Examworthy
Open the appSign inStart free

AB-900 domain - 38% of the exam

Understand data protection and governance tasks for Microsoft 365 and Copilot

Understand data protection and governance tasks for Microsoft 365 and Copilot is 38% of the AB-900 exam. These are the objectives it covers, each with practice questions, with every answer explained.

The domain in numbers

114
Practice questions
4
Objectives
86
Medium
28
Hard

Where people go wrong

  • Fixing oversharing with a Copilot or Purview switch

    The wrong answers reach for a Copilot-side or Purview-side switch: turning Copilot off, withdrawing a licence, excluding the semantic index, or applying DLP or retention. Copilot has no separate access model and only surfaces content the signed-in user could already open. Each of those options leaves the SharePoint permission in place, so the user can still open the file directly. Correcting the SharePoint site or file permissions removes the exposure for Copilot and for direct access alike.

    See it in a sample question

  • Swapping the jobs of labels, DLP and retention

    The wrong answers hand one control the job of another. Retention policies are credited with blocking sharing, DLP with classifying and encrypting content, and sensitivity labels with scheduling deletion. Sensitivity labels classify content and can encrypt it. DLP prevents sensitive content being shared or leaving, such as blocking an external email at the moment of sending. Retention policies keep content for a set period and can delete it afterwards, as with records kept for seven years.

    See it in a sample question

  • Answering a compliance score request with an activity or search tool

    A request for a regulatory score gets answered with a tool that reports events, finds content, maps classified content or enforces egress rules: Activity Explorer, Content search, Content explorer or DLP. None of those measures the tenant against a regulation. Compliance Manager is the capability that assesses the tenant against regulatory templates, produces a compliance score and lists improvement actions mapped to controls, each with a point value and an owner.

    See it in a sample question

  • Confusing Content search, Content explorer and Activity Explorer

    Three tools that all touch sensitive content get swapped. Content search runs a keyword query and returns items for review or export in an eDiscovery case. Content explorer shows where classified content and labels currently sit across locations. Activity Explorer shows a history of events, such as labels applied, changed or downgraded and DLP rules matched. The wrong answers pick one to do the work of another, such as an event timeline standing in for an inventory.

    See it in a sample question

  • Trading the SharePoint Advanced Management tools

    SharePoint Advanced Management offers three separate tools, and the wrong answers trade them. Data access governance reports detect and report overshared sites but enforce nothing. Site access reviews give site owners a recurring task to confirm or remove access. Restricted access control confines a whole site to a named group and blocks everyone else, even users holding a link. Entra access reviews are offered as a substitute, but they recertify directory groups and roles, not access to a SharePoint site.

    See it in a sample question

Objectives in this domain

What to study

The official documents this domain's practice questions cite most.

  • Microsoft Learncited by 48 questions
  • Microsoft Purview Information Protectioncited by 12 questions
  • Microsoft Purview Compliance Managercited by 8 questions
  • Microsoft Purview Data Loss Preventioncited by 7 questions
  • Microsoft Purviewcited by 6 questions
  • Microsoft Purview portalcited by 5 questions
  • Microsoft Purview Activity Explorercited by 4 questions
  • Microsoft Purview Data Lifecycle Managementcited by 4 questions

Sample questions from this domain

Free sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilothard

A finance analyst reports that Microsoft 365 Copilot returned salary figures from a spreadsheet stored in a SharePoint site owned by the HR team, and the analyst should not have access to that file. Which action resolves the underlying exposure?

  • ADisable Microsoft 365 Copilot for the finance analyst until the HR team confirms the file is safe to expose.
  • BEnable a Microsoft Purview sensitivity label on the spreadsheet so Copilot stops indexing it.
  • CCorrect the SharePoint permissions on the HR site so the analyst no longer has access to the spreadsheet. Correct
  • DTurn off the semantic index for the finance department in the Microsoft 365 admin center.
Copilot surfaces only what a user can already access, so an oversharing incident is fixed by correcting the underlying permissions, not a Copilot setting. Microsoft 365 Copilot has no separate access model; it queries Microsoft Graph and the semantic index within the user's existing permissions, so if Copilot returned a file the user could already open, the exposure lives in the file's permissions and must be remediated there.

Why A is wrong: Tempting because it appears to stop the analyst seeing the data, but Copilot only surfaced a file the analyst could already open, so turning Copilot off leaves the underlying permission intact and hides rather than fixes the exposure.

Why B is wrong: Tempting because labels do govern content, but a sensitivity label classifies and can encrypt a file rather than remove a user's existing site access, so the analyst who already has permission would still be able to open it.

Why C is correct: Correct: Copilot honours existing permissions and can only return content the user could already reach, so removing the analyst's access to the file at the SharePoint layer is what actually closes the exposure.

Why D is wrong: Tempting because the semantic index is how Copilot reasons over content, but there is no per-department switch to disable it, and the index respects permissions anyway, so this neither exists as a control nor addresses the over-permission.

Free sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilotmedium

An organisation must keep certain records for seven years and then delete them automatically to meet a regulatory obligation. Which statement correctly describes the Microsoft Purview capability that governs how long content is kept and when it is removed?

