Microsoft AB-900 Practice Exam

• A. An app registration that lists the project staff as owners
• B. An administrative unit that contains the project staff
• C. A security group that contains the project staff, assigned to the resource Correct answer
• D. A conditional access policy that targets the project staff, applied at sign-in

Option C is correct because a security group lets an administrator grant access to a resource once and have every member inherit it. An app registration describes an application, an administrative unit scopes admin delegation, and a Conditional Access policy controls sign-in conditions rather than granting access to a resource.

• A. A Microsoft Defender XDR detection rule that flags sign-ins from new locations
• B. An Identity Secure Score recommendation that lists MFA as an improvement action
• C. A conditional access policy that requires MFA unless the sign-in comes from a trusted location Correct answer
• D. A Privileged Identity Management rule that requires MFA to activate a role

Option C is correct because a Conditional Access policy can require multifactor authentication unless the sign-in comes from a trusted location, which covers sign-ins away from the corporate network. A Defender XDR rule only detects, Identity Secure Score only recommends, and a PIM rule applies MFA only when someone activates a privileged role.

• A. Let users reset a forgotten password without help desk support
• B. Publish on-premises web applications to remote users
• C. Give users just-in-time and time-limited access to privileged roles Correct answer
• D. Detect leaked credentials and mark affected users as high risk

Option C is correct because Privileged Identity Management provides just-in-time, time-bound access to privileged roles. Password reset, publishing on-premises web apps and detecting leaked credentials are handled by other Microsoft Entra features.

• A. FIDO2 security key Correct answer
• B. SMS text message
• C. Email one-time passcode
• D. Windows Hello for Business Correct answer
• E. Voice call

Options A and D are correct because FIDO2 security keys and Windows Hello for Business are on Microsoft's list of phishing-resistant authentication methods. SMS text messages, email one-time passcodes and voice calls are traditional methods that attackers can phish or relay.

• A. Named locations for trusted networks
• B. Authentication methods policy for the user, set per user
• C. Role-based access control with built-in roles, assigned to the administrator Correct answer
• D. Conditional Access with a grant control

Option C is correct because Microsoft Entra role-based access control lets an administrator assign a built-in role, such as Exchange Administrator, that carries only the permissions for that job. Named locations, the authentication methods policy and Conditional Access grant controls govern sign-in conditions, not what an administrator may manage.

• A. Security group Correct answer
• B. Microsoft 365 group
• C. Mail-enabled security group
• D. Distribution group

Option A is correct because security groups grant access to resources such as SharePoint sites and can contain users or devices. Mail-enabled security groups cannot contain devices, Microsoft 365 groups contain only users, and distribution groups are for sending email.

• A. Security Administrator
• B. User Administrator
• C. Global Administrator Correct answer
• D. Compliance Administrator

Option C is correct because the Global Administrator role can manage all aspects of Microsoft Entra ID and the Microsoft services that use Entra identities. Security, User and Compliance Administrators manage only their own areas.

• A. Sensitivity labels published to users Correct answer
• B. Retention labels that keep files for a set period
• C. A DLP policy that blocks external sharing from SharePoint
• D. A communication compliance policy for chat messages

Option A is correct because a sensitivity label can apply encryption and markings that travel with the file wherever it is shared. Retention labels only govern how long content is kept, a DLP policy blocks sharing but does not protect the file itself, and communication compliance reviews messages rather than documents.

• A. Content from all tenant sites, including sites the user cannot open
• B. Public web results, with no access to files, mail or chats
• C. Content the user authored, but not files that others shared with them
• D. Content the user has permission to open, such as files, mail and chats Correct answer

Option D is correct because Microsoft 365 Copilot only surfaces organizational data that the signed-in user already has at least view permission to open. It does not bypass SharePoint permissions, so it cannot reach sites the user cannot open, and it is not limited to the user's own content or to the public web.

• A. A DLP policy that moves email older than seven years to the archive
• B. A sensitivity label that ends encryption after seven years
• C. A retention policy with a seven-year retain-then-delete action Correct answer
• D. An eDiscovery hold placed on the department mailboxes

Option C is correct because a retention policy with a retain-then-delete action keeps email for the set period and then removes it automatically. A DLP policy and a sensitivity label do not manage retention periods, and an eDiscovery hold preserves content without any automatic deletion.

• A. File and site permissions in SharePoint Correct answer
• B. Sensitivity labels that apply encryption Correct answer
• C. Retention policies applied to Exchange mailboxes
• D. Audit log retention settings
• E. Compliance Manager improvement actions

Options A and B are correct because Copilot honors the permissions on the underlying content and the usage rights of encrypted items. SharePoint file and site permissions decide what a user can open, and a label that applies encryption only returns content to users who hold the EXTRACT usage right. Retention policies, audit log retention and Compliance Manager actions do not restrict what Copilot can read.

