14 free Microsoft AB-900 practice questions from the CertStash pack of 89, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 14 free here, all 89 in the pack, and each step includes the one before it.
Get all 89 questions (US$39) · Download the first 10 as a PDF
Question 1
Your organization has a Microsoft 365 subscription. Which two tasks can you perform by using the Exchange admin center? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C. Create a mail flow rule; Create a shared mailbox.
The Exchange admin center is used to manage mail flow and create shared mailboxes. Mail flow rules (option B) control email routing and policies and are a core Exchange admin center function. Shared mailboxes (option C) can be created through the Exchange admin center to enable multiple users to access a single mailbox. License assignment (option A) is performed in the Microsoft 365 admin center, not Exchange admin center. Custom domain configuration (option D) is also managed in the Microsoft 365 admin center, not the Exchange admin center.
Why the other options are wrong
- A. License assignment is handled in the Microsoft 365 admin center, not the Exchange admin center.
- D. Custom domain configuration is managed in the Microsoft 365 admin center, not the Exchange admin center.
Question 2
You are reviewing your company’s security policies as part of a Zero Trust strategy. Which statement accurately describes the Zero Trust principles?
Show answer and explanation
Correct answer: B. Zero Trust assumes breach and verifies each request.
Zero Trust is a security strategy that assumes breach and verifies every request, regardless of source. This foundational principle requires continuous verification of all access attempts, users, devices, and data. Option A contradicts Zero Trust by suggesting authentication is minimized. Option C is the opposite of Zero Trust philosophy, which does not trust corporate network traffic by default. Option D is false because Zero Trust requires regular review and adjustment of access permissions as part of continuous verification.
Why the other options are wrong
- A. Zero Trust requires continuous authentication and verification, not minimized prompts.
- C. Zero Trust explicitly does not grant automatic trust to requests from corporate networks.
- D. Regular review and adjustment of access permissions is essential to Zero Trust implementation.
Question 3
Your organization has a Microsoft 365 subscription. You need to generate a report that shows the permissions and active sharing links of content stored in Microsoft OneDrive accounts. What should you use?
Show answer and explanation
Correct answer: C. Data access governance in the SharePoint admin center
Data access governance in the SharePoint admin center provides reports on permissions and active sharing links for content stored in OneDrive accounts. This feature specifically addresses sharing and permission analysis across OneDrive. Audit in the Defender portal (option A) tracks security events but not sharing link reports. Reports in the Microsoft 365 admin center (option B) provide general organizational reporting but not the specific OneDrive sharing link and permission details required. eDiscovery in Purview (option D) is designed for legal holds and content searches, not routine sharing permission reporting.
Why the other options are wrong
- A. Audit in the Microsoft Defender portal tracks security events, not sharing links and permissions reports.
- B. The Microsoft 365 admin center reports do not provide detailed OneDrive sharing link and permission analysis.
- D. eDiscovery is used for legal discovery and content holds, not for routine sharing and permissions reporting.
Question 4
Your organization has a Microsoft 365 subscription. You need to investigate security incidents and alerts raised from the Windows 11 devices in your organization. What should you use?
Show answer and explanation
Correct answer: D. Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is the solution designed to investigate security incidents and alerts from Windows devices, including Windows 11. It provides threat detection, incident investigation, and response capabilities at the endpoint level. Entra ID Protection (option A) focuses on identity and sign-in risks, not endpoint-level incidents. Defender for Identity (option B) monitors active directory and on-premises identity threats, not Windows client devices. Purview Insider Risk Management (option C) addresses insider threats and data exfiltration patterns, not general Windows device security incidents.
Why the other options are wrong
- A. Entra ID Protection focuses on identity and authentication threats, not Windows device incidents.
- B. Defender for Identity monitors on-premises active directory threats, not Windows client endpoints.
- C. Insider Risk Management addresses employee data exfiltration and behavioral risk, not general device security incidents.
Question 5
Your organization has a Microsoft 365 subscription. All users have Microsoft 365 Copilot licenses. You need to identify where sensitive content is being used during Copilot interactions, analyze the content usage patterns, and provide recommendations on applying the appropriate protections. What should you use?
