Microsoft Copilot and Agent Admin Fundamentals (AB-900) Practice Questions & Study Guide

Free Microsoft Copilot and Agent Admin Fundamentals (AB-900) Practice Questions Preview

• Question 1

  HOTSPOT -
  You want to view the administrative actions taken by a service administrator in Microsoft 365.
  For each of the following statements, select Yes if the statement is true. Otherwise, select No.
  NOTE: Each correct selection is worth one point.
  

  Correct Answer: See interactive view.

  Explanation:

  I disagree with the suggested answer shown in the image (Yes/Yes/Yes) and agree with the community consensus (No/Yes/Yes). Search & intelligence is used for managing search results and bookmarks, not for auditing administrative logs.

  Reason

  The statement You can use Audit in the Microsoft Defender portal is correct because the Audit log search is integrated into the Microsoft Defender portal under the Audit menu. The statement You can use Audit in the Microsoft Purview portal is also correct as Microsoft Purview is the primary home for compliance and auditing solutions, allowing you to track activities performed by users and administrators across 365 services.

  Why the other options are not as suitable

  The statement You can use Search & intelligence in the Microsoft 365 admin center is incorrect for this specific goal because that tool is designed for configuring Microsoft Search features (like acronyms or floor plans) rather than viewing audit logs or administrative activity trails.

  Citations

  • https://learn.microsoft.com/en-us/purview/audit-log-search
  • https://learn.microsoft.com/en-us/defender-office-365/mdo-portal-overview

• Question 2

  HOTSPOT -
  Select the answer that correctly completes the sentence.
  

  Correct Answer: See interactive view.

  Explanation:

  I agree with the chosen answer. Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources, primarily through Just-In-Time (JIT) access which relies on time-bound role activation.

  Reason

  time-bound role activation is correct because PIM allows administrators to assign roles that are 'eligible' rather than permanent. Users must activate these roles for a specific duration (e.g., 1 to 8 hours), after which the privileges are automatically revoked, minimizing the risk of 'standing' access.

  Why the other options are not as suitable

  restricted access to Microsoft 365 services is too vague and generally refers to basic Conditional Access policies or licensing rather than the specific lifecycle of privileged roles. the lifecycle management of users refers to Identity Governance features like entitlement management or HR-driven provisioning (joining, moving, leaving), not role-specific elevation. the management of enterprise applications refers to App Management and SSO configurations within Microsoft Entra ID, which does not define the core purpose of PIM.

  Citations

  • https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

• Question 3

  Your organization has a Microsoft 365 E5 subscription.
  You need to ensure that a third-party cloud service can authenticate to Microsoft Entra.
  What should you configure?

  • A. a Microsoft 365 Copilot connector
  • B. multifactor authentication (MFA)
  • C. a Conditional Access policy
  • D. an app registration

  Correct Answer: D

  Explanation:

  I agree with the suggested answer D. To allow an external application or third-party service to interact with and authenticate against Microsoft Entra ID (formerly Azure Active Directory), you must establish a trust relationship by registering that application within the tenant.

  Reason

  Option D is correct because an app registration creates an identity configuration for the application. This process provides the application with a Application (client) ID and allows for the configuration of secrets or certificates, enabling the third-party service to prove its identity to Microsoft Entra ID and obtain tokens via OAuth 2.0 or OpenID Connect.

  Why the other options are not as suitable

  • Option A is incorrect because Microsoft 365 Copilot connectors are used to surface external data within Copilot, not to manage core authentication for third-party cloud services.
  • Option B is incorrect because multifactor authentication (MFA) is a security requirement applied to identities (usually users), not the primary mechanism for establishing the identity of a third-party service itself.
  • Option C is incorrect because Conditional Access policies are used to enforce access requirements (like MFA or device compliance) after an identity is already established; they do not provide the initial identity or authentication framework for a service.

  Citations

  • https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app
  • https://learn.microsoft.com/en-us/entra/identity-platform/app-objects-and-service-principals

• Question 4

  HOTSPOT -
  Select the answer that correctly completes the sentence.
  

  Correct Answer: See interactive view.

  Explanation:

  I agree with the suggested answer. Conditional Access is a fundamental Microsoft Entra ID (formerly Azure AD) feature that functions as a policy-driven 'if-then' engine to secure access to cloud applications based on specific signals.