• A. Site permissions across your organization
• B. Sensitivity label applied to files
• C. Shared with 'Everyone except external users'
• D. Sharing links Correct answer

Option D is correct because the Sharing links activity report lists the sites where the most new Anyone, organization-wide and specific-people links were created in the last 28 days. The site permissions report is a point-in-time snapshot, the sensitivity label report shows labeled files, and the Everyone except external users report covers a different kind of sharing.

• A. Insider Risk Management
• B. Data Security Investigations
• C. Communication Compliance
• D. DSPM for AI Correct answer

Option D is correct because Data Security Posture Management for AI (DSPM for AI) gives insight into how Copilot and other generative AI apps are used and offers one-click policies to start protecting data. Insider Risk Management, Data Security Investigations and Communication Compliance are different Purview solutions that do not provide this AI usage overview.

• A. The Microsoft Purview browser extension, deployed to Windows users
• B. A Microsoft 365 Copilot license, assigned to each user in scope
• C. Devices onboarded to Microsoft Purview for endpoint visibility
• D. The enterprise version of Microsoft Purview data governance Correct answer
• E. A collection policy that captures prompts and responses from Microsoft Copilot experiences Correct answer

Options D and E are correct because capturing prompts and responses from Copilot in Fabric and Security Copilot needs the enterprise version of Microsoft Purview data governance and a collection policy. The browser extension and onboarded devices apply to third-party AI sites, and a Microsoft 365 Copilot license applies to Microsoft 365 Copilot.

• A. In the Microsoft 365 admin center, on the user's Licenses and apps tab Correct answer
• B. In the Microsoft Purview portal, in the user's role group settings
• C. In the Power Platform admin center, on the Licensing page for Copilot Studio
• D. In the Exchange admin center, on the user's mailbox features page

Option A is correct because Copilot licenses are assigned in the Microsoft 365 admin center, either on a user's Licenses and apps tab or on the Billing > Licenses page. The Purview role group settings, the Power Platform admin center Licensing page (which covers Copilot Studio capacity) and the Exchange mailbox features page do not assign Microsoft 365 Copilot to a user.

• A. A usage-based billing spending policy that is linked to a security group
• B. A Power Platform capacity add-on assigned to the tenant
• C. A billing policy that is linked to an Azure subscription Correct answer
• D. A Copilot add-on license assigned to a security group

Option C is correct because pay-as-you-go billing needs a billing policy that links an Azure subscription to the users or groups who are charged. A spending policy governs Copilot credits for usage-based billing, a Power Platform capacity add-on is a different purchase, and a Copilot add-on license is a fixed per-user fee instead of metered use.

• A. A custom agent that uses the SharePoint site as its knowledge Correct answer
• B. The Analyst agent, which runs code on data files from a SharePoint site
• C. Copilot Chat with the policy pages pasted into each prompt
• D. The Researcher agent, which builds reports from web and SharePoint content

Option A is correct because an agent that answers from a SharePoint site and follows written instructions is a declarative agent that uses the site as its knowledge. The Analyst agent works on data files, Copilot Chat with pasted pages is manual and cannot carry the team's instructions, and the Researcher agent builds multi-step reports rather than following team instructions.

• A. Microsoft Copilot diagnostics logs under Copilot settings
• B. Microsoft Copilot self-service purchases under Copilot settings
• C. Microsoft Copilot Frontier under Copilot settings
• D. Microsoft Copilot Dashboard in Viva Insights Correct answer
• E. Microsoft Copilot usage report in the Microsoft 365 admin center Correct answer

Options D and E are correct because the Microsoft Copilot Dashboard in Viva Insights and the Microsoft Copilot usage report in the Microsoft 365 admin center show how often people use Copilot and how widely it is adopted. The diagnostics logs, self-service purchases and Frontier settings under Copilot settings do not report usage or adoption.

• A. Agent feedback sharing
• B. Sharing
• C. User access Correct answer
• D. Agent and plugin access

Option C is correct because User access controls which users or groups can access and install agents and plugins. Agent feedback sharing controls feedback to developers, Sharing controls who can share Agent Builder agents, and Agent and plugin access controls which categories of agents appear.

• A. No users in the organization
• B. Specific users or groups Correct answer
• C. All users in the organization
• D. Selected agents from the registry

Option B is correct because Specific users or groups lets the administrator choose the Sales group, and only the selected users can use agents and plugins. All users is the default and allows everyone, and No users blocks everyone. Selected agents is an option of Agent feedback sharing, not of User access.