AB-900 - Understand data protection and governance tasks for Microsoft 365 and Copilot (38% of the exam) - Section 2.1

Understand Microsoft Purview and the capability that addresses a stated data-protection requirement.

Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Security Posture Management (DSPM) for AI, and Data Lifecycle Management; use cases for sensitivity labels; data classification; and retention. Candidates should map a requirement to the right Purview capability rather than recite the product list.

Microsoft Purview Information ProtectionMicrosoft Purview Data Loss Prevention (DLP)Insider Risk ManagementCommunication ComplianceDSPM for AIData Lifecycle Managementsensitivity labelsretention policies

Practice question for this objective

Free sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilotmedium

An administrator must create and manage sensitivity labels, DLP policies, retention policies, and Insider Risk Management for a Microsoft 365 tenant. Which admin centre is the correct place to configure all of these data-protection and governance capabilities?

AThe Microsoft Entra admin center.
BThe Microsoft Purview portal. Correct
CThe Exchange admin center.
DThe Microsoft 365 admin center.

Identify the Microsoft Purview portal as the admin centre for configuring Purview labels, DLP, retention, and insider risk. Microsoft consolidated its data-protection and governance capabilities under Microsoft Purview, and the Microsoft Purview portal is the single console where sensitivity labels, DLP policies, retention policies, and Insider Risk Management are created and managed. It replaced the older Microsoft 365 compliance centre.

Why A is wrong: Tempting because it is a central Microsoft 365 admin surface, but the Microsoft Entra admin center manages identity, users, groups, and access rather than Purview data-protection policies.

Why B is correct: Correct. Sensitivity labels, DLP, retention, and Insider Risk Management are all Microsoft Purview capabilities and are configured in the Microsoft Purview portal, the successor to the former Microsoft 365 compliance centre.

Why C is wrong: Plausible because mail-flow rules can enforce some protections, but the Exchange admin center manages mailboxes and transport, not the unified Purview policy set spanning labels, retention, and insider risk.

Why D is wrong: This portal handles tenant-wide user, licence, and service settings and links out to specialist consoles, but the Purview policies themselves are authored in the Microsoft Purview portal.

See more AB-900 practice questions, answers explained.

Exam traps in Understand data protection and governance tasks for Microsoft 365 and Copilot

Answers that look right on this material and are not. Each one is a distractor from a different question in the AB-900 bank for this domain.

The Microsoft Entra admin center, where directory identities, groups, and conditional access policies are managed
Why it is wrong: The Entra admin center is tempting because identity governs access, but it manages identities and access policies, not the data-protection policies delivered by Microsoft Purview.
The Microsoft Entra admin center
Why it is wrong: The Entra admin center is tempting because it governs identity and conditional access, but it does not host sensitivity labels, DLP, or retention policies.
Compliance Manager
Why it is wrong: Compliance Manager scores the tenant against regulatory frameworks and tracks improvement actions, so it is tempting as a governance dashboard, but it does not surface risks from Copilot prompt and response activity.

More in this domain

Back to all Understand data protection and governance tasks for Microsoft 365 and Copilot objectives, or the AB-900 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.