AB-730 Practice Questions

Prompt injection is a generative AI security risk where an attacker inserts instructions (often hidden in text, documents, webpages, or user inputs) to override or manipulate the assistant’s intended behavior. This can lead to unintended actions such as ignoring policy controls, producing unsafe outputs, or attempting to reveal sensitive information. Because generative AI systems follow natural-language instructions, they can be socially engineered to prioritize malicious content unless safeguards are in place. This is why prompt injection can cause data exposure (for example, attempting to extract confidential content from grounded sources) and can also embed harmful instructions that redirect the model’s behavior. In enterprise settings like Microsoft 365 Copilot, mitigations include grounding boundaries, permission trimming, content filtering, and instruction hierarchy (system policies over user instructions). From a business governance perspective, users should treat untrusted inputs (emails, documents, web text) as potentially hostile and apply least-privilege access and validation when using AI outputs in decision-making.

Copilot in Word assists with content generation, summarization, rewriting, and structural organization. It can analyze document headings and insert a table of contents based on structured heading styles, supporting document navigation. It can also generate summaries of key points, which aligns directly with generative AI text analysis capabilities.

Custom watermark formatting and precise page margin configuration are traditional Word formatting functions and are not core generative AI capabilities of Copilot.

Therefore, the correct answers are A and

C.  

==================================================

Microsoft Purview is the correct choice because it is Microsoft’s unified compliance and data governance solution that helps organizations apply and enforce policies across Microsoft 365 content— including Copilot-related interactions where those interactions are captured in services such as Microsoft 365 audit, eDiscovery, and Purview compliance experiences. Purview supports capabilities such as data loss prevention (DLP), retention, eDiscovery, audit, and sensitivity labeling so organizations can manage and govern data and AI-assisted content in line with regulatory and internal requirements. In contrast, Microsoft Entra ID focuses on identity and access management, Intune focuses on device and application management, and Defender for Cloud focuses on cloud security posture management. Governance policies for Copilot-generated conversations and associated compliance controls align most directly with Purview, which is designed to manage information protection and compliance across the Microsoft 365 environment.