AB-900 Sample Questions & Answers
Data protection and governance through Microsoft Purview is weighted heaviest, just ahead of Microsoft 365's core objects and the security principles behind them, and the basic administrative tasks involved in running Copilot and agents.
Launch the full AB-900 simulator →Showing 11 of 22 free samples.
- Question 1Intermediate
Understand Data Protection and Governance Tasks for Microsoft 365 and Copilot · DSPM for AI
A compliance officer wants to identify if employees are using Microsoft 365 Copilot to generate code that might violate intellectual property policies. The officer needs a high-level view of AI usage trends and potential risks associated with AI applications. Which tool in the Microsoft Purview portal provides this specific visibility?
Show answer & explanation
Correct answer: B
DSPM for AI (Data Security Posture Management for AI) is the dedicated tool in Purview for discovering, assessing, and protecting against risks associated with AI usage, including Copilot and third-party AI apps. It provides the specific visibility into AI prompts, usage trends, and associated data risks.
- Question 2Intermediate
Perform Basic Administrative Tasks for Copilot and Agents · Agent creation
You need to create a new custom agent that can answer questions based on a specific SharePoint document library containing product manuals. This agent will be used by the customer support team within Microsoft Teams. Which tool offers the most streamlined 'no-code' experience to build this agent?
Show answer & explanation
Correct answer: D
Copilot Studio (formerly Power Virtual Agents) provides the Agent builder interface, a low-code/no-code environment specifically designed to create agents grounded in specific data sources like SharePoint libraries. This allows creating a targeted agent for the support team without developer skills.
- Question 3Advanced
Understand Data Protection and Governance Tasks for Microsoft 365 and Copilot · Oversharing in SharePoint
Case Study: Fabrikam Residences
Fabrikam Residences is a property management company with 5,000 employees. They are rolling out Microsoft 365 Copilot to their Leasing Department.
Scenario:
The Leasing Department uses a SharePoint site called 'Lease Docs' to store sensitive contracts. The site permissions are currently set to 'Everyone except external users' with Read access because historically, all employees needed to view templates. However, the site now contains signed leases with PII.The IT Director is concerned that Copilot will allow any employee to summarize these signed leases, violating privacy policies. The goal is to restrict Copilot's access to this data without breaking the ability for Leasing agents to search for it manually if needed.
Which immediate action addresses the root cause of this oversharing risk in relation to Copilot?
Show answer & explanation
Correct answer: D
Copilot follows the same permissions as the user. If a user has Read access to a file (via the 'Everyone' group), Copilot can access and summarize it for them. The root cause of 'oversharing' is the broad permission assignment. Restricting the SharePoint site permissions to only the relevant department ensures Copilot only accesses that data for authorized users.
- Question 4IntermediateSelect 2
Perform Basic Administrative Tasks for Copilot and Agents · Copilot license assignment
Which two roles in the Microsoft 365 admin center allow a user to purchase Microsoft 365 Copilot licenses? (Select TWO)
Show answer & explanation
Correct answers: B, C
Microsoft's admin role descriptions say Global Administrators can manage purchasing of the organization's subscriptions and products, and Billing Administrators make purchases, manage subscriptions and service requests, and monitor service health. Purchasing isn't the same as assigning: to assign Copilot licenses to users you need at least the License Administrator or User Administrator role (or Global Administrator), and the Billing Administrator role doesn't include license assignment. Service Support Administrator only opens service requests and monitors service health, and Compliance Administrator manages compliance features, not purchases.
Microsoft's admin role descriptions say Global Administrators can manage purchasing of the organization's subscriptions and products, and Billing Administrators make purchases, manage subscriptions and service requests, and monitor service health. Purchasing isn't the same as assigning: to assign Copilot licenses to users you need at least the License Administrator or User Administrator role (or Global Administrator), and the Billing Administrator role doesn't include license assignment. Service Support Administrator only opens service requests and monitors service health, and Compliance Administrator manages compliance features, not purchases.
- Question 5Beginner
Perform Basic Administrative Tasks for Copilot and Agents · Copilot usage and adoption monitoring
True or False: A business leader must be assigned both a Microsoft 365 Copilot license and a paid Viva Insights license to view the Microsoft Copilot Dashboard in Viva Insights.
