AB-900 - Understand data protection and governance tasks for Microsoft 365 and Copilot (38% of the exam) - Section 2.3
Identify data protection and governance risks using the appropriate Purview tool.
Compliance Manager for compliance risks and recommendations, Data Explorer for sensitive information, Insider Risk Management, responding to DLP alerts, Communication Compliance policy violations, Activity Explorer, DSPM for AI to discover and manage AI activity, and Content search in eDiscovery. Each tool answers a distinct question, and picking the wrong one is the classic distractor.
Microsoft Purview Compliance ManagerData ExplorerActivity ExplorerDSPM for AIContent search in eDiscoveryDLP alerts
Practice question for this objective
lock_openFree sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilothard
A security team wants to distinguish two Microsoft Purview capabilities before a Copilot rollout: one that continuously discovers and reports data security risks arising from generative AI activity such as prompts and responses, and one that shows a historical record of activities performed on labelled content. Which pairing correctly matches each need?
ACompliance Manager discovers AI-related data risks, and Content search shows the historical activities performed on labelled content.
BData Security Posture Management for AI discovers AI-related data risks, and Activity Explorer shows the historical activities performed on labelled content.check_circle Correct
CActivity Explorer discovers AI-related data risks, and Data Security Posture Management for AI shows the historical activities performed on labelled content.
DData Loss Prevention discovers AI-related data risks, and Compliance Manager shows the historical activities performed on labelled content.
Differentiate DSPM for AI (discover AI risk) from Activity Explorer (historical activity on labelled content). DSPM for AI is designed to discover and monitor data security risks from generative AI, whereas Activity Explorer surfaces the audit-style record of what happened to classified content, making them complementary but distinct.
Why A is wrong: Compliance Manager scores control assessments rather than discovering AI risk, and Content search finds items rather than reporting activity history, so both halves are mismatched.
Why B is correct: DSPM for AI is purpose-built to surface risks from generative AI usage, while Activity Explorer reports past activities on classified content, so this matches each capability to its intended job.
Why C is wrong: This swaps the two roles; DSPM for AI is the discovery tool for AI risk and Activity Explorer is the activity-history view, so reversing them is wrong.
Why D is wrong: DLP prevents egress of sensitive data rather than discovering AI risk, and Compliance Manager tracks assessments, not activity history, so neither element fits the stated needs.
Exam traps in Understand data protection and governance tasks for Microsoft 365 and Copilot
Answers that look right on this material and are not. Each one is a distractor from a different question in the AB-900 bank for this domain.
Data loss prevention alerts
errorWhy it is wrong: DLP alerts notify the team when a policy is violated, which relates to sensitive data, but they do not present where such data resides or how it is classified across repositories.
Microsoft Entra ID sign-in logs, because they record every Copilot session the user started.
errorWhy it is wrong: Tempting because sign-in logs do prove authentication events, but they record identity and access activity rather than the text of prompts and responses, so they cannot supply the content an eDiscovery review needs.
Activity Explorer answers the obligations question, and Compliance Manager answers the actions-on-labelled-content question
errorWhy it is wrong: This reverses the two tools; Activity Explorer does not score obligations and Compliance Manager does not report per-item label activity, making the pairing incorrect.