AB-900 Dumps with Practice Exam Questions Answers

The correct answer is D. Data Lifecycle Management . Microsoft Learn states that Microsoft Purview retention policies and retention labels, managed under Data Lifecycle Management , support three core outcomes: retain-only , delete-only , and retain and then delete . The requirement in this question is exact: keep email for seven years and then permanently delete it. That is a textbook retain and then delete retention configuration, which Microsoft documents as part of Purview’s retention capabilities. Microsoft also recommends using Microsoft 365 retention policies and labels for retaining and deleting emails rather than relying on older Exchange-only approaches in most modern compliance scenarios.

The other options do not meet the requirement. Information Protection focuses on labeling and protecting sensitive information. Insider Risk Management is used to detect and investigate risky user behavior. Data Loss Prevention helps prevent inappropriate sharing or exfiltration of sensitive data. None of those are designed to enforce a timed seven-year retention period followed by automatic permanent deletion. The Microsoft Purview solution explicitly built for that lifecycle requirement is Data Lifecycle Management .

The correct answer is B. the Microsoft Purview DSPM for AI solution . Microsoft documents that Data Security Posture Management for AI (DSPM for AI) in Microsoft Purview provides a central place to secure data for AI apps and proactively monitor AI use , including Copilots and agents . Microsoft also states that DSPM for AI helps organizations identify where sensitive content is used in AI interactions , review Copilot prompts and responses , analyze usage patterns , assess exposure and oversharing risks, and get recommendations for protections such as sensitivity labels and DLP policy coverage.

The other options do not fit this requirement. Microsoft Viva Insights focuses on productivity and work-pattern analytics, not sensitive-data protection in Copilot interactions. Microsoft Security Copilot is a security assistant for analysts, not the Purview governance solution that analyzes sensitive content use in Copilot and recommends data protections. Insider Risk Management is for identifying risky user behavior, not for broad AI interaction posture analysis and protection recommendations. Microsoft specifically positions DSPM for AI as the “front door” for discovering, monitoring, and protecting AI-related data usage in Microsoft 365 Copilot.

In Microsoft 365 Copilot, you should use the Researcher agent to perform multi-step reasoning over unstructured data.

The correct answer is the Researcher agent . Microsoft describes Researcher in Microsoft 365 Copilot as an agent for complex, multi-step research that can reason across information sources and synthesize findings into structured outputs. That aligns with the phrase multi-step reasoning in the question. Microsoft’s guidance also contrasts Researcher with Analyst , which is aimed more at data analysis and spreadsheet-oriented tasks.

The other options are less suitable. Chat is general-purpose and not the specialized tool Microsoft positions for deeper multi-step research workflows. A notebook is used to organize materials and chats, not as the main reasoning engine for this scenario. The Analyst agent is better suited to structured data analysis, trends, and calculations rather than broad reasoning over unstructured data such as documents, notes, and mixed content. Based on Microsoft’s product positioning, the best fit for multi-step reasoning over unstructured information is the Researcher agent .

The correct answers are A and D because Microsoft Entra Identity Secure Score is based on identity security recommendations, and Microsoft Learn specifically lists recommendations such as “Designate more than one Global Administrator” and “Do not expire passwords.” That means the number of global administrators in the tenant and whether password expiration is disabled directly influence the Identity Secure Score. Microsoft also notes that the score measures how closely an organization aligns with Microsoft’s recommended identity security best practices.

Option B is incorrect because SharePoint site permissions are related to SharePoint and Microsoft 365 workload permissions, not to the Entra identity-focused scoring model. Option C is incorrect because user location may be evaluated in Conditional Access and Zero Trust scenarios, but it is not itself listed as a direct Identity Secure Score factor in the Microsoft Entra recommendations referenced by Microsoft Learn. Identity Secure Score is driven by tracked identity recommendations and security configurations, not by simple geographic placement of users.

The correct answer is C. the Microsoft 365 admin center . Microsoft Learn documents a specific Copilot image generation setting in the Microsoft 365 admin center under Copilot > Settings > Copilot actions > Copilot image generation . Microsoft states that when this scenario is allowed, users can ask Copilot to create, design, and edit images. When it is not allowed, Copilot does not generate images and instead responds with stock or brand images. This directly matches the requirement to prevent users from generating images by using Copilot.

The other options are incorrect because Microsoft does not document this control as being managed from Defender, Purview, or Entra for this scenario. Microsoft also separately notes that organizations can control access to Designer image generation through policy, but the admin experience for managing the Microsoft 365 Copilot scenario itself is explicitly surfaced in the Microsoft 365 admin center . Therefore, for an exam question focused on where an admin should go to disable image generation in Copilot, the best and documented answer is the Microsoft 365 admin center .