AB-900 Practice Questions

time-bound role activation

The correct answer is time-bound role activation . Microsoft Learn explains that Microsoft Entra Privileged Identity Management (PIM) allows users to be made eligible for privileged roles and then activate those roles only when needed. Microsoft also states that once activated, the role is active for a preconfigured period of time , after which the privileged access expires automatically. This is the core just-in-time and time-limited access model that PIM is designed to provide. ( learn.microsoft.com )

The other options do not match Microsoft’s definition of PIM. It is not primarily described as providing restricted access to Microsoft 365 services , the lifecycle management of users , or the management of enterprise applications . Those areas relate more closely to other Microsoft Entra and Microsoft 365 governance capabilities. Microsoft specifically positions PIM as a service to manage, control, and monitor access to important resources by using eligible assignments , approval workflows , MFA if required , and temporary role activation . Therefore, the phrase that correctly completes the sentence is time-bound role activation . ( learn.microsoft.com )

A Communication Compliance policy can detect inappropriate text in Microsoft Teams messages. Answer: Yes

A Communication Compliance policy can detect offensive language in Microsoft 365 Copilot prompts. Answer: Yes

A Communication Compliance policy can be used to retain email messages for 10 years. Answer: No

The correct selections are Yes, Yes, No . Microsoft documents that Microsoft Purview Communication Compliance can detect potentially inappropriate messages in supported communication channels, including Microsoft Teams and email . Microsoft also states that reviewers can investigate communications in Microsoft 365 Copilot and Microsoft 365 Copilot Chat , which means Communication Compliance policies can evaluate Copilot prompts and responses for risky or offensive content.

This makes statement 1 Yes , because inappropriate text in Teams messages is a standard Communication Compliance scenario. Statement 2 is also Yes , because Microsoft explicitly includes Microsoft 365 Copilot and Microsoft 365 Copilot Chat among the supported communication sources for policy review and investigation.

Statement 3 is No because retaining email for a fixed period such as 10 years is handled by Microsoft Purview Data Lifecycle Management through retention policies or retention labels, not by Communication Compliance. Communication Compliance is for monitoring and investigating risky communications, not for long-term retention enforcement.

The correct answer is Data access governance . Microsoft documents that Data access governance reports in the SharePoint admin center help administrators discover overshared or sensitive SharePoint content and assess sharing exposure. More specifically, Microsoft’s sharing links activity reports under Data access governance are designed to monitor sharing activity and identify sites where links such as Anyone , People in the organization , and Specific people links have been created. This is the SharePoint admin reporting area Microsoft provides for investigating external sharing patterns and related exposure.

The other listed reports do not fit this requirement. Agent insights is for Copilot/agent usage, App insights is for application-related insights, Change history tracks configuration changes, OneDrive accounts focuses on OneDrive administration, and Site policy comparison compares site settings. None of those is the SharePoint report family intended for identifying externally shared SharePoint content. Based on Microsoft’s documentation, the report area you should use is Data access governance .

The correct selections are No, Yes, No . Microsoft defines Zero Trust as a security strategy and explicitly states that it isn’t a product or a service . Instead, it is an approach based on principles such as verify explicitly , use least privilege access , and assume breach . That makes statement 2 true.

Statement 1 is false because Zero Trust does not require an Azure subscription. Microsoft provides Zero Trust guidance across many environments, including Microsoft 365, Copilot, Azure, and hybrid scenarios. It is a strategy that can be implemented with different technologies and is not dependent on owning Azure specifically.

Statement 3 is also false because there is no single switch in the Microsoft 365 admin center to “enable Zero Trust” for an organization. Microsoft’s documentation presents Zero Trust as a set of policies, configurations, and deployment steps across services such as Microsoft Entra, Intune, Defender, and Microsoft 365 workloads, not as one admin-center toggle.

Top of Form

Bottom of Form

You can use a Microsoft Entra security group to assign permissions to Microsoft Entra ID resources. Answer: Yes

You can use a Microsoft Entra security group to assign Microsoft 365 licenses. Answer: Yes

You can use a Microsoft Entra security group to assign permissions to Microsoft Exchange mailboxes. Answer: No

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft’s recommended identity security best practices.

Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.