  • ARetention policies under Data Lifecycle Management keep content for a defined period and can delete it afterwards. Correct
  • BSensitivity labels keep content for a defined period and can delete it afterwards.
  • CDLP policies keep content for a defined period and can delete it afterwards.
  • DCommunication Compliance keeps content for a defined period and can delete it afterwards.
Identify retention policies within Data Lifecycle Management as the control for keeping then deleting content on a schedule. Data Lifecycle Management uses retention policies and labels to retain content for a required period and then dispose of it, meeting keep-then-delete obligations. This retention function is distinct from classification by sensitivity labels and egress prevention by DLP.

Why A is correct: Correct. Retention policies in Data Lifecycle Management enforce how long content is retained and whether it is deleted at the end of that period, which matches the seven-year keep-then-delete requirement.

Why B is wrong: Tempting because labels can be applied broadly, but sensitivity labels classify and protect content with encryption and markings and do not control retention or deletion schedules.

Why C is wrong: DLP prevents sensitive content from leaving approved boundaries by blocking actions; it has no function for retaining content over time or deleting it on a schedule.

Why D is wrong: Communication Compliance reviews messages for policy violations and does not set retention durations or automatic deletion for records.

Free sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilotmedium

A compliance officer needs to see a running measure of how well the organisation meets its regulatory obligations, expressed as a score with recommended improvement actions mapped to controls. Which Microsoft Purview capability is designed for this?

  • AActivity Explorer, which records what happened to labelled content and surfaces those historical activities
  • BContent search, which locates specific items across Microsoft 365 workloads for review
  • CData Loss Prevention, which blocks sensitive information from leaving the organisation
  • DCompliance Manager, which provides assessments, a compliance score, and improvement actions mapped to regulatory controls Correct
Compliance Manager measures regulatory posture through assessments, a compliance score, and control-mapped improvement actions. The distinguishing feature of Compliance Manager is that it translates regulatory frameworks into assessments and a quantified score, then recommends improvement actions linked to individual controls, which no other Purview tool does.

Why A is wrong: Activity Explorer is tempting because it also reports on governance data, but it shows historical activity on labelled or protected content, not a regulatory compliance score with control-mapped actions.

Why B is wrong: Content search sounds relevant to compliance work, but it finds content for investigations or eDiscovery and does not calculate an obligation score or recommend control improvements.

Why C is wrong: DLP is a legitimate compliance control, but it prevents egress of sensitive data at policy enforcement time and does not produce a posture score or assessment mapping.

Why D is correct: Compliance Manager is built to measure regulatory posture through templated assessments, a calculated compliance score, and improvement actions tied to specific controls, which is exactly what is asked.

Free sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilotmedium

An administrator must locate every email and document across mailboxes and SharePoint that mentions a specific project code so legal can review the items in response to an investigation. Which Microsoft Purview capability is designed for this?

  • AActivity Explorer, which lists the activities performed on the matching items after the labels were applied
  • BContent search in eDiscovery, which queries mailboxes and sites for matching items and returns them for review or export Correct
  • CContent explorer, which shows where sensitive information types were detected across the data estate
  • DCompliance Manager, which assesses whether the investigation meets the relevant regulatory framework
Content search in eDiscovery locates and returns matching items across Microsoft 365 for legal review. Content search is the find-it tool: it executes keyword and condition queries across Microsoft 365 workloads and returns the actual items for review or export, unlike tools that assess posture or report activity.

Why A is wrong: Activity Explorer reports actions taken on labelled content, which is tempting because it also concerns the same items, but it does not locate or return the documents and messages themselves.

Why B is correct: Content search runs keyword and condition queries across Microsoft 365 locations and returns the matching items for review or export, which precisely meets the requirement to find and collect the project-code content.

Why C is wrong: Content explorer surfaces where classified sensitive data lives, which sounds like finding content, but it maps classification coverage rather than running a keyword search that returns reviewable items.

Why D is wrong: Compliance Manager measures control coverage and scoring, which relates to governance broadly, but it cannot search mailboxes and sites for items containing a project code.

Free sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilotmedium

A governance team wants site owners to periodically confirm who still needs access to their high-risk SharePoint sites, with owners approving or removing individual users on a recurring basis, so stale access does not accumulate ahead of a Copilot deployment. Which SharePoint Advanced Management capability meets this requirement?

  • ASite access reviews initiated from the data access governance reports Correct
  • BRestricted access control policy on each site
  • CA conditional access policy scoped to SharePoint in Microsoft Entra ID
  • DA sensitivity label configured with a default sharing setting
Site access reviews delegate recurring access recertification to SharePoint site owners to clear stale access before Copilot. SharePoint Advanced Management site access reviews let an administrator hand a flagged site from the data access governance report to its owner, who then confirms or revokes each user's access on a recurring basis, steadily reducing accumulated over-permissioning.

Why A is correct: Correct: SharePoint Advanced Management lets administrators start site access reviews from the DAG reports, delegating to site owners the recurring task of confirming or removing who retains access, which matches the requirement exactly.

Why B is wrong: Tempting because it limits a site to an approved group, but restricted access control enforces a fixed membership boundary rather than asking owners to recertify individual users on a schedule, so it does not deliver the recurring review described.

Why C is wrong: Tempting because conditional access governs sign-in, but it evaluates conditions such as device and location at access time and does not have owners periodically recertify membership, so it does not meet the requirement.

Why D is wrong: Tempting because labels can restrict sharing, but a sensitivity label sets protection at classification time and does not drive a recurring owner-led access recertification, so it does not satisfy the described process.

Other domains in this exam

See also the AB-900 cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.