Free and Premium Microsoft AB-900 Dumps Questions Answers

provide control over how users can access cloud apps.

The correct answer is provide control over how users can access cloud apps . Microsoft Learn defines Microsoft Entra Conditional Access as the Zero Trust policy engine that uses if-then logic to make access decisions. Microsoft states that Conditional Access policies determine who can access resources, what resources they can access, and under what conditions . These policies can require actions such as multifactor authentication, compliant devices, or other controls before allowing access to applications and services like Microsoft 365. That means Conditional Access is specifically used to control how users access cloud apps .

The other options are incorrect. Conditional Access policies are not configured by using the Microsoft Defender portal ; they are managed in the Microsoft Entra admin center . They are also not applied only to on-premises resources , because Microsoft documents Conditional Access primarily for cloud identities, cloud apps, and cloud-connected resources. Finally, Conditional Access does not require a Microsoft Exchange mailbox. It can be applied broadly across many Microsoft and third-party cloud applications integrated with Microsoft Entra.

The correct answers are B and C . Microsoft documents that Identity Secure Score in Microsoft Entra is based on identity security recommendations, including recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” Those recommendations directly map to the number of global administrators and whether passwords are set to never expire , so both factors affect the score.

Option A is incorrect because SharePoint site permissions are part of SharePoint content and collaboration security, not a direct factor in the Microsoft Entra Identity Secure Score model. Option D is also incorrect because the location of users can be used in Conditional Access and other access control decisions, but Microsoft does not list user geographic location itself as a direct Identity Secure Score recommendation. Identity Secure Score is driven by Entra identity best-practice checks and recommendations rather than by SharePoint permission structure or user location data.

The correct answer is A . Microsoft Learn defines Zero Trust as a security strategy built on the principles verify explicitly , use least privilege access , and assume breach . Microsoft also summarizes Zero Trust as a model that assumes breach and verifies every request , rather than trusting users, devices, or traffic simply because they originate from inside the corporate network. This is the key reason option A is correct. Under Zero Trust, every access request should be evaluated continuously using available signals such as identity, device state, location, service, and risk.

Option B is incorrect because improving user experience is not the defining principle of Zero Trust. Option C is incorrect because Zero Trust requires ongoing review and adjustment of permissions, especially through least privilege and risk-based access. Option D is incorrect because Zero Trust explicitly rejects implicit trust based on network location. Microsoft states that organizations should reduce reliance on the traditional idea that anything on the internal network is automatically safe or trustworthy.

The correct answers are A and D . Microsoft documents that with group-based licensing , licenses assigned to a group are automatically inherited by the group’s members. Therefore, if User1 is added to Group1 , User1 can receive the Microsoft 365 E3 license through group membership. Microsoft also documents that licenses can be assigned directly to individual users , so assigning a Microsoft 365 E3 license straight to User1 is also a complete solution.

Options B and C are incorrect because Conditional Access controls how users access cloud resources after sign-in; it does not grant product entitlements or service licenses. Microsoft licensing guidance separates access-policy controls from actual license assignment. In this scenario, the issue is lack of license entitlement, not access conditions. As a result, the valid solutions are either to make User1 a member of the licensed group or to assign the license directly to User1. Microsoft also notes that group-based licensing assignment can fail if required user properties such as usage location are missing, but among the available answer choices, the two complete license-granting actions are Add User1 to Group1 and Assign a license to User1 .

The correct answer is B. data loss prevention (DLP) policies . Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices . Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.

Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft’s documented solution is DLP policies .

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft’s recommended identity security best practices.

Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.

The correct answer is Microsoft SharePoint sites . Microsoft Learn documents that Microsoft Purview sensitivity labels for containers can be applied to Microsoft Teams, Microsoft 365 groups, and SharePoint sites . These labels can control settings such as privacy, external sharing, and unmanaged device access for the labeled site. That is the official Microsoft feature that matches the sentence in the question.

The other options are not the best match for this item. Microsoft 365 Copilot conversations are not the standard object to which admins directly apply a sensitivity label in the way this question is asking. Copilot can honor labels on source content and may display label context in responses, but the selectable resource here is not “Copilot conversations.” Azure Blob Storage is also not the intended answer in the Microsoft 365 Copilot and Agent Admin context for Purview sensitivity labels.

So for this hotspot, the sentence is correctly completed with Microsoft SharePoint sites , because Microsoft explicitly supports applying Purview sensitivity labels to SharePoint sites as a container-level labeling capability.

The correct answer is D. the Microsoft 365 admin center . Microsoft Learn states that users with a Microsoft 365 Copilot license can use Copilot capabilities, and Microsoft specifically points administrators to the Microsoft 365 admin center and its setup guidance to assign the required licenses to users. Microsoft also documents that the Researcher and Analyst agents were deployed to existing users with Microsoft 365 Copilot licenses and that administrators govern these agents through the Microsoft 365 admin center .

