Free AB-900 sample questions

Correct answer: Verify explicitly

The principle of 'Verify explicitly' requires that all access requests be fully authenticated, authorized, and encrypted before granting access. This matches the scenario where the administrator wants to verify every request regardless of origin. 'Assume breach' focuses on minimizing blast radius and segmenting access, while 'Use least privilege access' focuses on limiting user permissions to only what is necessary.

Correct answer: Purchase Microsoft 365 Copilot add-on licenses for the existing E3 users

Microsoft 365 Copilot is available as an add-on license. Since the users already have a prerequisite license (Microsoft 365 E3) and do not need the other features of E5, purchasing the Copilot add-on is the most cost-effective and direct solution. Upgrading to E5 would incur unnecessary costs for features not required.

Correct answer: Conditional Access

Conditional Access policies in Microsoft Entra ID allow administrators to create if-then statements (signals to decisions) to enforce access controls. This scenario describes a classic Conditional Access policy: IF location is X AND device is Y, THEN Grant/Block access. Identity Protection focuses more on risk-based events like leaked credentials.

Correct answer: Customer prompts and data are not used to train the foundation LLMs.

A core security principle of Microsoft 365 Copilot is that customer data (prompts and grounding data) is NOT used to train the foundation Large Language Models (LLMs). The data remains within the tenant boundary and is only used to generate the specific response for that user session.

Correct answer: Data Loss Prevention (DLP)

Data Loss Prevention (DLP) is designed specifically to detect sensitive information types (like credit card numbers) and apply protective actions, such as blocking the transmission of that data in Teams chats. Communication Compliance is for detecting inappropriate conduct (harassment, threats), not necessarily structured sensitive data types like credit cards.

Correct answer: Data Security Posture Management (DSPM) for AI

DSPM for AI (Data Security Posture Management for AI) is the dedicated tool in Purview for discovering, assessing, and protecting against risks associated with AI usage, including Copilot and third-party AI apps. It provides the specific visibility into AI prompts, usage trends, and associated data risks.

Correct answer: Copilot Studio (Agent builder)

Copilot Studio (formerly Power Virtual Agents) provides the Agent builder interface, a low-code/no-code environment specifically designed to create agents grounded in specific data sources like SharePoint libraries. This allows creating a targeted agent for the support team without developer skills.

Correct answer: Remove 'Everyone except external users' from the site permissions and assign access only to the Leasing Department security group.

Copilot follows the same permissions as the user. If a user has Read access to a file (via the 'Everyone' group), Copilot can access and summarize it for them. The root cause of 'oversharing' is the broad permission assignment. Restricting the SharePoint site permissions to only the relevant department ensures Copilot only accesses that data for authorized users.

Correct answers: Global Administrator; Billing Administrator

Microsoft's admin role descriptions say Global Administrators can manage purchasing of the organization's subscriptions and products, and Billing Administrators make purchases, manage subscriptions and service requests, and monitor service health. Purchasing isn't the same as assigning: to assign Copilot licenses to users you need at least the License Administrator or User Administrator role (or Global Administrator), and the Billing Administrator role doesn't include license assignment. Service Support Administrator only opens service requests and monitors service health, and Compliance Administrator manages compliance features, not purchases.

Microsoft's admin role descriptions say Global Administrators can manage purchasing of the organization's subscriptions and products, and Billing Administrators make purchases, manage subscriptions and service requests, and monitor service health. Purchasing isn't the same as assigning: to assign Copilot licenses to users you need at least the License Administrator or User Administrator role (or Global Administrator), and the Billing Administrator role doesn't include license assignment. Service Support Administrator only opens service requests and monitors service health, and Compliance Administrator manages compliance features, not purchases.

Correct answer: False

False. Microsoft's Copilot Dashboard documentation states that the dashboard is available to any customer with a Microsoft 365 or Office 365 subscription for business or enterprise and an active Exchange Online account, and that neither a paid Viva Insights license nor a Microsoft 365 Copilot license is required to view it. The analyzed population is the employees who have a Copilot license assigned, and the features shown depend on how many Copilot (or Viva Insights) licenses the tenant has. People with access open it from the Viva Insights web app by selecting Copilot Dashboard.

Correct answer: Microsoft Purview portal (Data Lifecycle Management)

Retention policies for Microsoft 365 workloads, including Teams chats, Teams channel messages, Exchange, SharePoint, and OneDrive, are created centrally in the Microsoft Purview portal under Data Lifecycle Management (the older Microsoft Purview compliance portal is retired). The Teams admin center handles operational settings such as meeting and messaging policies, not data retention and deletion.