  Reason

  The option provide control over how users can access cloud apps is correct because Conditional Access policies allow administrators to enforce requirements (like Multi-Factor Authentication or compliant devices) before granting access to specific cloud resources, effectively serving as the modern security perimeter.

  Why the other options are not as suitable

  are configured by using the Microsoft Defender portal is incorrect because these policies are primarily managed in the Microsoft Entra admin center or the Azure portal. are applied only to on-premises resources is incorrect as the primary purpose of Conditional Access is to protect cloud-based applications and services, though it can extend to on-premises apps via Application Proxy. require a Microsoft Exchange mailbox is incorrect because Conditional Access is an identity-level security feature and does not depend on a user having an active mailbox.

  Citations

  • https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview

• Question 5

  HOTSPOT -
  Select the answer that correctly completes the sentence.
  

  Correct Answer: See interactive view.

  Explanation:

  I agree with the suggested answer. Accountability is the specific Microsoft responsible AI principle that focuses on human oversight and the responsibility of the people who design and deploy AI systems.

  Reason

  The Accountability principle states that people who design and deploy AI systems must be accountable for how their systems operate. This directly involves establishing human oversight to ensure that humans remain in control of the AI's impact and decisions.

  Why the other options are not as suitable

  Inclusiveness focuses on empowering everyone and engaging people, ensuring AI doesn't exclude any groups. Privacy and security relates to protecting data and ensuring the AI system is secure against attacks. Reliability and safety ensures that AI systems operate within clear parameters and resist manipulation, focusing on performance consistency rather than the framework of human responsibility. Transparency is about making AI systems understandable so that users know how decisions are made, but it does not inherently mandate the oversight control mechanism itself.

  Citations

  • https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/innovate/best-practices/trusted-ai
  • https://www.microsoft.com/en-us/ai/responsible-ai

• Question 6

  HOTSPOT -
  A user named User5 navigates to https://myapps.microsoft.com. After entering their username and password, User5 receives the following message on their mobile device.
  
  Use the drop-down menus to select the answer choice that completes the statement based on the information presented in the graphic.
  

  Correct Answer: See interactive view.

  Explanation:

  I agree with the suggested answer. The interface shown in the mobile device image is the signature Microsoft Authenticator number matching prompt used for secure sign-ins.

  Reason

  The image shows a prompt asking the user to Enter the number shown to sign in. This is a specific feature of the Microsoft Authenticator app known as number matching, designed to prevent MFA fatigue and accidental approvals by requiring the user to type a code displayed on the login screen into the app.

  Why the other options are not as suitable

  Email OTP would involve receiving a code via email to enter on the login page, not a mobile app prompt. SMS would involve a text message with a code, rather than an interactive app interface. A Temporary Access Pass is a time-limited passcode used for initial setup or recovery that is entered on the login screen, not a push notification prompt requiring number entry on a mobile device.

  Citations

  • https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match

• Question 7

  Your organization has a Microsoft 365 subscription.
  You need to evaluate your organization’s Identity Secure Score.
  Which two factors affect the score? Each correct answer presents a complete the solution.
  NOTE: Each correct selection is worth one point.

  • A. the SharePoint site permissions
  • B. the number of global administrators
  • C. passwords that are never expired
  • D. the location of the users

  Correct Answer: BC

  Explanation:

  I agree with the suggested answer BC. The Identity Secure Score specifically measures security posture related to Microsoft Entra ID (formerly Azure AD) configurations and administrative hygiene, and both the number of privileged accounts and password policies are core components of this assessment.

  Reason

  B (the number of global administrators) is correct because having too many highly privileged accounts increases the attack surface; the score rewards organizations for following the principle of least privilege. C (passwords that are never expired) is correct because identity security recommendations often include auditing password expiration and complexity policies to ensure compromised credentials cannot be used indefinitely.

  Why the other options are not as suitable

  A (the SharePoint site permissions) is incorrect because it relates to document and site-level authorization rather than identity-level security configurations. D (the location of the users) is incorrect because while geographic data might be used in Conditional Access policies, the physical location of a user is not a configuration factor that determines the baseline Identity Secure Score.