The other portals are not the primary place for this task. Microsoft Entra admin center focuses on identity and access, Microsoft Purview focuses on compliance and governance, and Microsoft Defender focuses on security operations and threat protection. None of those is the main admin experience Microsoft documents for assigning Microsoft 365 Copilot access and managing the availability of Researcher and Analyst. Because the goal is to enable a user to use Microsoft 365 Copilot and its Microsoft-provided agents, the correct administrative tool is the Microsoft 365 admin center .

The correct answer is C. Insider Risk Management . Microsoft documents that Microsoft Purview Insider Risk Management helps organizations detect, investigate, and act on potentially risky internal activities, including data theft and data leakage . Microsoft specifically provides policy templates for departing users , describing scenarios where users who are leaving an organization might download files, print files, or copy data to personal cloud storage or messaging services near their resignation or end date. That matches this question exactly, where User1 is leaving in two weeks and you need to determine whether the user is exfiltrating data.

The other options do not fit. Communication Compliance is for reviewing risky communications, Data Security Posture Management focuses on broader data exposure posture, and Data Lifecycle Management is for retention and deletion. None of those is the Microsoft Purview solution specifically built to monitor suspicious user activity and data exfiltration risk for departing employees. Microsoft positions Insider Risk Management as the correct tool for this scenario.

The correct answer is eDiscovery . In Microsoft Purview, eDiscovery is the solution used to search for content and export copies of that content from Microsoft 365 locations such as SharePoint and OneDrive. Microsoft Learn states that when you export search results from eDiscovery, copies of native Office documents and other documents are exported . That directly matches the requirement to provide HR with a copy of files .

By contrast, Audit is primarily used to investigate user and admin activity records and can export those audit records to CSV , but it does not export the actual files themselves. Audit would help identify that User1 modified files, but the question asks for copies of the recent files modified by User1 , which is an eDiscovery content search and export scenario rather than an activity-log reporting scenario.

So, among the Microsoft Purview solutions shown, the appropriate selection is eDiscovery because it is the Purview tool designed to find and export the actual content items HR wants to receive.

The correct answer is D. a sensitivity label policy . In Microsoft Purview, creating a sensitivity label by itself does not make it available to users. Microsoft Learn states that after you create sensitivity labels, you must publish them by creating a label policy so that users and groups can see and apply those labels in Microsoft 365 apps and services. Publishing controls which labels are available and to whom they are shown. This is why a sensitivity label policy is required to ensure that users can apply Label1 to files.

The other options do not meet the requirement. Auto-labeling policies apply labels automatically when content matches conditions, but they are not the primary mechanism for simply making a label available for user selection. A trainable classifier is used to identify content categories, not to publish a label. A retention label policy publishes retention labels for records and lifecycle purposes, which is different from sensitivity labeling for classification and protection. Therefore, the correct Microsoft-documented method to let users apply Label1 to files is to publish it using a sensitivity label policy .

The correct selections are No, No, Yes . Microsoft states that in Microsoft 365 Copilot and Microsoft 365 Copilot Chat, prompts and responses aren’t used to train the underlying foundation models . Microsoft also documents that Copilot works within the Microsoft 365 service boundary and that data accessed through Microsoft Graph isn’t used to train foundation models . That makes statements 1 and 2 No .

Statement 3 is Yes because Microsoft documents that Microsoft 365 Copilot honors the same data protection, access control, and compliance capabilities that apply across Microsoft 365. Microsoft also states that Copilot only surfaces organizational data that users already have permission to access, including content retrieved through Microsoft Graph in services such as SharePoint, OneDrive, Exchange, and Teams.

The correct answer is D. From the Finance site, configure permissions . Microsoft states that Microsoft 365 Copilot honors existing Microsoft 365 permissions and only grounds responses in content that the signed-in user is already allowed to access. That means if users are getting Finance-site content in Copilot responses, those users likely still have permission to that SharePoint content. The direct fix is to review and correct the site, library, folder, or file permissions on the Finance site so only the intended users retain access.

The other options do not directly solve this requirement. Information Barriers are designed for communication and collaboration segmentation scenarios, not for ordinary site-level oversharing remediation. A Defender data connector is unrelated to SharePoint permission enforcement. Conditional Access controls sign-in and session access conditions, but it does not selectively remove Copilot grounding from one SharePoint site for users who still have site permissions. Because Copilot uses SharePoint and Microsoft Graph permissions as its boundary, the Microsoft-documented corrective action is to fix the Finance site permissions .

The correct answer is View all the users in the Microsoft Entra tenant . In the exhibit, John is assigned the Global Reader role. Microsoft documents that the Global Reader role is intended for users who need to view administrator features and settings in admin centers that a Global Administrator can view, but without edit permissions. That makes it appropriate for read-only visibility into tenant-wide directory and admin information, including users in Microsoft Entra.

The other answer choices are not supported by the Global Reader role. Microsoft distinguishes admin-center visibility from access to content in workloads such as SharePoint sites and Exchange mailboxes . Global Reader is a read-only administrative role, not a content access role for reading all documents or mailbox items. Likewise, performing eDiscovery of Microsoft 365 Copilot prompts requires Purview eDiscovery permissions or role group membership, not merely the Global Reader role. Microsoft documents eDiscovery permissions separately in Purview role groups.

Therefore, based on the assigned role shown, the valid completion is that John can view all the users in the Microsoft Entra tenant .

The correct answer is Connectors . Microsoft documents that Microsoft 365 Copilot connectors are used to bring external, line-of-business data into Microsoft 365 Copilot so users can search, reason over, and act on content from non-Microsoft systems. Microsoft also states that admins must enable and configure Copilot connectors in the Microsoft 365 admin center , and once configured, those connectors can be selected as knowledge sources for custom agents. This directly matches the requirement to let users use an external system as a knowledge source for custom Microsoft 365 Copilot agents.

This is why the hotspot in the Copilot area should be set to Connectors , not Overview, Agents, Search, Billing & usage, or Settings. Overview provides status information, Agents is for agent management, Search is for Microsoft Search experiences, and Billing & usage is for metering and consumption tracking. The specific admin feature that enables external enterprise data sources for agent grounding is Connectors . Microsoft further explains that configured connectors can expose external knowledge securely and respect source-level permissions when used in agent scenarios.

A Communication Compliance policy can detect inappropriate text in Microsoft Teams messages. Answer: Yes

A Communication Compliance policy can detect offensive language in Microsoft 365 Copilot prompts. Answer: Yes

A Communication Compliance policy can be used to retain email messages for 10 years. Answer: No

The correct selections are Yes, Yes, No . Microsoft documents that Microsoft Purview Communication Compliance can detect potentially inappropriate messages in supported communication channels, including Microsoft Teams and email . Microsoft also states that reviewers can investigate communications in Microsoft 365 Copilot and Microsoft 365 Copilot Chat , which means Communication Compliance policies can evaluate Copilot prompts and responses for risky or offensive content.

This makes statement 1 Yes , because inappropriate text in Teams messages is a standard Communication Compliance scenario. Statement 2 is also Yes , because Microsoft explicitly includes Microsoft 365 Copilot and Microsoft 365 Copilot Chat among the supported communication sources for policy review and investigation.

Statement 3 is No because retaining email for a fixed period such as 10 years is handled by Microsoft Purview Data Lifecycle Management through retention policies or retention labels, not by Communication Compliance. Communication Compliance is for monitoring and investigating risky communications, not for long-term retention enforcement.

the Microsoft Authenticator app

The correct answer is the Microsoft Authenticator app . The image shows the familiar Microsoft MFA prompt that says “Are you trying to sign in?” and “Enter the number shown to sign in.” Microsoft documents this as number matching in Authenticator push notifications , which is part of Microsoft Entra multifactor authentication using the Microsoft Authenticator app . Microsoft explains that number matching is a security improvement for Authenticator push approvals and is used when the default sign-in method is Authenticator push notifications.

The other choices do not match the experience shown. Email OTP would involve a one-time code sent by email. SMS would send a text message code to a phone number. Temporary Access Pass is a time-limited passcode used for onboarding or recovery scenarios, not the mobile push screen shown in the image. Because the graphic specifically shows a mobile approval prompt with number matching, the MFA method is clearly the Microsoft Authenticator app .

The correct answer is adding a public DNS record . Microsoft documents that when you add a custom domain to Microsoft 365, you must first prove ownership of that domain before Microsoft 365 can use it for services such as Exchange Online, SharePoint, and user sign-ins. The standard verification method described by Microsoft is to add a DNS record at your domain registrar or DNS hosting provider. Microsoft commonly uses a TXT record for verification, although in some cases an MX record can also be used depending on the setup flow. This is why “adding a public DNS record” is the right completion for the sentence.

The other choices are not the standard Microsoft 365 domain verification process. Microsoft’s admin guidance does not use confirming your business address , uploading a certificate , or uploading a webpage as the normal method for proving ownership of a domain in Microsoft 365. Domain verification is specifically tied to DNS because DNS is the authoritative public system used to prove control over the domain name.

The correct answer is Data access governance . Microsoft documents that Data access governance reports in the SharePoint admin center help administrators discover overshared or sensitive SharePoint content and assess sharing exposure. More specifically, Microsoft’s sharing links activity reports under Data access governance are designed to monitor sharing activity and identify sites where links such as Anyone , People in the organization , and Specific people links have been created. This is the SharePoint admin reporting area Microsoft provides for investigating external sharing patterns and related exposure.

The other listed reports do not fit this requirement. Agent insights is for Copilot/agent usage, App insights is for application-related insights, Change history tracks configuration changes, OneDrive accounts focuses on OneDrive administration, and Site policy comparison compares site settings. None of those is the SharePoint report family intended for identifying externally shared SharePoint content. Based on Microsoft’s documentation, the report area you should use is Data access governance .