9 real AB-900 sample questions, each with an explanation of why every option is right or wrong. No account, no card. This is the reasoning the AB-900 tests: knowing why the tempting answer is wrong, not just spotting the right one.
The real AB-900 is Typically 40 to 60 questions questions in 45 minutes, pass mark 700 / 1000. For a domain-by-domain breakdown and a study plan, read the AB-900 study guide. The full bank has 295 questions.
lock_openFree sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilothard
A governance lead asks how Microsoft 365 Copilot decides which documents it can use when answering a prompt. Which statement correctly describes the access model Copilot applies?
- ACopilot uses the signed-in user's existing permissions and can only reference content that the user already has rights to open.check_circle Correct
- BCopilot is granted a dedicated service identity with tenant-wide read access so it can reason over every document in the organisation.
- CCopilot can read any file whose sensitivity label is lower than the user's clearance level, regardless of sharing permissions.
- DCopilot indexes content under an administrator identity, then filters results to the user only at display time.
Copilot inherits the signed-in user's existing permissions and surfaces only content that user could already access. Copilot resolves grounding data through Microsoft Graph in the user's own security context, so permission trimming occurs at query time and Copilot cannot expose files the user lacks rights to open.
Why A is correct: Correct. Copilot has no access model of its own; it queries content through Microsoft Graph in the user's security context, so it surfaces only what that user could already retrieve.
Why B is wrong: Tempting because Copilot can seem to 'know everything', but it holds no elevated tenant-wide identity; it always operates within the requesting user's permissions.
Why C is wrong: Sensitivity labels influence protection and usage rights, but access is decided by the user's file permissions, not by a clearance comparison, so this is wrong.
Why D is wrong: This sounds plausible given central indexing, but retrieval is trimmed by permission in the user's context during the query, not by a late display-time filter over admin-read data.
lock_openFree sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilothard
An administrator wants to understand the role of the semantic index in Microsoft 365 Copilot. Which description best captures what the semantic index provides?
- AA separate copy of all tenant files moved into the Copilot service so responses can be generated without touching Microsoft 365 data.
- BA conceptual, meaning-based map of tenant content and interactions that helps Copilot find relevant grounding data while respecting each user's permissions.check_circle Correct
- CA keyword lookup table that matches prompt terms to file names and returns any document containing the exact words.
- DA compliance log that records which prompts each user submitted so that auditors can review Copilot activity.
The semantic index is a meaning-based representation of tenant content that improves Copilot grounding while preserving permission trimming. The semantic index maps content and interactions by conceptual meaning and relationships so Copilot can retrieve relevant grounding data, and retrieval still honours each user's existing permissions.
Why A is wrong: Tempting as an efficiency story, but the semantic index does not export a parallel data store outside the tenant boundary; grounding data stays within Microsoft 365.
Why B is correct: Correct. The semantic index represents content and relationships by meaning rather than exact keywords, improving grounding relevance while retrieval stays permission-trimmed per user.
Why C is wrong: This describes classic keyword search; the semantic index is meaning-based and captures relationships, so a plain keyword table understates what it does.
Why D is wrong: Audit and activity records exist elsewhere in Microsoft Purview; the semantic index is a relevance structure for grounding, not an audit log.
lock_openFree sampleUnderstand data protection and governance tasks for Microsoft 365 and Copilothard
A security team wants to discover, monitor, and reduce data security risks specifically arising from generative AI use, including prompts and responses in Microsoft 365 Copilot. Which Microsoft Purview capability is purpose-built for this?
- ACompliance Manager, which produces regulatory assessments and improvement actions against control frameworks.
- BContent search, which lets an investigator run keyword queries across mailboxes and sites to locate specific items.
- CData Security Posture Management (DSPM) for AI, which surfaces AI interactions and highlights sensitive-data risk in Copilot usage.check_circle Correct
- DActivity Explorer, which lists individual labelling and DLP events after they have occurred.
DSPM for AI in Microsoft Purview is the capability that discovers and monitors generative AI activity and its sensitive-data risk. DSPM for AI is scoped to generative AI usage, giving visibility into Copilot prompts and responses and the sensitive information involved, which the assessment, search, and event-reporting tools do not do.
Why A is wrong: Compliance Manager scores regulatory posture and suggests actions; it does not discover or monitor AI prompt and response activity, so it does not fit this need.
Why B is wrong: Content search finds existing stored items by query; it is not built to surface and analyse AI interaction risk, so it is the wrong tool here.
