Free Microsoft AB-900 practice questions

10 free Microsoft AB-900 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 89 questions. Work through them, then open each answer to check your reasoning.

Get all 89 questions (US$39) · Download these 10 as a PDF

Question 1

Your organization has a Microsoft 365 E5 subscription.

You need to ensure that a third-party cloud service can authenticate to Microsoft Entra.

What should you configure?

  1. a Microsoft 365 Copilot connector
  2. multifactor authentication (MFA)
  3. a Conditional Access policy
  4. an app registration
Show answer and explanation

Correct answer: D. an app registration

An app registration in Microsoft Entra is required to enable a third-party cloud service to authenticate to Microsoft Entra. This registration creates the necessary service principal and credentials that allow the external application to establish trust and obtain access tokens for authentication.

Why the other options are wrong

  • A. Microsoft 365 Copilot connectors are for integrating Copilot functionality, not for thir-arty authentication.
  • B. MFA is an authentication mechanism for users, not for application-to-Entra authentication.
  • C. Conditional Access policies enforce access rules but do not enable initial authentication registration.

Question 2

Your organization has a Microsoft 365 subscription.

You need to evaluate your organization’s Identity Secure Score.

Which two factors affect the score? Each correct answer presents a complete the solution.

NOTE: Each correct selection is worth one point.

  1. the SharePoint site permissions
  2. the number of global administrators
  3. passwords that are never expired
  4. the location of the users
Show answer and explanation

Correct answer: B, C

B. the number of global administrators C. passwords that are never expired Identity Secure Score measures identity configuration and administrative practices in Microsoft Entra ID and returns improvement actions with point values. The number of global administrators is scored because keeping privileged role assignments to a small number reduces attack surface. Password expiration policy is also scored: Microsoft recommends setting passwords to never expire and using strong authentication instead of forced rotation, so that configuration is reflected in the score.

Why the other options are wrong

  • A. SharePoint site permissions are governed by SharePoint and Microsoft Purview controls and are not part of the Identity Secure Score calculation.
  • D. The physical or geographic location of users is not measured by Identity Secure Score, although sign-in risk and location can be used in Conditional Access policies.

Question 3

Your organization has a Microsoft 365 subscription.

You need to review the impact of a recent phishing incident that targeted email users.

What should you use?

  1. the Microsoft Defender portal
  2. the Microsoft 365 admin center
  3. the Microsoft Entra admin center
  4. the Microsoft Exchange admin center
Show answer and explanation

Correct answer: A. the Microsoft Defender portal

The Microsoft Defender portal provides comprehensive threat investigation and incident response capabilities, including the ability to review phishing attacks, email threats, and their impact on users. This portal centralizes security incident analysis and provides detailed threat intelligence.

Why the other options are wrong

  • B. The Microsoft 365 admin center manages licensing and general administration, not threat analysis.
  • C. The Microsoft Entra admin center focuses on identity and access management, not email threat investigation.
  • D. The Microsoft Exchange admin center manages mail flow and Exchange settings but lacks the advanced threat analysis features needed for phishing incident review.

Question 4

Your organization has a Microsoft 365 subscription.

You create a security group named Group1 and assign a Microsoft 365 E3 license to the group.

You discover that a user named User1 does NOT have access to the Microsoft 365 E3 features.

You need to ensure that User1 can access all the Microsoft 365 E3 features.

Which two actions can you perform? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

  1. Add User1 to Group1.
  2. Assign a Conditional Access policy to Group1.
  3. Assign a Conditional Access policy to User1.
  4. Assign a license to User1.
Show answer and explanation

Correct answer: A, D

A. Add User1 to Group1. D. Assign a license to User1. User1 can gain access to Microsoft 365 E3 features by either being added to Group1 (which has the license assigned) or by having a license assigned directly to the user account. Both approaches provide the necessary license entitlement. Conditional Access policies control access conditions but do not grant licenses or enable features.

Why the other options are wrong

  • B. Conditional Access policies on groups control access conditions, not license entitlements.
  • C. Conditional Access policies on users control access conditions, not license availability.

Question 5

Your organization has a Microsoft 365 subscription.

You discover that some users cannot sign in to Microsoft 365.

You need to view the failed Microsoft 365 sign-in attempts.

What should you use?

  1. the Microsoft Defender portal
  2. the Microsoft Entra admin center
  3. the Microsoft Purview portal
  4. the Microsoft 365 admin center
Show answer and explanation

Correct answer: B. the Microsoft Entra admin center

The Microsoft Entra admin center provides access to sign-in logs and activity reports where administrators can view failed authentication attempts, including details about which users failed to sign in and the reasons for those failures.

Why the other options are wrong

  • A. The Microsoft Defender portal focuses on security threats and malware, not sign-in logs.
  • C. The Microsoft Purview portal handles compliance and data governance, not authentication logs.
  • D. The Microsoft 365 admin center provides general administration but does not offer detailed sign-in failure logs like Entra does.

