A company is adopting a Zero Trust security model. They want to ensure that even if a user's credentials are compromised, the attacker cannot access sensitive data. Which additional control should they implement?

Implement a VPN for all remote access.

Disable external sharing in SharePoint.

Require multi-factor authentication for all users.

An organization wants to enforce least privilege for its Microsoft 365 administrators. They have a small IT team where each member needs to perform different administrative tasks. They want to avoid giving permanent global admin rights to anyone. Which approach should they use?

Create custom roles with all permissions to ensure flexibility.

Use Conditional Access to restrict admin access to specific IP addresses.

Make all IT team members global admins to simplify management.

Assign the appropriate Azure AD roles and use Privileged Identity Management (PIM) for just-in-time activation.

A company uses Microsoft 365 and wants to improve its threat protection posture. They want to detect and respond to advanced threats across email, endpoints, and identities in a unified manner. Which Microsoft 365 security feature should they use?

Microsoft Defender for Office 365

Microsoft Purview compliance portal

A company has a Zero Trust strategy and wants to implement least privilege access for its Microsoft 365 environment. They have a team of administrators who need to manage Exchange Online, but they should not have access to other workloads. What is the best way to achieve this?

Create a custom role with Exchange permissions.

Assign the Exchange Administrator role to the team.

Assign the Global Administrator role to the team.

Use Privileged Identity Management (PIM) for just-in-time access.

Microsoft 365 Certified:Copilot and Agent Administration Fundamentals

Domain 1Objective 2

Understand the Microsoft 365 Security Principles AB-900 Practice Questions (Page 5)

Part of the Identify the core features and objects of Microsoft 365 services domain, which accounts for 30–35% of the AB-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~6–11 in this domain), expect 2–4 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

6concepts

30–35%of the exam

Questions 21–25

21application · medium
A company is adopting a Zero Trust security model. They want to ensure that even if a user's credentials are compromised, the attacker cannot access sensitive data. Which additional control should they implement?
Select an answer first
22foundation · easy
Which Microsoft 365 feature provides a centralized view of threat intelligence and allows security teams to investigate and respond to threats?
Select an answer first
23expert · hard
An organization wants to enforce least privilege for its Microsoft 365 administrators. They have a small IT team where each member needs to perform different administrative tasks. They want to avoid giving permanent global admin rights to anyone. Which approach should they use?
Select an answer first
24application · medium
A company uses Microsoft 365 and wants to improve its threat protection posture. They want to detect and respond to advanced threats across email, endpoints, and identities in a unified manner. Which Microsoft 365 security feature should they use?
Select an answer first
25expert · hard
A company has a Zero Trust strategy and wants to implement least privilege access for its Microsoft 365 environment. They have a team of administrators who need to manage Exchange Online, but they should not have access to other workloads. What is the best way to achieve this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AB-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AB-900” is a trademark of its owner, used for identification only.