Free AB-900 practice test: 30 questions with answers

Sensitivity labels with auto-labeling detect sensitive information types such as card numbers and can apply protection that limits sharing. Channel tags, message tracking and site descriptions do not classify or protect content.

Retention policies keep content for a defined period regardless of user deletion, which meets a seven-year requirement. DLP blocks or warns on sharing, insider risk identifies behavior, and communication compliance flags messages.

Data classification and content explorer show sensitive information types and where they are stored. Message trace follows mail routing, storage metrics show size, and usage reports show activity counts.

Copilot works within the signed-in user's permissions, so it only uses content that user can access. Mailbox size, page counts and time of day do not determine access.

Data access governance reports identify oversharing, and restricted access control limits who can reach sensitive sites. Storage, home page names and turning off search do not address oversharing.

Insider Risk Management detects risky behavior patterns such as large downloads by users with signals like departures. Retention labels, site templates and recordings do not detect insider risk.

Communication Compliance scans communications for policy violations such as harassment and creates alerts for review. DLP focuses on sensitive data sharing, label scoping applies labels, and audit retention only stores logs.

DSPM for AI provides visibility into AI activity and related sensitive data exposure. Mailbox, channel and site usage reports do not show AI interactions with sensitive content.

Microsoft 365 Copilot is a per-user license on a supported base plan, and pay-as-you-go billing policies can apply to some Copilot experiences. Automatic free access, shared concurrent licenses and no billing visibility are not accurate.

Assigning access to specific users or groups and requiring approval before publication control agent use. Unreviewed availability, public default publishing and uncontrolled sharing bypass governance.

Usage frequency and cost under each model determine which is more economical. Preferences, names and announcement order do not reflect cost or value.

Copilot usage and adoption reports in the admin center and Copilot Analytics show active use and app patterns. Manual lists and wikis are not usage reports, and the recycle bin holds deleted items.

Researcher performs multi-step research across work data and the web and produces a report. Mailbox quotas, Power Apps creation and sign-in blocking are different capabilities.

Analyst works with data in spreadsheets and similar files to answer questions and create insights. Bulk mail, identity provisioning and physical security are not Analyst use cases.

Prompt management lets users save, share and schedule prompts for reuse. Deleting history, font changes and disabling Copilot do not provide prompt reuse.

Organizations that require approval route agents through the approval process before availability. Immediate publication bypasses review, emailing defers without a process, and deletion is unnecessary.

Microsoft 365 Copilot is licensed per user on top of a supported base license, so the user needs the Copilot add-on license. Site settings, mailboxes and distribution groups do not grant Copilot access.

The Microsoft 365 admin center manages domains under Settings, including adding and verifying them. Purview handles compliance, Teams manages collaboration policies, and Power Platform manages environments.

A shared mailbox lets several users read and send mail from one address without a separate license per shared mailbox user. A distribution group only forwards mail, a security group without members does nothing, and journal rules capture messages for archiving.

SharePoint permissions are managed at the site, library and folder levels, and groups make assignment manageable. Mailboxes, channels and journals are not the objects that control document permissions.

Teams policies and team settings control features such as channel creation and meeting options. Mailbox quotas, removing sites and blocking apps do not address the channel requirement.

A team site connected to a Microsoft 365 group gives owners and members manageable permissions with shared resources. Unconnected single-owner sites, personal folders and mailboxes do not provide the same group-based model.

A distribution group delivers messages to multiple recipients without a shared inbox. A shared mailbox provides an inbox that members access, while journal and archive mailboxes serve compliance and storage purposes.

Verify explicitly means checking identity, device health and context for each access decision. Trusting the network and standing administrator access contradict Zero Trust, and disabling authentication removes verification.

Sign-in logs show which conditional access policy applied and why access was blocked, including device compliance. Color settings, channel descriptions and storage quotas do not explain a conditional access block.

Microsoft Entra single sign-on uses the directory to let users authenticate once for many applications. Shared notes, local admin accounts and separate directory-less passwords do not provide SSO.

Privileged Identity Management provides just-in-time, time-bound and approval-based role activation, and reviews of role assignments. The other features do not manage privileged roles.

Identity Secure Score rates the identity configuration against recommended practices and lists improvement actions. User sign-in counts, storage use and meeting counts are unrelated.

Microsoft Entra audit logs record directory changes such as group membership updates and the actor who made them. Chats, home pages and calendars do not record directory changes.

App registrations define the application, and enterprise applications govern its access and consent in the tenant. OneDrive folders, wiki tabs and transport rules do not register applications for Graph access.