AB-900 Practice Questions

You can use a Microsoft Entra security group to assign permissions to Microsoft Entra ID resources. Answer: Yes

You can use a Microsoft Entra security group to assign Microsoft 365 licenses. Answer: Yes

You can use a Microsoft Entra security group to assign permissions to Microsoft Exchange mailboxes. Answer: No

Communications Compliance uses OCR (optical character recognition) and machine learning to detect offensive or risky text inside images , including those in SharePoint and OneDrive.

By default, Communications Compliance pseudonymizes user identities to reduce investigator bias. Admins can later deanonymize if needed.

It does not add disclaimers. It silently monitors communications and flags policy violations; disclaimers are handled by Exchange transport rules, not Communications Compliance.

provide control over how users can access cloud apps.

The correct answer is provide control over how users can access cloud apps . Microsoft Learn defines Microsoft Entra Conditional Access as the Zero Trust policy engine that uses if-then logic to make access decisions. Microsoft states that Conditional Access policies determine who can access resources, what resources they can access, and under what conditions . These policies can require actions such as multifactor authentication, compliant devices, or other controls before allowing access to applications and services like Microsoft 365. That means Conditional Access is specifically used to control how users access cloud apps .

The other options are incorrect. Conditional Access policies are not configured by using the Microsoft Defender portal ; they are managed in the Microsoft Entra admin center . They are also not applied only to on-premises resources , because Microsoft documents Conditional Access primarily for cloud identities, cloud apps, and cloud-connected resources. Finally, Conditional Access does not require a Microsoft Exchange mailbox. It can be applied broadly across many Microsoft and third-party cloud applications integrated with Microsoft Entra.

The correct selections are Yes, Yes, Yes . For statement 1, Microsoft Support explains that if you are not a site owner, you might still be able to invite other people to the site , although the invitation can generate an access request that a site owner approves or declines. Microsoft also states that site users have the opportunity to invite other people to collaborate on sites , unless that feature is disabled. That makes the statement true.

For statement 2, Microsoft Learn states that in SharePoint you can give people permissions to a site by adding individual users, security groups, or Microsoft 365 groups to one of the three SharePoint groups, including the Members group. That directly supports the statement.

For statement 3, Microsoft documents that site ownership and membership can be managed by adding or removing owners, members, site owners, site members, and site visitors . For group-connected sites, Microsoft also documents that owners can manage group ownership and remove owner status. Therefore, a site owner can remove another site owner, provided at least one owner remains.

The correct answers are B and C . Microsoft documents that Identity Secure Score in Microsoft Entra is based on identity security recommendations, including recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” Those recommendations directly map to the number of global administrators and whether passwords are set to never expire , so both factors affect the score.

Option A is incorrect because SharePoint site permissions are part of SharePoint content and collaboration security, not a direct factor in the Microsoft Entra Identity Secure Score model. Option D is also incorrect because the location of users can be used in Conditional Access and other access control decisions, but Microsoft does not list user geographic location itself as a direct Identity Secure Score recommendation. Identity Secure Score is driven by Entra identity best-practice checks and recommendations rather than by SharePoint permission structure or user location data.