Understand Data Security Implications of Copilot AB-900 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A user asks Copilot in Outlook to summarize emails from a specific sender. The user has access to the emails, but the sender's emails are marked as 'Confidential' with a sensitivity label. What should Copilot do?

   • ASummarize the emails because the user has access to them.
   • BSummarize the emails but redact the sender's name.
   • CRefuse to summarize the emails because they are marked as 'Confidential'.
   • DAsk the user to confirm that they have permission to access the emails.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A user asks Copilot in Word to draft a proposal based on a SharePoint site that contains multiple documents. The user has read access to all documents. Which statement best describes how Copilot decides which content to use?

   • ACopilot uses only documents that have been shared with the user explicitly.
   • BCopilot uses only the documents that the user has recently opened.
   • CCopilot uses all documents in the SharePoint site regardless of relevance.
   • DCopilot uses Microsoft Graph to retrieve relevant documents based on the user's prompt and permissions.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An organization wants to prevent Copilot from using content that contains credit card numbers in responses. They have Microsoft 365 E5 and have enabled Microsoft Purview. What should they configure to meet this requirement?

   • ACreate a data loss prevention (DLP) policy that detects credit card numbers and blocks Copilot interactions.
   • BDisable Copilot for all users who have access to credit card data.
   • CCreate a sensitivity label that marks credit card content as confidential and apply it to all files.
   • DConfigure Microsoft Defender for Cloud Apps to block Copilot traffic.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user asks Copilot to generate a summary of a colleague's performance review. The user does not have permission to the review document. What should happen according to responsible AI principles and Copilot's design?

   • ACopilot will ask the user to request permission from the document owner.
   • BCopilot will generate a summary but will redact the employee's name.
   • CCopilot will generate a summary based on the document because it can access all organizational data.
   • DCopilot will refuse to generate a summary and will not reveal any content from the document.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does Copilot use permissions in Microsoft 365 to mitigate data security risks?

   • AIt bypasses permissions when the user is a member of the organization to speed up responses.
   • BIt grants all users the same level of access to ensure consistent responses.
   • CIt uses a separate set of AI-specific permissions that are configured by the Copilot administrator.
   • DIt applies the permissions of the user who is signed in, so users only see data they are authorized to access.
   Reveal Solution Discussion Select an answer first