Why C is correct: Correct. DSPM for AI is designed to discover and monitor generative AI activity, including Copilot prompts and responses, and flag associated sensitive-data risks for remediation.
Why D is wrong: Activity Explorer reports historical label and policy events, which is tempting, but it is not the dedicated AI-risk discovery surface that DSPM for AI provides.
lock_openFree sampleIdentify the core features and objects of Microsoft 365 serviceseasy
An administrator needs to create shared mailboxes, configure mail flow rules, and manage email retention for the organisation. Which admin centre is purpose-built for these mailbox and mail flow tasks?
- AExchange admin centercheck_circle Correct
- BMicrosoft 365 admin center
- CSharePoint admin center
- DMicrosoft Purview portal
The Exchange admin center is the console for mailboxes, mail flow rules, and messaging configuration. Mailboxes, shared mailboxes, transport rules, and messaging retention are Exchange Online objects, so they are administered in the Exchange admin center rather than the tenant-wide or content-focused centres.
Why A is correct: The Exchange admin center is the dedicated console for mailboxes, mail flow rules, and messaging retention, so it is where shared mailboxes and transport rules are configured.
Why B is wrong: This centre handles tenant-wide users, licences, and billing, and it links out to specialist centres, but shared mailboxes and mail flow rules are configured in the dedicated messaging centre rather than here.
Why C is wrong: This centre manages sites, storage, and sharing policies for SharePoint, which is tempting because it also touches content, but it does not configure mailboxes or mail flow.
Why D is wrong: This portal governs compliance, retention labels, and data protection across services, which sounds related to email retention, but it does not create mailboxes or set transport rules.
lock_openFree sampleIdentify the core features and objects of Microsoft 365 serviceseasy
A new employee needs a Microsoft 365 E3 licence, and the administrator wants to assign it once to a security group so every current and future member inherits it automatically. Which capability supports assigning the licence to the group rather than to each user individually?
- AConditional access policies
- BGroup-based licensing in Microsoft Entra IDcheck_circle Correct
- CSensitivity labels
- DAdministrative units
Group-based licensing in Microsoft Entra ID assigns licences to a group so members inherit them automatically. Assigning a licence to a group means membership drives entitlement, so users gain the licence when they join and lose it when they leave, which removes per-user assignment work.
Why A is wrong: Conditional access governs the conditions under which users may sign in, which is tempting because it also targets groups, but it does not assign product licences.
Why B is correct: Group-based licensing lets an administrator assign a licence to a group so members inherit it automatically, which is exactly the requirement described.
Why C is wrong: Sensitivity labels classify and protect content, so they may appear governance-related, but they play no part in granting a licence to users or groups.
Why D is wrong: Administrative units scope administrative permissions to a subset of the directory, which sounds organisational, but they delegate management rather than assign licences to members.
lock_openFree sampleIdentify the core features and objects of Microsoft 365 serviceseasy
An organisation wants to control who can create new teams, set meeting policies, and manage messaging settings for collaboration and calling. Which admin centre configures these Teams objects and policies?
- ASharePoint admin center
- BExchange admin center
- CTeams admin centercheck_circle Correct
- DMicrosoft Entra admin center
The Teams admin center configures team creation controls, meeting policies, and messaging policies. Meeting policies, messaging policies, and team creation settings are Teams service objects, so they are administered in the Teams admin center rather than the underlying identity, mail, or storage centres.
Why A is wrong: SharePoint underpins the files behind a team, so this centre is tempting, but meeting and messaging policies for Teams are set in the dedicated Teams console, not here.
Why B is wrong: This centre governs mailboxes and mail flow, which supports Teams calendaring indirectly, but it does not configure Teams meeting or messaging policies.
Why C is correct: The Teams admin center is the dedicated console for team creation controls, meeting policies, and messaging policies, so it is the correct place for these settings.
Why D is wrong: This centre manages identities, groups, and sign-in, which is tempting because teams are backed by groups, but Teams-specific meeting and messaging policies live in the Teams console.
lock_openFree samplePerform basic administrative tasks for Copilot and agentsmedium
An organisation runs a workload where employees only occasionally use a custom agent, and it wants to be charged for the consumption those interactions generate rather than committing to a fixed per-user subscription. Which Microsoft 365 Copilot commercial model matches this requirement?
