📘 Free AB-900 Sample Questions
HOTSPOT -
You want to view the administrative actions taken by a service administrator in Microsoft 365.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
A
Correct Answer:
A.
Explanation:
You can use Search & intelligence in the Microsoft 365 admin center.
Yes
Generally, Search & intelligence related to compliance and audit is mainly in the Microsoft Purview portal.
admin center, but full audit/search functionality is centralized in Purview.
You can use Audit in the Microsoft Defender portal.
Yes
Yes
However, Microsoft 365 admin center does include some basic search capabilities like content search for
eDiscovery or mailbox searches via the Security & Compliance section (which now redirects to Purview).
So, depending on interpretation, basic search & intelligence features can be initiated from the Microsoft 365
The Microsoft Defender portal is focused on threat management but does include some audit and event logs
specifically related to Defender products (like attack detection history).
So, some audit functionality is available but only for Defender-related telemetry.
You can use Audit in the Microsoft Purview portal.
Microsoft Purview is the main portal for audit log search and investigations across Microsoft 365 services.
HOTSPOT -
Select the answer that correctly completes the sentence.
A
Correct Answer:
A.
Explanation:
time-bound role activation.
Microsoft Entra Privileged Identity Management (PIM) is a service that enables you to manage, control, and
monitor access to important resources in your organization. The core philosophy of PIM is Zero Trust,
specifically the principle of Just-In-Time (JIT) access.
Your organization has a Microsoft 365 E5 subscription.
You need to ensure that a third-party cloud service can authenticate to Microsoft Entra.
What should you configure?
A
a Microsoft 365 Copilot connector
B
multifactor authentication (MFA)
C
. a Conditional Access policy
D
an app registration
Correct Answer:
D. an app registration
Explanation:
D .an app registration.
An app registration creates a service principal in Azure AD (Microsoft Entra) and supplies the credentials
(client ID, tenant ID, secret or certificate) that external SaaS applications use to sign in to Microsoft 365.
External services that need to authenticate to Entra must be registered as “enterprise applications” and
granted an appropriate permission (e.g.,ApplicationPermissions such asUser.Read.All or Directory.Read.All).
Once registered, the service can use OAuth2.0 client-credential flow (or certificate-based authentication) to
obtain an access token, enabling secure programmatic access without interactive user involvement.
Why the other options are not suitable
A – Microsoft365 Copilot connector – This is used to expose Copilot data to external tools; it does not
provide a generic authentication mechanism for arbitrary third-party services.
B – Multifactor authentication (MFA) – MFA protects user sign-ins, but external services typically run
non-interactive flows and cannot present a second factor; they rely on service-principal authentication rather
than user-based MFA.
C – Conditional Access policy – Conditional Access enforces policies (e.g., location, device compliance) on
sign-ins, but it does not establish the credential set needed for an app to authenticate; it only governs access
after authentication has occurred.
Therefore, configuring an app registration is the precise step that enables a third-party cloud service to
authenticate to Microsoft Entra.
References
App registration and service principal overview: https://learn.microsoft.com/en-us/azure/active-
directory/develop/app-objects-and-service-principals
Authentication flows for daemon applications (client-credential flow): https://learn.microsoft.com/en-
us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow
These links are current as of 2025 and illustrate the concepts referenced above.
HOTSPOT -
Select the answer that correctly completes the sentence.
A
Correct Answer:
A.
Explanation:
provide control over how users can access cloud apps.
Conditional Access is the "if-then" engine of Microsoft Entra ID (formerly Azure AD). It allows you to enforce
specific security requirements before a user is granted access to an application or resource.
HOTSPOT -
Select the answer that correctly completes the sentence.
A
Correct Answer:
A.
Explanation:
accountability.
The Microsoft Responsible AI principle of accountability dictates that the people who design and deploy AI
systems must be responsible for how those systems operate. This involves creating internal review bodies and
ensuring that humans maintain ultimate oversight and control over the AI's actions and impacts.
HOTSPOT -
A user named User5 navigates to https://myapps.microsoft.com. After entering their username and password,
User5 receives the following message on their mobile device.
A
Correct Answer:
A.
Explanation:
the Microsoft Authenticator app.
In Microsoft Entra ID (formerly Azure AD), the Microsoft Authenticator app is considered one of the most
secure and versatile methods for Multi-Factor Authentication (MFA) because it supports several verification
methods beyond just a simple code.