Show answer & explanation
Correct answer: B
False. Microsoft's Copilot Dashboard documentation states that the dashboard is available to any customer with a Microsoft 365 or Office 365 subscription for business or enterprise and an active Exchange Online account, and that neither a paid Viva Insights license nor a Microsoft 365 Copilot license is required to view it. The analyzed population is the employees who have a Copilot license assigned, and the features shown depend on how many Copilot (or Viva Insights) licenses the tenant has. People with access open it from the Viva Insights web app by selecting Copilot Dashboard.
- Question 6Beginner
Understand Data Protection and Governance Tasks for Microsoft 365 and Copilot · Retention
An administrator needs to configure a retention policy that ensures all Teams chat messages are deleted after 30 days for legal compliance. Where should the administrator configure this policy?
Show answer & explanation
Correct answer: A
Retention policies for Microsoft 365 workloads, including Teams chats, Teams channel messages, Exchange, SharePoint, and OneDrive, are created centrally in the Microsoft Purview portal under Data Lifecycle Management (the older Microsoft Purview compliance portal is retired). The Teams admin center handles operational settings such as meeting and messaging policies, not data retention and deletion.
- Question 7Intermediate
Identify the Core Features and Objects of Microsoft 365 Services · Troubleshooting common sign-in issues
You are managing a Microsoft 365 tenant. You need to identify which users have the highest risk level based on anomalous sign-in behavior, such as impossible travel or sign-ins from unfamiliar locations. Which report or dashboard should you check?
Show answer & explanation
Correct answer: A
The 'Risky users' report in Microsoft Entra ID (Identity Protection) specifically flags users who have triggered risk detections like impossible travel, unfamiliar locations, or leaked credentials. This is the direct source for this information.
- Question 8Intermediate
Understand Data Protection and Governance Tasks for Microsoft 365 and Copilot · Sensitivity labels in Microsoft Purview
You want to ensure that all documents labeled 'Confidential' are automatically encrypted and can only be accessed by full-time employees. You also want to apply a watermark to these documents. Which Microsoft Purview feature handles these requirements?
Show answer & explanation
Correct answer: B
Sensitivity labels in Microsoft Purview Information Protection are used to classify and protect data. They can enforce encryption (access control) and apply content markings like headers, footers, and watermarks. Retention labels handle lifecycle (delete/keep), not encryption or watermarking.
- Question 9Advanced
Understand Data Protection and Governance Tasks for Microsoft 365 and Copilot · Microsoft Graph influence on Copilot responses
You are explaining the Microsoft 365 Copilot architecture to a client. They ask how Copilot retrieves relevant organization data (emails, files, chats) to answer user prompts without scanning every single file in real-time.
Which component is responsible for indexing and retrieving this data based on user intent?
Show answer & explanation
Correct answer: C
The Semantic Index for Copilot creates a sophisticated map of your user and company data, identifying relationships and connections (e.g., 'Project Alpha' relates to 'Budget.xlsx'). This allows Copilot to perform vector-based retrieval to find conceptually relevant data, not just keyword matches.
flowchart LR User[User Prompt] --> Copilot[Copilot Orchestrator] Copilot --> Graph[Microsoft Graph] Graph --> Semantic[Semantic Index] Semantic --> Data[(M365 Data)] Data --> Copilot Copilot --> LLM[LLM] - Question 10Intermediate
Perform Basic Administrative Tasks for Copilot and Agents · Agent approval process
A developer has submitted a custom agent for approval in the Microsoft 365 admin center. You are the administrator responsible for reviewing it.
Which status must the agent move to before it becomes available for users to install from the organizational catalog?
Show answer & explanation
Correct answer: C
After submission, an admin must approve the app. Once approved, it moves to a 'Published' state in the organization's app catalog, making it discoverable for users.
- Question 11Intermediate
Identify the Core Features and Objects of Microsoft 365 Services · Microsoft Defender XDR
Your organization has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You need to identify a solution that detects lateral movement attacks and compromised identities within your on-premises network using signals captured from domain controllers. Which Microsoft Defender XDR component should you deploy?
Show answer & explanation
Correct answer: B
Microsoft Defender for Identity (formerly Azure ATP) is designed specifically to monitor on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.
Ready for the real thing?
The full AB-900 simulator has every exam-style question, timed mode, and instant scoring.