AB-900 - Understand data protection and governance tasks for Microsoft 365 and Copilot - Section 2.1

Understand Microsoft Purview and the capability that addresses a stated data-protection requirement.

Information Protection, Data Loss Prevention, Insider Risk Management, Communication Compliance, Data Security Posture Management (DSPM) for AI, and Data Lifecycle Management; use cases for sensitivity labels; data classification; and retention. Candidates should map a requirement to the right Purview capability rather than recite the product list.

Microsoft Purview Information ProtectionMicrosoft Purview Data Loss Prevention (DLP)Insider Risk ManagementCommunication ComplianceDSPM for AIData Lifecycle Managementsensitivity labelsretention policies

Practice question for this objective

Free sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilotmedium

An administrator must create and manage sensitivity labels, DLP policies, retention policies, and Insider Risk Management for a Microsoft 365 tenant. Which admin centre is the correct place to configure all of these data-protection and governance capabilities?

AThe Microsoft Entra admin center.
BThe Microsoft Purview portal. Correct
CThe Exchange admin center.
DThe Microsoft 365 admin center.

Identify the Microsoft Purview portal as the admin centre for configuring Purview labels, DLP, retention, and insider risk. Microsoft consolidated its data-protection and governance capabilities under Microsoft Purview, and the Microsoft Purview portal is the single console where sensitivity labels, DLP policies, retention policies, and Insider Risk Management are created and managed. It replaced the older Microsoft 365 compliance centre.

Why A is wrong: Tempting because it is a central Microsoft 365 admin surface, but the Microsoft Entra admin center manages identity, users, groups, and access rather than Purview data-protection policies.

Why B is correct: Correct. Sensitivity labels, DLP, retention, and Insider Risk Management are all Microsoft Purview capabilities and are configured in the Microsoft Purview portal, the successor to the former Microsoft 365 compliance centre.

Why C is wrong: Plausible because mail-flow rules can enforce some protections, but the Exchange admin center manages mailboxes and transport, not the unified Purview policy set spanning labels, retention, and insider risk.

Why D is wrong: This portal handles tenant-wide user, licence, and service settings and links out to specialist consoles, but the Purview policies themselves are authored in the Microsoft Purview portal.

See more AB-900 practice questions, answers explained.

More in this domain

Back to all Understand data protection and governance tasks for Microsoft 365 and Copilot objectives, or the AB-900 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.