An administrator suspects that a user's account was compromised and that the attacker accessed Exchange Online and then assigned a new role. You need to determine the full scope of the attack, including what the attacker accessed and what changes were made. Which tools should you use?

Microsoft 365 Defender and Microsoft Purview audit logs

Microsoft Entra audit logs and Microsoft Purview audit logs

Microsoft Entra sign-in logs and audit logs

Microsoft Entra sign-in logs and Microsoft 365 Defender

What is the primary purpose of a user object in Microsoft Entra ID?

To store passwords for all applications in the organization

To represent an individual identity that can be authenticated and authorized

To define a set of permissions for a group of users

To manage the lifecycle of applications

Contoso has enabled Microsoft Entra ID P1 and requires all users to use MFA. Recently, a group of users reported being blocked during sign-in even though they successfully completed MFA. The sign-in logs show these users were denied by a Conditional Access policy that requires a 'compliant device'. You need to allow these users to access Microsoft 365 while still enforcing the compliance requirement. What should you do?

Exclude these users from the Conditional Access policy.

Disable MFA for these users to reduce sign-in friction.

Ask the users to re-register their devices in Microsoft Entra ID.

Ensure the devices are enrolled in Microsoft Intune and meet compliance policies.

Which feature of Microsoft Entra ID allows users to access multiple applications with a single set of credentials?

Privileged Identity Management (PIM)

Multi-factor authentication (MFA)

Which feature of Privileged Identity Management (PIM) helps reduce the risk of standing administrative access?

Requiring multi-factor authentication for all sign-ins

Blocking all external users from signing in

Automatic password rotation for all users

Just-in-time activation of roles

Microsoft 365 Certified:Copilot and Agent Administration Fundamentals

Domain 1Objective 3

Identify the Core Security Features of Microsoft 365 Services AB-900 Practice Questions (Page 7)

Part of the Identify the core features and objects of Microsoft 365 services domain, which accounts for 30–35% of the AB-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~6–11 in this domain), expect 2–4 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

9concepts

30–35%of the exam

Questions 31–35

31expert · hard
An administrator suspects that a user's account was compromised and that the attacker accessed Exchange Online and then assigned a new role. You need to determine the full scope of the attack, including what the attacker accessed and what changes were made. Which tools should you use?
Select an answer first
32foundation · easy
What is the primary purpose of a user object in Microsoft Entra ID?
Select an answer first
33application · medium
Contoso has enabled Microsoft Entra ID P1 and requires all users to use MFA. Recently, a group of users reported being blocked during sign-in even though they successfully completed MFA. The sign-in logs show these users were denied by a Conditional Access policy that requires a 'compliant device'. You need to allow these users to access Microsoft 365 while still enforcing the compliance requirement. What should you do?
Select an answer first
34foundation · easy
Which feature of Microsoft Entra ID allows users to access multiple applications with a single set of credentials?
Select an answer first
35foundation · easy
Which feature of Privileged Identity Management (PIM) helps reduce the risk of standing administrative access?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AB-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AB-900” is a trademark of its owner, used for identification only.