A company wants to retain all employee HR records for 10 years, but also wants to allow employees to delete their own personal documents from OneDrive after 1 year. The company wants to ensure that deleted HR records are still recoverable for the full 10 years. What should they configure?

A DLP policy that blocks deletion of HR records

A single retention policy that applies to all content with a 10-year retention period

A retention policy for HR records with a 10-year retention period, and a separate retention policy for OneDrive with a 1-year retention period

A sensitivity label that marks HR records as 'Retain 10 years'

An organization wants to protect sensitive documents by encrypting them and restricting access to specific users. They also want to prevent these documents from being shared externally. What should they use in Microsoft Purview?

Sensitivity labels with encryption and a DLP policy that blocks external sharing of labeled documents.

Retention policies and Data Lifecycle Management

Insider Risk Management and Communication Compliance

Data Classification and Content Explorer

What is the purpose of Microsoft Purview Data Security Posture Management (DSPM) for AI?

To manage and secure data used in AI models by providing visibility and control over data flows and potential risks.

To automatically generate AI models from sensitive data.

To monitor employee communications for AI-related policy violations.

To block all AI usage within the organization.

A company has a high rate of false positives in its insider risk alerts, causing the security team to ignore them. They want to reduce false positives while still detecting real threats like mass data exfiltration. They also want to avoid blocking legitimate work. What should they do?

Disable insider risk alerts and rely solely on DLP policies to block data loss

Use communication compliance to monitor all employee communications

Increase the sensitivity of insider risk indicators to catch more activity

Refine the insider risk policy with specific indicators and thresholds, and use DLP alerts to corroborate risky activity

A company is investigating a potential insider threat where an employee has been accessing sensitive files and sending them to a personal email. The company wants to determine the scope of the data exfiltration and prevent further loss, but they do not want to alert the employee. What should they do?

Use communication compliance to review the employee's emails

Use a retention policy to preserve all of the employee's files

Immediately suspend the employee's account

Use insider risk management to review the employee's activity and DLP to block further external sharing of sensitive files

Microsoft 365 Certified:Copilot and Agent Administration Fundamentals

Domain 2Objective 1

Understand Microsoft Purview AB-900 Practice Questions (Page 8)

Part of the Understand data protection and governance tasks for Microsoft 365 and Copilot domain, which accounts for 35–40% of the AB-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

9concepts

35–40%of the exam

9 Concepts in This Objective

Microsoft Purview Information Protection
Microsoft Purview Data Loss Prevention
Microsoft Purview Insider Risk Management
Microsoft Purview Communication Compliance
Microsoft Purview Data Security Posture Management for AI
Microsoft Purview Data Lifecycle Management
Sensitivity Labels Use Cases
Data Classification in Microsoft Purview
Retention Policies in Microsoft Purview

Questions 36–40

36application · medium
A company wants to retain all employee HR records for 10 years, but also wants to allow employees to delete their own personal documents from OneDrive after 1 year. The company wants to ensure that deleted HR records are still recoverable for the full 10 years. What should they configure?
Select an answer first
37application · medium
An organization wants to protect sensitive documents by encrypting them and restricting access to specific users. They also want to prevent these documents from being shared externally. What should they use in Microsoft Purview?
Select an answer first
38foundation · easy
What is the purpose of Microsoft Purview Data Security Posture Management (DSPM) for AI?
Select an answer first
39expert · hard
A company has a high rate of false positives in its insider risk alerts, causing the security team to ignore them. They want to reduce false positives while still detecting real threats like mass data exfiltration. They also want to avoid blocking legitimate work. What should they do?
Select an answer first
40expert · hard
A company is investigating a potential insider threat where an employee has been accessing sensitive files and sending them to a personal email. The company wants to determine the scope of the data exfiltration and prevent further loss, but they do not want to alert the employee. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AB-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AB-900” is a trademark of its owner, used for identification only.