A security team wants to stay ahead of new threats by using Microsoft's global threat intelligence to identify indicators of compromise (IOCs) that might affect their Microsoft 365 environment. Which feature should they use to access this intelligence?

Microsoft Defender XDR threat analytics

Microsoft 365 compliance center

In the Zero Trust model, what does 'assume breach' mean for security design?

Design security controls as if an attacker is already present in the environment

Assume that all traffic is safe once it passes the firewall

Assume that the network perimeter is the primary defense

Assume that all users are malicious until proven otherwise

A user reports receiving a suspicious email with a link. The email passed through Microsoft Defender for Office 365 without being blocked. What should the administrator do to improve threat protection for future similar emails?

Create a mail flow rule to quarantine all emails with links.

Disable the user's email account to prevent further access.

Add the sender to the blocked senders list.

Submit the email to Microsoft for analysis and use the resulting threat intelligence to create a policy.

Which capability is a key feature of Microsoft Defender XDR?

Automated investigation and response across multiple security domains

Managing user passwords and account lockout policies

Creating and enforcing data loss prevention policies

Providing a virtual private network (VPN) for remote users

An organization wants to implement a security solution that provides a single console for investigating and responding to threats across email, endpoints, and identities. They also want to leverage automated investigation and response capabilities. Which Microsoft 365 security solution should they deploy?

Microsoft Defender for Cloud Apps

Microsoft 365 Certified:Copilot and Agent Administration Fundamentals

Domain 1Objective 2

Understand the Microsoft 365 Security Principles AB-900 Practice Questions (Page 3)

Part of the Identify the core features and objects of Microsoft 365 services domain, which accounts for 30–35% of the AB-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~6–11 in this domain), expect 2–4 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

30–35%of the exam

Questions 11–15

11application · medium
A security team wants to stay ahead of new threats by using Microsoft's global threat intelligence to identify indicators of compromise (IOCs) that might affect their Microsoft 365 environment. Which feature should they use to access this intelligence?
Select an answer first
12foundation · easy
In the Zero Trust model, what does 'assume breach' mean for security design?
Select an answer first
13application · medium
A user reports receiving a suspicious email with a link. The email passed through Microsoft Defender for Office 365 without being blocked. What should the administrator do to improve threat protection for future similar emails?
Select an answer first
14foundation · easy
Which capability is a key feature of Microsoft Defender XDR?
Select an answer first
15application · medium
An organization wants to implement a security solution that provides a single console for investigating and responding to threats across email, endpoints, and identities. They also want to leverage automated investigation and response capabilities. Which Microsoft 365 security solution should they deploy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AB-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AB-900” is a trademark of its owner, used for identification only.