AB-900 Practice Questions

Privileged Identity Management (PIM) provides Just-In-Time (JIT) access to roles, ensuring users only have high privileges when needed and for a limited time, which is the core of Least Privilege.

According to the diagram, the transition from 'Review' to 'Published' is triggered by 'Admin Approve'. The path is Draft -> Submit -> Review -> Approve -> Published.

In Copilot Studio, an entity is a unit of information that represents a real-world type such as a city, date and time, phone number or money. With prebuilt or custom entities, the agent recognizes these values in natural-language input and saves them to variables (slot filling). For example, 'London' becomes the destination city and 'next Tuesday' a date. Topics define conversation paths, variables store the extracted values, and connectors call external systems.

Activity Explorer provides granular details about data activities, including which user performed the action, what object (file/email) was affected, the date/time, and the specific label or policy involved.

Communication Compliance supports optical character recognition (OCR) to detect printed and handwritten text in images embedded in or attached to email and Microsoft Teams chat messages, and built-in classifiers, such as those used by the 'Detect inappropriate images' policy template, which detects adult and racy images. Encryption at rest, meeting recordings, and Exchange mail flow rules don't analyze image content.

In the Microsoft 365 admin center, go to Settings > Org settings > Organization profile > Release preferences, select Targeted release for selected users, and add the users (Standard release is the default). Targeted release applies to services such as new Outlook, OneDrive, SharePoint, Microsoft 365 for the web, the admin center, and some parts of Exchange Online and Teams. Copilot features use a newer audience-based model instead: Copilot > Settings > Copilot Frontier gives specific users pre-release Copilot features, and Copilot release preferences set Standard or Deferred release. Intune update rings, Exchange address book policies and Teams messaging policies don't control Microsoft 365 feature release timing.

The principle of 'Verify explicitly' requires that all access requests be fully authenticated, authorized, and encrypted before granting access. This matches the scenario where the administrator wants to verify every request regardless of origin. 'Assume breach' focuses on minimizing blast radius and segmenting access, while 'Use least privilege access' focuses on limiting user permissions to only what is necessary.

Microsoft 365 Copilot is available as an add-on license. Since the users already have a prerequisite license (Microsoft 365 E3) and do not need the other features of E5, purchasing the Copilot add-on is the most cost-effective and direct solution. Upgrading to E5 would incur unnecessary costs for features not required.

Conditional Access policies in Microsoft Entra ID allow administrators to create if-then statements (signals to decisions) to enforce access controls. This scenario describes a classic Conditional Access policy: IF location is X AND device is Y, THEN Grant/Block access. Identity Protection focuses more on risk-based events like leaked credentials.

A core security principle of Microsoft 365 Copilot is that customer data (prompts and grounding data) is NOT used to train the foundation Large Language Models (LLMs). The data remains within the tenant boundary and is only used to generate the specific response for that user session.

Data Loss Prevention (DLP) is designed specifically to detect sensitive information types (like credit card numbers) and apply protective actions, such as blocking the transmission of that data in Teams chats. Communication Compliance is for detecting inappropriate conduct (harassment, threats), not necessarily structured sensitive data types like credit cards.