- AThe Microsoft 365 Copilot per-user monthly licence, which grants each assigned user unlimited use for a fixed recurring fee
- BA Microsoft Entra ID P2 subscription, which includes Copilot agent usage as part of its identity governance features
- CPay-as-you-go billing, which meters agent consumption and charges the organisation for the messages actually usedcheck_circle Correct
- DA Microsoft 365 E5 add-on that converts unused Copilot licences into consumption credits automatically
Distinguish the fixed per-user Microsoft 365 Copilot licence from consumption-based pay-as-you-go billing for agents. Pay-as-you-go is a metered model that charges for the volume of agent messages consumed, which suits intermittent or unpredictable usage where a fixed per-user licence would be poor value.
Why A is wrong: This is a real model and is tempting because it is the headline Copilot offer, but it charges a flat fee per assigned user regardless of usage, which is the opposite of paying only for occasional consumption.
Why B is wrong: Entra ID P2 covers identity protection and governance such as Privileged Identity Management; it does not include or meter Copilot agent consumption, so it cannot fulfil the billing requirement.
Why C is correct: Pay-as-you-go bills on metered consumption of agent messages, so an organisation with occasional use pays for what it consumes rather than a fixed per-user fee.
Why D is wrong: This sounds plausible because E5 bundles many add-ons, but no such automatic licence-to-credit conversion add-on exists, making it an invented mechanism.
lock_openFree samplePerform basic administrative tasks for Copilot and agentsmedium
A research team wants a Microsoft 365 Copilot capability that can perform multi-step research across work data and the web to produce a structured, reasoned report on a complex topic. Which capability is designed for this reasoning-heavy research work?
- AAnalyst, a reasoning agent that runs data analysis over raw datasets to surface trends and calculations
- BThe semantic index, which ranks tenant content so prompt responses draw on the most relevant documents
- CCopilot Studio, the low-code environment used to build and publish custom agents for the organisation
- DResearcher, a reasoning agent that carries out multi-step research across work and web data to build a structured reportcheck_circle Correct
Identify Researcher as the reasoning agent for multi-step research and reporting within Microsoft 365 Copilot. Researcher chains multiple reasoning and retrieval steps across both work data and the web to compile a structured report, distinguishing it from Analyst, which concentrates on analysing datasets.
Why A is wrong: Analyst is a genuine reasoning agent, which makes it tempting, but it focuses on interrogating raw data such as spreadsheets to produce analytical outputs, not multi-step topic research and reporting.
Why B is wrong: The semantic index improves retrieval relevance behind the scenes; it is infrastructure that supports responses, not an agent that conducts multi-step research on request.
Why C is wrong: Copilot Studio is the authoring tool for creating custom agents, so it is a builder rather than the ready-made research capability the team is asking for.
Why D is correct: Researcher is the reasoning agent purpose-built to run deep, multi-step investigations across work content and the web and return a structured report, which matches the requirement exactly.
lock_openFree samplePerform basic administrative tasks for Copilot and agentsmedium
A data team needs a Microsoft 365 Copilot capability that can take a raw dataset such as a sales spreadsheet, run calculations and analysis on it, and surface trends without the user writing formulas. Which capability is built for this analytical task?
- AAnalyst, a reasoning agent that analyses raw data to run calculations and reveal trends for the usercheck_circle Correct
- BResearcher, which performs multi-step research across work and web sources to produce a written report
- CMicrosoft Purview DSPM for AI, which discovers and monitors data security risks arising from AI use
- DThe Microsoft 365 Copilot per-user licence, which unlocks analytical features as a billing entitlement
Recognise Analyst as the Copilot reasoning agent that analyses raw datasets to produce calculations and trends. Analyst applies reasoning to raw data such as spreadsheets, running analysis and calculations to expose trends, which separates it from Researcher's multi-step topic research role.
Why A is correct: Analyst is the reasoning agent designed to work over raw datasets, performing analysis and calculations to surface trends, which is precisely what the data team needs.
Why B is wrong: Researcher is a real reasoning agent, but it is oriented to broad multi-step topic research and reporting rather than running calculations over a supplied dataset.
Why C is wrong: DSPM for AI is a governance capability that watches AI-related data risk; it does not perform data analysis on a user's spreadsheet, so it does not meet the requirement.
Why D is wrong: A licence is a commercial entitlement rather than a capability; naming it here confuses what grants access with the tool that actually performs the analysis.
Examworthy is not affiliated with or endorsed by Microsoft. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. AB-900 and related marks belong to their respective owners.