Your organization has a Microsoft 365 subscription.
You need to evaluate your organization’s Identity Secure Score.
Which two factors affect the score? Each correct answer presents a complete the solution.
NOTE: Each correct selection is worth one point.
A
the SharePoint site permissions
B
the number of global administrators
C
passwords that are never expired
D
the location of the users
Correct Answer:
B. the number of global administrators
Explanation:
B –the number of global administrators
C –passwords that are never expired
Why these are the right factors
global administrators lowers privileged access risk, directly improving the score.
Why the other options are not considered
References
Identity Secure Score evaluates the strength of an organization’s identity posture. Reducing the count of
Enforcing passwords that do not expire (i.e., requiring periodic change) is a recommended control; leaving
passwords permanently unchanged raises the risk of credential misuse and therefore negatively impacts the
score.
direct component of the Identity Secure Score calculation.
A – SharePoint site permissions: While proper permission hygiene is important for overall security, it is not a
D – The location of the users: User location may affect compliance considerations, but it is not a parameter
that influences the Secure Score’s identity-related metrics.
Microsoft Secure Score – Identity page
Password policies and expiration in Microsoft 365
Your organization has a Microsoft 365 subscription.
You need to review the impact of a recent phishing incident that targeted email users.
What should you use?
A
the Microsoft Defender portal
B
. the Microsoft 365 admin center
C
the Microsoft Entra admin center
D
the Microsoft Exchange admin center
Correct Answer:
A. the Microsoft Defender portal
Explanation:
Why optionA is the correct choice
The Microsoft Defender portal (Defender for Office 365) provides native capabilities for investigating phishing
incidents, including email trace, quarantine/release, threat-intelligence reports, and the
“Investigate&respond” workflow.
It surfaces malicious-email indicators, malicious-sender reputation, attachment scanning results (Safe
Attachments), and URLreputation (Safe Links), enabling you to assess the scope and impact of a targeted
phishing campaign.
All remediation actions (e.g., message quarantine, user notifications, policy adjustments) are centrally
managed from this portal.
Why the other options are less suitable
Microsoft 365 admin center – a general-purpose admin hub that does not expose the granular email-threat
analytics needed for forensic investigation.
access) and does not contain mail-content analysis or threat-intelligence data.
that are only available through the Defender portal.
References
Microsoft Entra admin center – focuses on identity and access management (users, groups, SSO, conditional
Microsoft Exchange admin center – manages mailbox configuration, transport rules, and mail flow but lacks
the integrated phishing-investigation tools (e.g., Safe Attachments, Safe Links, incident response playbooks)
Microsoft Defender for Office 365 – Investigation & response: https://learn.microsoft.com/en-us/microsoft-
365/security/office-365-security/anti-phishing-protection
Investigate phishing emails using the Security & Compliance Center: https://learn.microsoft.com/en-
us/exchange/security-and-compliance/anti-phishing
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
A
Correct Answer:
A.
Explanation:
1. Microsoft Defender for Office 365 provides protection from phishing and malware attacks.
Yes
Microsoft Defender for Office 365 is specifically designed to protect email and collaboration tools like
Exchange Online, SharePoint, and Teams.
It includes:
Anti-phishing protection (detects fake emails, impersonation)
Anti-malware scanning (attachments and links)
Safe Links & Safe Attachments features
2. Microsoft Defender for Identity monitors identities in Active Directory domains.
Yes
Microsoft Defender for Identity focuses on identity-based threats.
It:
Monitors on-premises Active Directory
Detects suspicious behavior (e.g., lateral movement, credential theft)
Uses domain controller signals to analyze activity
(No
Microsoft Defender Vulnerability Management is used for:
Identifying vulnerabilities in devices and software
Providing remediation recommendations
Risk-based vulnerability prioritization
However:
3. Microsoft Defender Vulnerability Management provides protection for software as a service (SaaS)
applications.
It does NOT protect SaaS apps
SaaS protection is handled by tools like Microsoft Defender for Cloud Apps
HOTSPOT -
Your organization has a Microsoft 365 subscription that contains a Microsoft SharePoint site named Site1. The
permissions for Site1 are configured as shown in the following exhibit.
A
Correct Answer:
A.
Explanation:
a Site Member of
Has edit permissions
Can:
Add/edit/delete content (documents, lists)
Collaborate with others.
Questions: 1-10 out of 89
Continue Full Practice..
GET ALL 89 QUESTIONS