Show answer and explanation
Correct answer: B. the Microsoft Purview DSPM for AI solution
The Microsoft Purview DSPM (Data Security Posture Management) for AI solution is specifically designed to identify where sensitive content is being used during Copilot interactions, analyze usage patterns, and recommend appropriate protections for AI environments. This solution directly addresses the security posture of sensitive data within generative AI applications. Viva Insights (option A) focuses on productivity and collaboration metrics. Security Copilot (option C) is an AI-powered security tool for threat analysis, not for monitoring sensitive content in Copilot interactions. Insider Risk Management (option D) addresses internal threats and data exfiltration by employees, not content protection within AI systems.
Why the other options are wrong
- A. Viva Insights provides productivity and collaboration analytics, not sensitive content protection in AI.
- C. Security Copilot is an AI tool for security threat analysis, not for monitoring sensitive content in Copilot.
- D. Insider Risk Management focuses on employee misconduct and data exfiltration detection, not AI content protection.
Question 6
Your organization has a Microsoft 365 subscription that contains a user named User1. User1 plans to leave your company in two weeks. You need to capture the activity of User1 to identify whether the user is exfiltrating data. Which Microsoft Purview solution should you use?
Show answer and explanation
Correct answer: C. Insider Risk Management
Insider Risk Management is designed to detect and investigate risky user behavior, including data exfiltration attempts by departing employees. It monitors activities and user behavior patterns to identify potential data theft and misconduct. Communication Compliance (option A) focuses on communication policy violations and inappropriate messaging, not data exfiltration detection. Data Security Posture Management (option B) assesses overall data security configuration and compliance, not individual user activity monitoring. Data Lifecycle Management (option D) handles retention and deletion policies for data governance, not threat detection.
Why the other options are wrong
- A. Communication Compliance monitors for policy violations in communications, not data exfiltration activities.
- B. Data Security Posture Management evaluates security configurations, not individual user activity and data exfiltration.
- D. Data Lifecycle Management handles data retention and disposal, not insider threat and exfiltration detection.
Question 7
Your organization has a Microsoft 365 E5 subscription. You need to ensure that a third-party cloud service can authenticate to Microsoft Entra. What should you configure?
Show answer and explanation
Correct answer: D. an app registration
An app registration in Microsoft Entra is the mechanism used to enable third-party cloud services to authenticate against Entra ID. This creates an application identity and associated credentials (certificates or secrets) that the service uses for authentication. App registrations define permissions, redirect URIs, and other authentication parameters necessary for service-to-service authentication.
Why the other options are wrong
- A. Copilot connectors are for integrating Copilot with external data sources, not for general third-party cloud service authentication.
- B. MFA is an authentication factor enforcement mechanism, not the configuration needed to enable third-party service authentication.
- C. Conditional Access policies control access conditions for authenticated users or apps but don't establish the initial authentication mechanism itself.
Question 8
Your organization has a Microsoft 365 subscription. You need to evaluate your organization’s Identity Secure Score. Which two factors affect the score? Each correct answer presents a complete the solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C. the number of global administrators; passwords that are never expired
The Identity Secure Score measures security posture based on identity configuration. The number of global administrators affects the score because excessive global admin accounts increase security risk. Password expiration policies affect the score because never-expiring passwords represent a security weakness. SharePoint site permissions and user location are not factors in the Identity Secure Score calculation.
Why the other options are wrong
- A. SharePoint site permissions are managed separately and do not contribute to the Identity Secure Score.
- D. User location alone is not a factor in the Identity Secure Score; Conditional Access policies based on location are separate controls.
Question 9
Your organization has a Microsoft 365 subscription. You need to review the impact of a recent phishing incident that targeted email users. What should you use?
Show answer and explanation
Correct answer: A. the Microsoft Defender portal
The Microsoft Defender portal (security.microsoft.com) is the unified security center that provides email security analytics, threat investigation, and incident response capabilities. It consolidates data from Microsoft Defender for Office 365 and shows the impact of phishing attacks on email users, including affected messages, user statistics, and remediation actions.
Why the other options are wrong
- B. The Microsoft 365 admin center is for subscription and user management, not for detailed email security threat investigation.
- C. The Microsoft Entra admin center focuses on identity and access management, not email security incidents.
- D. The Exchange admin center manages mailbox and mail flow configurations but lacks comprehensive phishing incident analytics.
