A user reports that they are prompted for MFA every time they sign in, even though they selected 'Don't ask again' on their device. The sign-in logs show that a Conditional Access policy with a session control for 'Sign-in frequency' is being applied. What should you do to reduce the frequency of MFA prompts for this user?

Exclude the user from the Conditional Access policy.

Modify the Conditional Access policy to increase the sign-in frequency duration.

Ask the user to re-register their device for MFA.

Disable the 'Remember MFA' setting for the user.

A company has 5,000 users. The IT team needs to apply a Conditional Access policy that requires MFA for all users in the Finance department, but the Finance department users are spread across multiple organizational units and are not consistently assigned to a single group. The company uses Microsoft Entra ID P1. What is the most efficient way to target the policy?

Create a dynamic group with a rule that includes users based on their department attribute, then assign the policy to that group.

Use a PowerShell script to assign the policy to each user individually.

Create a static group and manually add each Finance user.

Apply the policy to all users and exclude the non-Finance users.

An administrator suspects that a user's account was compromised and that the attacker assigned a new role to the account. You need to determine whether a role assignment was made and by whom. What should you review?

The Microsoft Entra audit logs for role management activities

The Microsoft 365 Defender alerts for the user

The Microsoft Entra sign-in logs for the user

A company has a custom line-of-business application that is registered in Microsoft Entra ID. They want to restrict access to this app to only users in the 'Finance' group and require MFA. The app is used by both internal employees and external contractors who are invited as guests. You need to ensure that only Finance group members can access the app, regardless of whether they are internal or external. What should you do?

Assign the app to the Finance group and create a Conditional Access policy that requires MFA and restricts to the Finance group.

Remove external contractors from the tenant to prevent access.

Use app permissions to restrict access to the Finance group only.

Create a Conditional Access policy that requires MFA for all users and assign the app to all users.

Microsoft 365 Certified:Copilot and Agent Administration Fundamentals

Domain 1Objective 3

Identify the Core Security Features of Microsoft 365 Services AB-900 Practice Questions (Page 4)

Part of the Identify the core features and objects of Microsoft 365 services domain, which accounts for 30–35% of the AB-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~6–11 in this domain), expect 2–4 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

9concepts

30–35%of the exam

Questions 16–20

16application · medium
A user reports that they are prompted for MFA every time they sign in, even though they selected 'Don't ask again' on their device. The sign-in logs show that a Conditional Access policy with a session control for 'Sign-in frequency' is being applied. What should you do to reduce the frequency of MFA prompts for this user?
Select an answer first
17application · medium
A company has 5,000 users. The IT team needs to apply a Conditional Access policy that requires MFA for all users in the Finance department, but the Finance department users are spread across multiple organizational units and are not consistently assigned to a single group. The company uses Microsoft Entra ID P1. What is the most efficient way to target the policy?
Select an answer first
18application · medium
An administrator suspects that a user's account was compromised and that the attacker assigned a new role to the account. You need to determine whether a role assignment was made and by whom. What should you review?
Select an answer first
19foundation · easy
Which Microsoft Entra ID report can help you investigate why a user was prompted for multi-factor authentication (MFA) during sign-in?
Select an answer first
20expert · hard
A company has a custom line-of-business application that is registered in Microsoft Entra ID. They want to restrict access to this app to only users in the 'Finance' group and require MFA. The app is used by both internal employees and external contractors who are invited as guests. You need to ensure that only Finance group members can access the app, regardless of whether they are internal or external. What should you do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AB-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AB-900” is a trademark of its owner, used for identification only.

Identify the Core Security Features of Microsoft 365 Services AB-900 Practice Questions (Page 4)

Questions 16–20

An administrator suspects that a user's account was compromised and that the attacker assigned a new role to the account. You need to determine whether a role assignment was made and by whom. What should you review?

Which Microsoft Entra ID report can help you investigate why a user was prompted for multi-factor authentication (MFA) during sign-in?

Keep studying — Identify the core features and objects of Microsoft 365 services