Prepare for the AB-900 Microsoft Copilot and Agent Administration Fundamentals Exam

Free AB-900 Practice Questions (With Answers)

5 real questions from the AB-900 bank, with the full explanation for each answer. No sign-up needed to read them.

1. Question 1Copilot and Agent Administration [troubleshooting Copilot]

   An admin receives reports that Copilot is surfacing documents in responses that users claim they should not have access to. How should the admin investigate?

   • A.Immediately disable Copilot across the whole tenant until Microsoft issues a security patch for the indexing bug
   • B.Instruct all of the affected users to clear their browser cache in order to reset Copilot's local memory store
   • C.Review the Microsoft Secure Score dashboard for any alerts regarding unauthorized Copilot queries in the tenant
   • D.Use Microsoft Purview AI Hub to review interaction logs and investigate underlying SharePoint permissions
   Show answer and explanation

   Correct answer: D

   Correct. The admin should use AI Hub to see exactly which documents Copilot retrieved. Because Copilot respects permissions, this usually reveals an oversharing issue (e.g., broad M365 Group memberships) where the user technically had read access they shouldn't have had.

   Why the other options are wrong

   A. Incorrect. This assumes a platform bug. Overwhelmingly, these issues stem from existing tenant permission flaws, not Copilot security flaws.

   B. Incorrect. Copilot retrieves live data from the cloud based on current permissions; local cache has no impact on data exposure.

   C. Incorrect. Secure Score evaluates configuration posture, it does not log individual data access events.

2. Question 2Data Protection and Governance for M365 and Copilot [Purview Tool Selection]

   After deploying Copilot, a team needs the history of who accessed, downloaded, and shared a specific labeled file. Which tool should they use?

   Show answer and explanation

   Correct answer:

3. Question 3Microsoft 365 Core Services and Security [cloud services model]

   A startup signs up for Microsoft 365 Business Premium. Their admin wants to understand who manages server hardware, OS updates, and physical security. Which responsibilities remain with Microsoft under SaaS?

   • A.The organization manages hardware and OS; Microsoft manages only the applications
   • B.Microsoft manages infrastructure, OS, and patching; the organization manages identity and data
   • C.Both Microsoft and the organization share equal responsibility for all layers including hardware
   • D.The organization manages everything locally while Microsoft only provides the software licenses
   Show answer and explanation

   Correct answer: B

   Correct. SaaS means Microsoft owns the full stack below the data layer. The admin never patches a server or maintains application code.

   Why the other options are wrong

   A. Incorrect. In SaaS, Microsoft manages infrastructure, OS, and application updates — not the organization.

   C. Incorrect. Responsibility is clearly divided in SaaS, not shared equally. Hardware and OS are entirely Microsoft's responsibility.

   D. Incorrect. This describes an on-premises model. In SaaS, Microsoft manages the infrastructure.

4. Question 4Microsoft 365 Core Services and Security [cloud services model]

   A company wants to use Microsoft Teams and Exchange Online without managing any servers, operating systems, or application updates. Which cloud service model does this describe?

   • A.Infrastructure as a Service (IaaS)
   • B.Platform as a Service (PaaS)
   • C.Software as a Service (SaaS)
   • D.Function as a Service (FaaS)
   Show answer and explanation

   Correct answer: C

   Correct. SaaS delivers fully managed applications over the internet. Microsoft handles all infrastructure, patches, and updates. You consume Teams and Exchange as a service — no servers to manage.

   Why the other options are wrong

   A. Incorrect. IaaS gives you virtual infrastructure but you still manage OS, runtime, and application. You would be responsible for servers and updates.

   B. Incorrect. PaaS provides a managed platform for building applications. You'd still manage your application code and data. Teams and Exchange are not built on PaaS for end-users.

   D. Incorrect. FaaS (serverless functions like Azure Functions) is for running event-driven code. Teams and Exchange are complete managed applications, not function execution environments.

5. Question 5Microsoft 365 Core Services and Security [identity as security perimeter]

   A company's IT policy uses VPN as the primary security control for remote access. A consultant says this is insufficient for modern threats. Which principle explains why network location alone cannot establish trust?

   • A.Zero Trust — network location is not a reliable trust signal; identity and device health must be verified
   • B.Defense in depth — multiple overlapping network controls compensate for VPN limitations
   • C.Least privilege — VPN grants excessive network-wide permissions to connected users
   • D.Micro-segmentation — the network must be divided into specific zones for the VPN to be effective
   Show answer and explanation

   Correct answer: A

   Correct. 'Verify explicitly' means corporate network or VPN origin doesn't make a connection trustworthy. Identity, device health, and risk signals must all be evaluated.

   Why the other options are wrong

   B. Incorrect. Defense in depth is valid but doesn't explain why network location is insufficient trust evidence. Zero Trust specifically addresses this.

   C. Incorrect. Least privilege addresses the scope of access — not whether network location is a valid trust signal.

   D. Incorrect. Segmentation improves containment but doesn't address why network location alone is insufficient trust evidence.