AB-900 Exam Preparation Material | Microsoft 365 Copilot and Agent Administration Fundamentals

Explanation:
The correct answer is A. the Microsoft Defender portal. Microsoft documents that phishing investigation and analysis for email threats is handled in Microsoft Defender for Office 365 through the Microsoft Defender portal. Microsoft’s phishing investigation guidance and email security reporting both point admins to Defender capabilities such as Threat Explorer, campaign views, and phish reports to understand the scope, affected users, and impact of phishing attacks.
The other options are not the primary investigation tool for this scenario. The Microsoft 365 admin center is mainly for tenant administration and usage reporting, not detailed phishing impact investigation. The Microsoft Entra admin center focuses on identity and access management, not email threat analysis. The Exchange admin center manages mail flow and Exchange settings, but Microsoft’s current phishing investigation workflows are centered in the Microsoft Defender portal, where security analysts can review detections, remediation actions, and affected recipients.
So, to review the impact of a phishing incident that targeted email users, the Microsoft-documented choice is the Microsoft Defender portal.

Explanation:
You can use a Microsoft Entra security group to assign permissions to Microsoft Entra ID resources. Answer. Yes
You can use a Microsoft Entra security group to assign Microsoft 365 licenses.
Answer. Yes
You can use a Microsoft Entra security group to assign permissions to Microsoft Exchange mailboxes.
Answer. No

Explanation:
Prevent users from sharing PII: Data Loss Prevention
Use machine learning to train a model: Information Protection
The correct selections are Data Loss Prevention and Information Protection. Microsoft states that Microsoft Purview Data Loss Prevention (DLP) helps organizations identify, monitor, and automatically protect sensitive information, including preventing people from sharing sensitive items such as PII in Microsoft 365 locations and other supported channels. That directly matches the requirement to stop users from sharing files that contain personally identifiable information.
For the second requirement, the correct choice is Information Protection because Microsoft Purview’s classification and labeling capabilities include trainable classifiers, which Microsoft describes as a tool you can train using machine learning to recognize types of sensitive or business content. Microsoft positions these classification capabilities under Microsoft Purview Information Protection and data classification. That makes Information Protection the best fit for “use machine learning to train a model that detects sensitive content.”
The other options are not the best match here. Communication Compliance monitors risky communications, DSPM for AI focuses on AI posture and exposure, and Insider Risk Management detects risky user behavior rather than blocking PII sharing or training classifiers.

Explanation:
The correct selections are No, Yes, Yes. Statement 1 is No because Microsoft states that if an organization has a Microsoft 365 Copilot license and at least one user is assigned to a Copilot license, SharePoint administrators automatically get access to the SharePoint Advanced Management features required for Copilot deployment. Microsoft does not say that all users in the organization must have Microsoft 365 Copilot licenses for administrators to use SharePoint Advanced Management.
Statement 2 is Yes because Microsoft documents SharePoint Advanced Management features such as Restricted Content Discovery and Restricted SharePoint Search, which can limit whether content from specific SharePoint sites appears in Microsoft 365 Copilot and organization-wide search experiences.
Statement 3 is Yes because Microsoft explicitly states that organizations can purchase a standalone SharePoint Advanced Management license for each user in the organization. That means it is available even for organizations that do not have Microsoft 365 Copilot.

Explanation:
You can use the eDiscovery Microsoft Purview solution to find all the content that relates to the term “Project Falcon” in the emails exchanged by two users.
The correct answer is eDiscovery. Microsoft documents that Microsoft Purview eDiscovery is used to search for content in Microsoft 365 data sources that is relevant to an investigation, legal matter, or internal review. Microsoft specifically states that eDiscovery search can find email messages, documents, instant messages, and other content across Microsoft 365 locations, including Exchange Online mailboxes. This makes it the correct solution for locating content related to a keyword or phrase such as “Project Falcon” in emails exchanged between specific users.
This is different from other Purview solutions such as Communication Compliance, which is designed to monitor risky or inappropriate communications, or Data Lifecycle Management, which is for retention and deletion. The requirement here is targeted search and retrieval of content connected to a specific term in user email communications, which is exactly what eDiscovery is designed to do.
Microsoft also notes that eDiscovery supports keyword queries and search conditions, which further aligns with this scenario.