how users can access cloud apps.

The correct answer is provide control over how users can access cloud apps . Microsoft Learn defines Microsoft Entra Conditional Access as the Zero Trust policy engine that uses if-then logic to make access decisions. Microsoft states that Conditional Access policies determine who can access resources, what resources they can access, and under what conditions . These policies can require actions such as multifactor authentication, compliant devices, or other controls before allowing access to applications and services like Microsoft 365. That means Conditional Access is specifically used to control how users access cloud apps .

The other options are incorrect. Conditional Access policies are not configured by using the Microsoft Defender portal ; they are managed in the Microsoft Entra admin center . They are also not applied only to on-premises resources , because Microsoft documents Conditional Access primarily for cloud identities, cloud apps, and cloud-connected resources. Finally, Conditional Access does not require a Microsoft Exchange mailbox. It can be applied broadly across many Microsoft and third-party cloud applications integrated with Microsoft Entra.

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft’s recommended identity security best practices.

Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.

Communications Compliance uses OCR (optical character recognition) and machine learning to detect offensive or risky text inside images , including those in SharePoint and OneDrive.

By default, Communications Compliance pseudonymizes user identities to reduce investigator bias. Admins can later deanonymize if needed.

It does not add disclaimers. It silently monitors communications and flags policy violations; disclaimers are handled by Exchange transport rules, not Communications Compliance.

the Microsoft Authenticator app

The correct answer is the Microsoft Authenticator app . The image shows the familiar Microsoft MFA prompt that says “Are you trying to sign in?” and “Enter the number shown to sign in.” Microsoft documents this as number matching in Authenticator push notifications , which is part of Microsoft Entra multifactor authentication using the Microsoft Authenticator app . Microsoft explains that number matching is a security improvement for Authenticator push approvals and is used when the default sign-in method is Authenticator push notifications.

The other choices do not match the experience shown. Email OTP would involve a one-time code sent by email. SMS would send a text message code to a phone number. Temporary Access Pass is a time-limited passcode used for onboarding or recovery scenarios, not the mobile push screen shown in the image. Because the graphic specifically shows a mobile approval prompt with number matching, the MFA method is clearly the Microsoft Authenticator app .

The correct selections are No, No, Yes . Microsoft states that in Microsoft 365 Copilot and Microsoft 365 Copilot Chat, prompts and responses aren’t used to train the underlying foundation models . Microsoft also documents that Copilot works within the Microsoft 365 service boundary and that data accessed through Microsoft Graph isn’t used to train foundation models . That makes statements 1 and 2 No .

Statement 3 is Yes because Microsoft documents that Microsoft 365 Copilot honors the same data protection, access control, and compliance capabilities that apply across Microsoft 365. Microsoft also states that Copilot only surfaces organizational data that users already have permission to access, including content retrieved through Microsoft Graph in services such as SharePoint, OneDrive, Exchange, and Teams.