AB-900 · Sample questions

AB-900 sample questions with answers and explanations

6 real questions from the CertifyDeck AB-900 bank, spread across the domains of the official Microsoft 365 Certified: Copilot and Agent Administration Fundamentals skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.

1. Question 1Domain: Identify the core features and objects of Microsoft 365 servicesMedium

   The change will first be validated with a small group and then expanded in phases. At Contoso, the Human Resources department is affected. The administrator must correlate incidents across identities, endpoints, email, and cloud applications while preserving the existing Microsoft 365 permissions model. Which capability should the administrator use?

   • A.Authentication methods
   • B.Threat protection and intelligence
   • C.Microsoft Defender XDR
   • D.Zero Trust
   Show answer and explanation

   Correct answer: C. Microsoft Defender XDR

   Explanation

   Microsoft Defender XDR directly addresses the requirement to correlate incidents across identities, endpoints, email, and cloud applications. Authentication methods is instead used to prove the identity of a person or workload before access is evaluated; Threat protection and intelligence is instead used to use current signals and research to anticipate and respond to malicious activity; Zero Trust is instead used to verify explicitly, use least privilege, and assume that a breach can occur.

   Official references

   • Official AB-900 study guide
2. Question 2Domain: Identify the core features and objects of Microsoft 365 servicesMedium

   The current process depends on individual administrators and needs to become policy-driven. At Adventure Works, the Legal department is affected. The administrator must measure the tenant's identity-security posture and prioritize recommended improvements and the solution must be auditable by the security team. Which capability should the administrator use?

   • A.Single sign-on (SSO)
   • B.Microsoft Entra users and groups
   • C.Microsoft Entra sign-in and diagnostic logs
   • D.Identity Secure Score
   Show answer and explanation

   Correct answer: D. Identity Secure Score

   Explanation

   Identity Secure Score directly addresses the requirement to measure the tenant's identity-security posture and prioritize recommended improvements. Single sign-on (SSO) is instead used to let a user access several approved applications after one authentication experience; Microsoft Entra users and groups is instead used to assign the same access consistently to several people with the same job function; Microsoft Entra sign-in and diagnostic logs is instead used to find why a sign-in was interrupted by MFA, risk, or an access policy.

   Official references

   • Official AB-900 study guide
3. Question 3Domain: Perform basic administrative tasks for Copilot and agentsMedium

   The help desk needs a repeatable procedure that first-line technicians can follow. At Adventure Works, the Legal department is affected. The administrator must choose between per-user recurring entitlement and consumption-based billing for eligible experiences and the solution must be auditable by the security team. Which capability should the administrator use?

   • A.Built-in Copilot and custom agents
   • B.Copilot feature controls
   • C.Researcher
   • D.Monthly licensing and pay-as-you-go
   Show answer and explanation

   Correct answer: D. Monthly licensing and pay-as-you-go

   Explanation

   Monthly licensing and pay-as-you-go directly addresses the requirement to choose between per-user recurring entitlement and consumption-based billing for eligible experiences. Built-in Copilot and custom agents is instead used to decide whether a standard assistant experience is sufficient or a scoped specialist is needed; Copilot feature controls is instead used to control the availability of optional assistant experiences for the organization; Researcher is instead used to perform a multi-step investigation that synthesizes information into a sourced report.

   Official references

   • Official AB-900 study guide
4. Question 4Domain: Perform basic administrative tasks for Copilot and agentsMedium

   A support escalation showed that the previous configuration was technically valid but addressed the wrong layer. At Northwind, the Legal department is affected. The administrator must review a submitted specialist before making it broadly available using a native Microsoft 365 administrative capability. Which capability should the administrator use?

   • A.Agent Builder
   • B.Agent approval workflow
   • C.Microsoft 365 and Power Platform agent analytics
   • D.Agent user access controls
   Show answer and explanation

   Correct answer: B. Agent approval workflow

   Explanation

   Agent approval workflow directly addresses the requirement to review a submitted specialist before making it broadly available. Agent Builder is instead used to build a lightweight specialist from instructions and approved knowledge sources; Microsoft 365 and Power Platform agent analytics is instead used to track specialist usage, operational health, ownership, and lifecycle across admin portals; Agent user access controls is instead used to allow only an intended audience to discover and use a specialist experience.

   Official references

   • Official AB-900 study guide
5. Question 5Domain: Understand data protection and governance tasks for Microsoft 365 and CopilotMedium

   The current process depends on individual administrators and needs to become policy-driven. At Contoso, the Research department is affected. The administrator must apply a persistent classification and protection marking to sensitive content using a native Microsoft 365 administrative capability. Which capability should the administrator use?

   • A.Microsoft Purview data classification
   • B.Sensitivity labels
   • C.Retention policies and labels
   • D.Microsoft Purview solution catalog
   Show answer and explanation

   Correct answer: B. Sensitivity labels

   Explanation

   Sensitivity labels directly addresses the requirement to apply a persistent classification and protection marking to sensitive content. Microsoft Purview data classification is instead used to discover and categorize content by sensitivity and trainable or exact data matches; Retention policies and labels is instead used to keep or delete content for a defined period according to business and regulatory rules; Microsoft Purview solution catalog is instead used to choose among information protection, data-loss, insider-risk, communications, AI posture, and lifecycle controls.

   Official references

   • Official AB-900 study guide
6. Question 6Domain: Understand data protection and governance tasks for Microsoft 365 and CopilotMedium

   The current process depends on individual administrators and needs to become policy-driven. At Contoso, the Legal department is affected. The administrator must see which users performed classification, labeling, or protection activities without changing existing content ownership. Which capability should the administrator use?

   • A.Communication Compliance
   • B.Microsoft Purview Activity explorer
   • C.Data Security Posture Management for AI
   • D.Microsoft Purview eDiscovery Content search
   Show answer and explanation

   Correct answer: B. Microsoft Purview Activity explorer

   Explanation

   Microsoft Purview Activity explorer directly addresses the requirement to see which users performed classification, labeling, or protection activities. Communication Compliance is instead used to review potentially inappropriate or noncompliant messages for policy violations; Data Security Posture Management for AI is instead used to discover generative-AI use and prioritize data-security risks and policy recommendations; Microsoft Purview eDiscovery Content search is instead used to find relevant messages and documents for an investigation or legal matter.

   Official references

   • Official AB-900 study guide