Question 6

Your organization has a Microsoft 365 subscription that contains a Microsoft SharePoint site named Site1.

You need to prevent users from sharing the content of Site1 to external users.

What should you use?

  1. the Site1 content
  2. the SharePoint admin center
  3. the Microsoft 365 admin center
  4. the Microsoft Entra admin center
Show answer and explanation

Correct answer: B. the SharePoint admin center

The SharePoint admin center provides granular controls over external sharing settings for individual SharePoint sites. Administrators can restrict or disable external sharing at the site level through this portal, preventing Site1 content from being shared with external users.

Why the other options are wrong

  • A. Site1 content itself does not contain the sharing restriction settings.
  • C. The Microsoft 365 admin center handles organization-wide settings but not sit-pecific sharing controls.
  • D. The Microsoft Entra admin center manages identity and access, not SharePoin-pecific sharing policies.

Question 7

What can you use to block a user account automatically when a risky sigh-in is detected?

  1. Microsoft Defender for Identity
  2. Microsoft Entra ID Protection
  3. Microsoft Defender for Office 365
  4. Microsoft Entra Privileged Identity Management (PIM)
Show answer and explanation

Correct answer: B. Microsoft Entra ID Protection

Microsoft Entra ID Protection automatically detects risky sign-in events and can be configured to block user accounts when risk is detected. It uses machine learning and risk algorithms to identify anomalous sign-in patterns and enforce automated responses including account blocking.

Why the other options are wrong

  • A. Microsoft Defender for Identity focuses on on-premises and hybrid environment threats, not cloud sign-in blocking.
  • C. Microsoft Defender for Office 365 protects against email and collaboration threats, not risky sign-in events.
  • D. Microsoft Entra PIM manages privileged role activation, not automatic blocking of risky sign-ins.

Question 8

Which statement accurately describes authorization in Microsoft 365?

  1. a process to verify whether an identity is who or what they claim to be
  2. a process to require additional authentication methods before an identity can access resources
  3. a process to verify whether an identity is allowed to access a resource
  4. a process to validate an identity from an external system
Show answer and explanation

Correct answer: C. a process to verify whether an identity is allowed to access a resource

Authorization is the process of determining what authenticated identities are permitted to access. It answers the question of whether a verified user has permission to use or access a specific resource, independent of who they are or how they authenticated.

Why the other options are wrong

  • A. This describes authentication, which verifies identity, not authorization.
  • B. This describes multifactor authentication, an additional verification step, not authorization.
  • D. This describes external validation or federation, not the core authorization process.

Question 9

Your organization has a Microsoft 365 subscription.

Which two tasks can you perform by using the Exchange admin center? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

  1. Assign a Microsoft Exchange license.
  2. Create a mail flow rule.
  3. Create a shared mailbox.
  4. Add a custom domain.
Show answer and explanation

Correct answer: B, C

B. Create a mail flow rule. C. Create a shared mailbox. The Exchange admin center is used to manage mail-related configurations and mailboxes in Microsoft 365. You can create mail flow rules (also called transport rules) to automate message handling based on conditions, and you can create shared mailboxes to allow multiple users to manage a single mailbox. Assigning Microsoft Exchange licenses is performed in the Microsoft 365 admin center, not the Exchange admin center. Adding custom domains is a tenant-wide configuration also managed in the Microsoft 365 admin center, not Exchange.

Why the other options are wrong

  • A. License assignment is handled in the Microsoft 365 admin center, not Exchange admin center.
  • D. Custom domain configuration is a tenant-level task performed in the Microsoft 365 admin center.

Question 10

You are reviewing your company’s security policies as part of a Zero Trust strategy.

Which statement accurately describes the Zero Trust principles?

  1. Zero Trust enhances the user experience by minimizing authentication prompts.
  2. Zero Trust assumes breach and verifies each request.
  3. Zero Trust treats all requests from your corporate network as trustworthy.
  4. Zero Trust removes the need to regularly review and adjust access permissions.
Show answer and explanation

Correct answer: B. Zero Trust assumes breach and verifies each request.

Zero Trust is a security framework that operates on the principle of 'assume breach' and requires continuous verification of all users and devices, regardless of their location or network. Every request must be authenticated and authorized before access is granted. Option A is incorrect because Zero Trust typically requires more frequent authentication, not less. Option C directly contradicts Zero Trust by suggesting implicit trust based on network location. Option D is false because Zero Trust requires ongoing review and adjustment of access permissions based on continuous monitoring.

Why the other options are wrong

  • A. Zero Trust increases authentication requirements rather than minimizing them for security.
  • C. Zero Trust explicitly rejects trust based on network location; all requests require verification.
  • D. Zero Trust mandates regular review and adjustment of access permissions as a core principle.

That was 10 of 89.

The full Microsoft AB-900 pack has all 89 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack