Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 Understand data protection and governance tasks for Microsoft 365 and Copilot: 513 practice questions

12 of the 513 Understand data protection and governance tasks for Microsoft 365 and Copilot questions in the Certsqill Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Microsoft 365 Copilot and Agent Administration Fundamentals AB-900? Take the free 5-min readiness check →

1. Configure sensitivity labels for classification: Select TWO actions or features that directly support classifi

Select two. More than one option is correct — every correct one is ticked below.

1. Configure sensitivity labels for classification and protection. ✓

   Sensitivity labels classify content and can apply configured protection, such as encryption, when settings require it.
2. Create a retention policy to assign confidentiality automatically.

   Retention governs preservation or deletion and does not provide confidentiality or access authorization.
3. Publish sensitivity labels through a label policy. ✓

   A label policy makes configured sensitivity labels available to appropriate users for classification and protection.
4. Use a distribution group to encrypt employee documents.

   Distribution groups distribute email and do not classify or encrypt documents.
5. Grant SharePoint site Members tenant-wide data protection rights.

   SharePoint Members permissions control site content access and do not configure Purview Information Protection.

Sensitivity labels classify and potentially protect content, while label policies publish those labels to users.

2. A sensitivity label applied to the report: Which capability best explains the observed behavior?

1. A communication compliance policy reviewing messages.

   Communication Compliance reviews configured communications for policy violations rather than labeling finance reports.
2. A sensitivity label applied to the report. ✓

   Sensitivity labels classify content and can display markings or apply configured protection to the labeled report.
3. A retention policy controlling document preservation.

   Retention controls preservation or deletion and does not explain a visible confidentiality classification marking.
4. A DLP policy detecting sensitive information.

   DLP detects configured conditions and may alert or block, but it does not primarily apply confidentiality classification markings.

Sensitivity labels explain visible confidentiality markings and configured protection on the finance report.

3. Configure sensitive information types: Select TWO prerequisites that can provide classification logic.

Select two. More than one option is correct — every correct one is ticked below.

1. Add all researchers to a SharePoint Visitors group.

   SharePoint Visitors permissions affect content access and do not configure Purview classification detection.
2. Configure sensitive information types. ✓

   Sensitive information types provide detection patterns that classification can use to identify defined content.
3. Create a retention label to discover every category.

   Retention labels govern lifecycle actions and do not automatically supply classification detection logic.
4. Configure appropriate classifiers. ✓

   Classifiers provide classification logic for recognizing content categories beyond basic source availability.
5. Create a distribution group for the research team.

   Distribution groups route email and do not provide sensitive-content detection or classification rules.

Classification can use sensitive information types and classifiers; source access alone does not define detection logic.

4. A retention policy or retention label: Which capability should govern preservation?

1. A retention policy or retention label. ✓

   Retention policies and labels govern preservation or deletion, while sensitivity labels address confidentiality separately.
2. A DLP rule detecting sensitive plan content.

   DLP detects sensitive-content conditions and applies configured actions, but it does not define retention duration.
3. A sensitivity label applied to the plans.

   Sensitivity labels address classification and protection, not the required preservation or deletion schedule.
4. A SharePoint Visitors permission level.

   Visitors permissions control access to site content and do not preserve or delete content on a schedule.

Retention policies or labels govern preservation and deletion; sensitivity labels govern classification and protection.

5. Copilot used content already available through: What should the administrator conclude?

1. The summary shows that Copilot ignored the file's permission settings.

   Copilot is not expected to bypass permissions when retrieving organizational content through Microsoft Graph.
2. Copilot used content already available through the employee's permissions. ✓

   Copilot can ground responses in organizational content available through Microsoft Graph under the signed-in user's permissions.
3. The Copilot license expanded the employee's SharePoint permissions.

   A Copilot license provides product entitlement but does not change the employee's permissions on the file.
4. Copilot indexed the file for all sales users.

   Using accessible content for one response does not make that content available to all sales users.

Copilot respects existing permissions; the employee could already access the file.

6. Review the identity and permissions used by each connected: Select TWO actions that directly verify the data a

Select two. More than one option is correct — every correct one is ticked below.

1. Grant tenant-wide consent so every agent can retrieve organizational content consistently.

   Tenant-wide consent broadens access and does not represent a least-privilege review of actual agent needs.
2. Treat the agent's ownership record as proof of access to every connected source.

   Ownership identifies responsibility for the agent, but it does not prove permissions for every connected source.
3. Review the identity and permissions used by each connected agent tool or connector. ✓

   Agent tools and connectors can use their own identity and permissions, so those access paths require separate review.
4. Use the agent review to determine whether Graph content will train the foundation model.

   Graph grounding concerns response context, while documented commercial commitments separately address foundation-model training.
5. Confirm the signed-in user's permissions to the organizational sources used for grounding. ✓

   Checking the user's source permissions verifies which organizational context Microsoft Graph can make available to Copilot.

Review both user-delegated source permissions and the permissions of connected tools or connectors.

7. A sensitivity label does not define retention requirements: Which boundary of this control should the administ

1. A sensitivity label does not define retention requirements. ✓

   Sensitivity labels address classification or protection, while retention is governed by separate retention controls.
2. A sensitivity label automatically labels every file in the branch.

   Applying a label to selected documents does not automatically label every other file in the location.
3. A sensitivity label cannot provide any protection for document content.

   Depending on configuration, sensitivity labels can apply protection such as encryption or access restrictions.
4. A sensitivity label automatically creates a legal hold for every document.

   Legal holds and retention controls are separate governance mechanisms from sensitivity labeling.

Sensitivity labels classify or protect content; they do not establish retention requirements or legal holds.

8. Ask the user to verify the underlying sources: Select TWO appropriate next steps.

Select two. More than one option is correct — every correct one is ticked below.

1. Treat the response as legally compliant because it was generated inside Microsoft 365.

   Product use does not guarantee universal legal compliance for generated content or resulting decisions.
2. Assume the response is accurate because Copilot grounded it in organizational data.

   Grounding provides context but does not guarantee that every generated answer is accurate or current.
3. Ask the user to verify the underlying sources and important claims before relying on the summary. ✓

   Users should verify generated content, especially when decisions depend on potentially inaccurate or incomplete summaries.
4. Apply human review before using the generated summary for the staffing decision. ✓

   Human oversight supports accountability and helps detect unreliable or unsuitable generated content before consequential use.
5. Delete the source documents so Copilot cannot produce another inaccurate summary.

   Deleting source content is not a responsible general response and may create governance or business risks.

Verify generated content and retain human oversight when inaccurate output could influence a consequential department decision.

9. Monitor the organization's compliance posture using: Select TWO suitable use cases.

Select two. More than one option is correct — every correct one is ticked below.

1. Delete HR documents that the assessment identifies as compliance risks.

   Compliance Manager recommends improvements; it does not automatically delete documents identified as risky.
2. Monitor the organization's compliance posture using its assessment score and recommendations. ✓

   Compliance Manager helps track compliance posture through assessments, scores, and recommended improvement activities.
3. Certify that all HR practices satisfy every applicable legal requirement.

   A Compliance Manager score is not legal certification and cannot establish universal compliance with every law.
4. Assess relevant controls and record improvement actions for the organization. ✓

   Compliance Manager assesses controls and provides improvement actions that help organizations address compliance-related gaps.
5. Search employee messages and automatically place matching content on legal hold.

   Compliance Manager is not a content-search or automatic legal-hold mechanism for employee messages.

Compliance Manager evaluates controls and improvement actions, helping track posture without certifying legal compliance.

10. The analyst can locate classified content: After a regional analyst receives the required permissions, what is

1. The analyst can change retention settings for all regional files.

   Data Explorer permissions do not automatically authorize changes to retention settings across regional files.
2. The analyst can place discovered content on legal hold.

   Data Explorer does not automatically impose legal holds on content it identifies.
3. The analyst can locate classified content. ✓

   Data Explorer lets an authorized analyst identify locations containing classified sensitive or labeled content within the available scope.
4. The analyst can label every unclassified regional document.

   Data Explorer identifies classified content but does not automatically label every unclassified document.

The analyst gains authorized visibility into locations containing classified sensitive or labeled content.

11. Insider Risk Management: Which feature is most appropriate?

1. Insider Risk Management ✓

   Insider Risk Management investigates sequences and context associated with potentially risky insider activity.
2. Data Explorer

   Data Explorer identifies locations containing classified content, rather than investigating insider activity sequences.
3. Data Loss Prevention

   DLP detects policy matches and may generate alerts, but it is not the primary feature for contextual insider investigations.
4. Communication Compliance

   Communication Compliance reviews potential policy violations in communications, not broad insider-risk activity sequences.

Insider Risk Management is designed to investigate contextual sequences of potentially risky insider activity.

12. The alert does not prove that DLP blocked the sharing: What does this symptom indicate?

1. The DLP policy was deleted after matching the file.

   A successful delivery does not indicate that the DLP policy was deleted after detecting the content.
2. The alert does not prove that DLP blocked the sharing action. ✓

   DLP alerts can arise during auditing or simulation and do not necessarily demonstrate that an action was blocked.
3. The recipient's access proves the file contained no sensitive information.

   A delivery event does not invalidate the DLP match or prove that the file lacked sensitive information.
4. The sensitive information was automatically removed before delivery.

   Recipient delivery does not establish that DLP automatically removed sensitive information from the file.

A DLP alert records a policy match or event; it does not by itself prove that sharing was blocked.

Other Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 domains

• Identify the core features and objects of Microsoft 365 services — 446 questions →
• Perform basic administrative tasks for Copilot and agents — 391 questions →
• All 1350 Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 questions →
• Microsoft 365 Copilot and Agent Administration Fundamentals AB-900 certification: requirements, cost and exam format →