  Citations

  • https://learn.microsoft.com/en-us/entra/architecture/secure-score-identity

• Question 8

  Your organization has a Microsoft 365 subscription.
  You need to review the impact of a recent phishing incident that targeted email users.
  What should you use?

  • A. the Microsoft Defender portal
  • B. the Microsoft 365 admin center
  • C. the Microsoft Entra admin center
  • D. the Microsoft Exchange admin center

  Correct Answer: A

  Explanation:

  I agree with the chosen answer A. The Microsoft Defender portal (formerly Microsoft 365 Defender) is the centralized security hub designed specifically for investigating, analyzing, and responding to security incidents like phishing across email and collaboration tools.

  Reason

  Option A is correct because Microsoft Defender for Office 365 provides the Threat Explorer and Incidents views within the Microsoft Defender portal. These tools allow administrators to drill down into specific phishing campaigns, see which users were targeted, and identify if any malicious links or attachments were clicked.

  Why the other options are not as suitable

  • Option B is incorrect because the Microsoft 365 admin center is for general tenant management (billing, users, and licenses) rather than deep security forensics.
  • Option C is incorrect because the Microsoft Entra admin center focuses on identity and access management (IAM), such as user accounts and conditional access, rather than analyzing email-based phishing content.
  • Option D is incorrect because while the Exchange admin center manages mailbox settings and mail flow rules, it does not provide the integrated threat intelligence and incident response tools found in the Defender portal.

  Citations

  • https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-about
  • https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender-portal

• Question 9

  HOTSPOT -
  For each of the following statements, select Yes if the statement is true. Otherwise, select No.
  NOTE: Each correct selection is worth one point.
  

  Correct Answer: See interactive view.

  Explanation:

  I agree with the suggested answer and the community consensus. The solution correctly identifies the scope of Microsoft Defender for Office 365, Microsoft Defender for Identity, and the limitations of Microsoft Defender Vulnerability Management regarding SaaS applications.

  Reason

  Statement 1 is Yes because Microsoft Defender for Office 365 safeguards organizations against malicious threats posed by email messages, links (URLs), and collaboration tools through features like Safe Attachments and Safe Links. Statement 2 is Yes because Microsoft Defender for Identity uses Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.

  Why the other options are not as suitable

  Statement 3 is No because Microsoft Defender Vulnerability Management is designed to provide asset visibility, intelligent assessments, and built-in remediation tools for devices (endpoints), not for Software as a Service (SaaS) applications. Protection and governance for SaaS applications are specifically handled by Microsoft Defender for Cloud Apps, which serves as a Cloud Access Security Broker (CASB).

  Citations

  • https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/defender-for-office-365-overview
  • https://learn.microsoft.com/en-us/defender-for-identity/what-is
  • https://learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management

• Question 10

  HOTSPOT -
  Your organization has a Microsoft 365 subscription that contains a Microsoft SharePoint site named Site1. The permissions for Site1 are configured as shown in the following exhibit.
  
  You create a new user named User1 in the subscription.
  Use the drop-down menus to select the answer choice that completes the statement based on the information presented in the graphic.
  

  Correct Answer: See interactive view.

  Explanation:

  I agree with the suggested answer. The exhibit shows that the Site members group includes Everyone except external users, which automatically includes any newly created internal user like User1.

  Reason

  a site member of is correct because User1 is a new internal user in the subscription. The permissions exhibit clearly lists Everyone except external users under the Site members - limited control section. Since User1 is an internal user, they are automatically part of that 'Everyone' claim and thus inherit Edit permissions as a site member.

  Why the other options are not as suitable

  a site visitor of is incorrect because the Site visitors group has no assigned users in the exhibit and User1's membership in the 'Everyone' group grants them a higher level of access (Member). a site owner of is incorrect because User1 has not been explicitly added to the Site owners group, which currently only lists the Global Administrator. prevented from accessing is incorrect because User1 is part of the Everyone except external users group, which has been granted explicit Edit access to the site.

  Citations

  • https://learn.microsoft.com/en-us/sharepoint/modern-experience-sharing-permissions
  • https://learn.microsoft.com/en-us/sharepoint/customize-sharepoint-site-permissions