Understand Data Security Implications of Copilot AB-900 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An organization wants to ensure that Copilot does not use content that contains personally identifiable information (PII) in responses. They have Microsoft 365 E5 and have configured sensitivity labels and DLP policies. However, they find that Copilot is still using content with PII. What is the most likely reason?

   • AThe DLP policy is not applied to Copilot.
   • BThe sensitivity label is not applied to the content.
   • CThe user has been granted bypass permissions for DLP policies.
   • DThe content is not indexed by Microsoft Graph.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A user asks Copilot to generate a list of all employees who have a certain skill. The user does not have permission to view the HR database. What should Copilot do according to responsible AI principles?

   • ARefuse to generate the list because the user does not have permission to the HR database.
   • BGenerate the list based on the user's organizational chart.
   • CGenerate the list based on publicly available information.
   • DGenerate the list but redact the names of employees.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A user asks Copilot to find a document that they have permission to access, but Copilot returns no results. The document is stored in a SharePoint site that has been configured to block external sharing. What is the most likely reason?

   • AThe SharePoint site is not connected to Microsoft Graph.
   • BThe document is blocked by a sensitivity label.
   • CThe user does not have permission to the document.
   • DThe document is not indexed by Microsoft Graph.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When a user asks Copilot in Microsoft 365 a question, how does Copilot retrieve the data needed to generate a response?

   • AIt uses the signed-in user's permissions to access only the data that user is authorized to view, such as emails, documents, and calendar items.
   • BIt only retrieves data from public web sources and does not access any user-specific Microsoft 365 data.
   • CIt accesses data directly from the underlying storage systems without applying any user permissions, relying on its own security model.
   • DIt searches all data in the tenant, including data the user does not have access to, to provide the most comprehensive answer.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which responsible AI principle is primarily concerned with ensuring that Copilot does not treat individuals or groups unfairly?

   • ATransparency
   • BFairness
   • CInclusiveness
   • DAccountability
   Reveal Solution Discussion Select an answer first