Microsoft AB-900 Practice Test Questions Answers

The correct selections are Information Protection and Data Loss Prevention . Microsoft documents that Microsoft Purview Information Protection helps organizations discover, classify, protect, and govern sensitive information wherever it lives or travels . Microsoft also describes Information Protection as the Purview solution for data classification, sensitivity labels, and encryption , including scenarios across Microsoft 365, on-premises repositories, cloud stores, and even third-party apps through supported extensions. That makes it the correct choice for the requirement to discover and classify sensitive data across multiple platforms .

For the second requirement, Microsoft states that Microsoft Purview Data Loss Prevention (DLP) helps prevent the unintentional sharing of sensitive items and can block users from prohibited activities , including inappropriate external sharing through services such as SharePoint, OneDrive, Teams, and email. Microsoft specifically documents DLP scenarios for preventing sensitive items from being shared with external users , which matches the requirement to block users from sharing intellectual property externally.

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft’s recommended identity security best practices.

Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.

provide control over how users can access cloud apps.

The correct answer is provide control over how users can access cloud apps . Microsoft Learn defines Microsoft Entra Conditional Access as the Zero Trust policy engine that uses if-then logic to make access decisions. Microsoft states that Conditional Access policies determine who can access resources, what resources they can access, and under what conditions . These policies can require actions such as multifactor authentication, compliant devices, or other controls before allowing access to applications and services like Microsoft 365. That means Conditional Access is specifically used to control how users access cloud apps .

The other options are incorrect. Conditional Access policies are not configured by using the Microsoft Defender portal ; they are managed in the Microsoft Entra admin center . They are also not applied only to on-premises resources , because Microsoft documents Conditional Access primarily for cloud identities, cloud apps, and cloud-connected resources. Finally, Conditional Access does not require a Microsoft Exchange mailbox. It can be applied broadly across many Microsoft and third-party cloud applications integrated with Microsoft Entra.

The correct answer is View all the users in the Microsoft Entra tenant . In the exhibit, John is assigned the Global Reader role. Microsoft documents that the Global Reader role is intended for users who need to view administrator features and settings in admin centers that a Global Administrator can view, but without edit permissions. That makes it appropriate for read-only visibility into tenant-wide directory and admin information, including users in Microsoft Entra.

The other answer choices are not supported by the Global Reader role. Microsoft distinguishes admin-center visibility from access to content in workloads such as SharePoint sites and Exchange mailboxes . Global Reader is a read-only administrative role, not a content access role for reading all documents or mailbox items. Likewise, performing eDiscovery of Microsoft 365 Copilot prompts requires Purview eDiscovery permissions or role group membership, not merely the Global Reader role. Microsoft documents eDiscovery permissions separately in Purview role groups.

Therefore, based on the assigned role shown, the valid completion is that John can view all the users in the Microsoft Entra tenant .

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft documents that Agent Builder in Microsoft 365 Copilot is included with the Microsoft 365 Copilot license , and agents built with that feature are part of that licensed experience. Microsoft also states that the capability is enabled by default in Microsoft 365 Copilot licensed tenants . While Copilot Chat users with qualifying Microsoft 365 licenses can access web-grounded chat experiences, creating Microsoft 365 Copilot agents in the app is documented under the Copilot-licensed Agent Builder experience, not as an E5-only entitlement.

Statement 2 is Yes because Microsoft states that Researcher and Analyst were deployed to users with Microsoft 365 Copilot licenses . Statement 3 is Yes because Microsoft says users can build agents in Agent Builder by using natural language or manually .