Question 10
Your organization has a Microsoft 365 subscription. You create a security group named Group1 and assign a Microsoft 365 E3 license to the group. You discover that a user named User1 does NOT have access to the Microsoft 365 E3 features. You need to ensure that User1 can access all the Microsoft 365 E3 features. Which two actions can you perform? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D. Add User1 to Group1; Assign a license to User1.
User1 can gain access to Microsoft 365 E3 features through two separate solutions: by adding User1 to Group1 (which already has the license assigned to it, allowing license inheritance through group-based licensing), or by directly assigning a license to User1. Both approaches independently solve the problem. Conditional Access policies control access conditions but do not grant licenses.
Why the other options are wrong
- B. Conditional Access policies restrict or allow access based on conditions but do not assign licenses or grant feature access.
- C. Conditional Access policies do not assign licenses; they only enforce access conditions for already-licensed users.
What people say about the full AB-900 pack 5.0 from 4
The product is amazing, and the service is exceptional. I'll be back for more exam prep soon!
The AB-900 practice questions helped me understand Microsoft business concepts better. The materials were easy to review.
The AB-900 practice tests were a good introduction to Microsoft business concepts. The exam questions helped me review important areas quickly.
Question 11
What can you use to block a user account automatically when a risky sigh-in is detected?
Show answer and explanation
Correct answer: B. Microsoft Entra ID Protection
Microsoft Entra ID Protection detects risky sign-ins based on risk factors and can automatically block user accounts or require remediation through policies like requiring password change or MFA. It specifically uses machine learning and heuristics to identify anomalous sign-in patterns and automatically enforce protective actions.
Why the other options are wrong
- A. Microsoft Defender for Identity focuses on on-premises Active Directory threats and lateral movement, not cloud sign-in risk.
- C. Microsoft Defender for Office 365 protects email and collaboration services but does not manage sign-in risk blocking.
- D. Microsoft Entra PIM manages privileged role access but is not designed for automatic blocking of risky sign-ins.
Question 12
Your organization has a Microsoft 365 subscription that contains a Microsoft SharePoint site named Site1. You need to prevent users from sharing the content of Site1 to external users. What should you use?
Show answer and explanation
Correct answer: B. the SharePoint admin center
The SharePoint admin center is where external sharing policies are configured at the site and organization level. This is the dedicated tool for managing whether specific SharePoint sites can share content with external users, including setting restrictions to prevent external sharing altogether.
Why the other options are wrong
- A. Site1 content itself cannot be configured to prevent sharing; sharing policies must be set at the administrative level.
- C. The Microsoft 365 admin center provides high-level tenant settings but the SharePoint admin center is the specific tool for site-level sharing policies.
- D. The Microsoft Entra admin center manages identity and access, not SharePoint sharing policies.
Question 13
Your organization has a Microsoft 365 subscription. You discover that some users cannot sign in to Microsoft 365. You need to view the failed Microsoft 365 sign-in attempts. What should you use?
Show answer and explanation
Correct answer: B. the Microsoft Entra admin center
The Microsoft Entra admin center provides access to sign-in logs and audit logs where administrators can review successful and failed sign-in attempts. This is the primary tool for troubleshooting authentication issues and monitoring user access patterns to Microsoft 365 services.
Why the other options are wrong
- A. The Microsoft Defender portal focuses on threat protection and security incidents, not general sign-in logs.
- C. The Microsoft Purview portal handles compliance and data governance, not user authentication logs.
- D. The Microsoft 365 admin center manages subscriptions and users but does not provide detailed sign-in log analytics.
Question 14
Which statement accurately describes authorization in Microsoft 365?
Show answer and explanation
Correct answer: C. a process to verify whether an identity is allowed to access a resource
Authorization is the process of determining whether an authenticated identity has permission to access a specific resource or perform a particular action. It answers the question "What are you allowed to do?" after identity has been established. This is distinct from authentication (verifying who you are) and other access control mechanisms.
Why the other options are wrong
- A. This describes authentication, not authorization; it verifies identity rather than access permissions.
- B. This describes multifactor authentication enforcement, which is an authentication control, not authorization.
- D. This describes identity federation or external validation, not the core concept of authorization.
That was 14 of 89.
The full Microsoft AB-900 pack has all 89 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 15 free as one PDF by email. Get the Half Pack →