Practice Exams:

View All

Microsoft 365 Copilot AB-900 Zero Trust Authorization And Authentication Methods Practice Test

Skills 1.2 • 30 original questions

This Microsoft AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals practice test focuses on zero trust authorization and authentication methods through original scenario-based questions aligned to the Skills measured as of July 22, 2026. Use the full ExamSnap AB-900 collection for broader practice across all current skill areas. For broader exam preparation, review the Microsoft AB-900 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

The service desk lead at Relecloud is asked to limit the blast radius of a compromised account. What is the most appropriate next step? The team wants the smallest change that directly addresses the requirement.

Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Evaluate authorization after authentication to determine what the identity is allowed to access or do

Correct answer: A

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

A: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

B: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

C: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

D: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

E: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

Learning point: Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach. Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs.

Question 2

Lamna Healthcare has validated the surrounding services. The remaining requirement is to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource. Which choice is correct? The decision must address the stated requirement rather than a different Microsoft 365 control.

Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use Microsoft Entra ID for cloud identity, authentication, and access management
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: D

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

A: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

B: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

C: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

D: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

E: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

Learning point: Evaluate authorization after authentication to determine what the identity is allowed to access or do. Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity.

Question 3

An administrator reviewing identity hardening effort for Proseware must strengthen sign-in by requiring an additional factor. Which Microsoft 365 control or object should be used? The team will validate the result immediately after the change.

Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity

Correct answer: E

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

B: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

C: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

D: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

E: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Learning point: Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity. Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization.

Question 4

Which Microsoft 365 concept is the strongest match for the following need at Lucerne Publishing: limit the blast radius of a compromised account? No unrelated tenant settings should be changed.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use Microsoft Entra ID for cloud identity, authentication, and access management
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement

Correct answer: D

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

A: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

C: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

D: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

E: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

Question 5

The IT team at City Power & Light wants to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource. Which Microsoft 365 capability should it use? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity

Correct answer: D

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

B: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

C: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

D: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

E: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

Question 6

While handling a service desk escalation, the SharePoint administrator needs to strengthen sign-in by requiring an additional factor. Which answer most directly addresses the stated need? The choice should follow normal Microsoft 365 administrative practice.

Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use the Exchange admin center to configure the required mailbox or distribution group

Correct answer: D

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

C: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

D: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

E: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

Question 7

During a production readiness check at Fourth Coffee, the Microsoft 365 administrator must limit the blast radius of a compromised account. Which Microsoft 365 action or concept most directly satisfies the requirement? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use Microsoft Entra ID for cloud identity, authentication, and access management
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO

Correct answer: D

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

A: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

B: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

C: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

D: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

E: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

Question 8

Which Microsoft 365 concept is the strongest match for the following need at Alpine Ski House: explain why successful sign-in does not automatically grant access to every Microsoft 365 resource? The team needs a direct administrative answer, not a broad redesign.

Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use the Exchange admin center to configure the required mailbox or distribution group
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities

Correct answer: B

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

A: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

B: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

C: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

D: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

E: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

Question 9

A support case at Contoso says administrators must strengthen sign-in by requiring an additional factor. Which option is the best fit? The administrator wants an action that is easy to audit later.

Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity

Correct answer: B

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

B: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

C: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

E: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

Question 10

For a agent governance review at Litware, which Microsoft 365 approach correctly addresses the need to limit the blast radius of a compromised account? The solution should preserve least privilege and existing governance where possible.

Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use Microsoft Entra ID for cloud identity, authentication, and access management
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature

Correct answer: A

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

A: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

B: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

C: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

D: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

E: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

Question 11

The compliance administrator at Trey Research is asked to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource. What is the most appropriate next step? The team wants the smallest change that directly addresses the requirement.

Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity

Correct answer: C

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

A: An app registration creates or represents the application object; an enterprise application is the tenant service principal used for local access and sign-in configuration. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

B: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

C: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

D: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

E: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

Question 12

Which Microsoft 365 concept is the strongest match for the following need at Consolidated Messenger: strengthen sign-in by requiring an additional factor? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use the Teams admin center and configure the relevant team, channel, or Teams policy
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Evaluate authorization after authentication to determine what the identity is allowed to access or do

Correct answer: D

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

B: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

C: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

D: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Question 13

An administrator reviewing licensing change for Woodgrove Bank must limit the blast radius of a compromised account. Which Microsoft 365 control or object should be used? The team will validate the result immediately after the change.

Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Use the Exchange admin center to configure the required mailbox or distribution group
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity

Correct answer: B

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

A: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

B: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

D: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

Question 14

A design review at Wide World Importers identifies one specific goal: explain why successful sign-in does not automatically grant access to every Microsoft 365 resource. Which option best matches that goal? No unrelated tenant settings should be changed.

Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO

Correct answer: C

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

B: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

C: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

D: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

Question 15

The IT team at Southridge Video wants to strengthen sign-in by requiring an additional factor. Which Microsoft 365 capability should it use? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use the Teams admin center and configure the relevant team, channel, or Teams policy
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity

Correct answer: E

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

B: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

C: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

D: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

E: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Question 16

Which Microsoft 365 concept is the strongest match for the following need at Fabrikam: limit the blast radius of a compromised account? The choice should follow normal Microsoft 365 administrative practice.

Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use Microsoft Entra ID for cloud identity, authentication, and access management
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities

Correct answer: D

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

D: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Question 17

During a Copilot adoption project at Wingtip Toys, the service desk lead must explain why successful sign-in does not automatically grant access to every Microsoft 365 resource. Which Microsoft 365 action or concept most directly satisfies the requirement? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use the Exchange admin center to configure the required mailbox or distribution group
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials

Correct answer: B

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

A: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

B: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

C: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

D: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

E: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

Question 18

VanArsdel is preparing a identity hardening effort. The team needs to strengthen sign-in by requiring an additional factor. What should the Copilot administrator choose? The team needs a direct administrative answer, not a broad redesign.

Evaluate authorization after authentication to determine what the identity is allowed to access or do
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement

Correct answer: D

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

B: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

C: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

D: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Question 19

A support case at Bellows College says administrators must limit the blast radius of a compromised account. Which option is the best fit? The administrator wants an action that is easy to audit later.

Use Microsoft Entra ID for cloud identity, authentication, and access management
Use the Exchange admin center to configure the required mailbox or distribution group
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement

Correct answer: D

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

A: Microsoft Entra ID is the identity and access service that underpins Microsoft 365 users, groups, authentication, and access controls. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

B: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

D: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Question 20

Which Microsoft 365 concept is the strongest match for the following need at Tailspin Toys: explain why successful sign-in does not automatically grant access to every Microsoft 365 resource? The solution should preserve least privilege and existing governance where possible.

Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use the Teams admin center and configure the relevant team, channel, or Teams policy

Correct answer: D

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

A: SharePoint content is organized into sites, libraries, folders, and items; choosing the correct scope avoids applying a control too broadly or too narrowly. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

B: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

C: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

D: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

E: Teams administration covers collaboration objects and policies that govern Teams behavior and access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

Question 21

The identity administrator at Coho Winery is asked to strengthen sign-in by requiring an additional factor. What is the most appropriate next step? The team wants the smallest change that directly addresses the requirement.

Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use the Exchange admin center to configure the required mailbox or distribution group
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation

Correct answer: B

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

B: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

C: Mailboxes and distribution groups are Exchange Online recipient objects and are administered through Exchange management experiences. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

D: Threat protection and intelligence provide detections, context, and indicators that help security teams investigate and respond to attacks. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

E: PIM reduces standing privilege by governing when privileged roles are activated and can enforce approval, MFA, justification, and time limits. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

Question 22

Humongous Insurance has validated the surrounding services. The remaining requirement is to limit the blast radius of a compromised account. Which choice is correct? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use Microsoft Entra ID for cloud identity, authentication, and access management
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach

Correct answer: E

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

A: Identity Secure Score summarizes identity security posture and provides recommended actions; it is not a guarantee that the tenant is secure. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

C: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

E: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Question 23

An administrator reviewing security review for Adventure Works must explain why successful sign-in does not automatically grant access to every Microsoft 365 resource. Which Microsoft 365 control or object should be used? The team will validate the result immediately after the change.

Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities
Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Evaluate authorization after authentication to determine what the identity is allowed to access or do

Correct answer: E

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

C: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

D: Audit logs record supported administrative and user actions and are the correct starting point for who-did-what-and-when investigations. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

E: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Question 24

Which Microsoft 365 concept is the strongest match for the following need at Blue Yonder Airlines: strengthen sign-in by requiring an additional factor? No unrelated tenant settings should be changed.

Use the Microsoft 365 admin center to review the tenant domain names and organization settings
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use a user object for an individual identity and a group when access or policy should be assigned to a collection of identities

Correct answer: B

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: The Microsoft 365 admin center provides tenant-level configuration, including domains and organization settings. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

B: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

E: Users represent individual identities; groups provide a scalable target for access, licensing, and policy assignments where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

Question 25

The IT team at Relecloud wants to limit the blast radius of a compromised account. Which Microsoft 365 capability should it use? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use Microsoft Entra ID for cloud identity, authentication, and access management
Use SharePoint administration and the appropriate site, library, or folder object for the requirement
Use the Exchange admin center to configure the required mailbox or distribution group
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation

Correct answer: D

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

D: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Question 26

While handling a data protection review, the Copilot administrator needs to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource. Which answer most directly addresses the stated need? The choice should follow normal Microsoft 365 administrative practice.

Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use the Exchange admin center to configure the required mailbox or distribution group
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Evaluate authorization after authentication to determine what the identity is allowed to access or do
Use Identity Secure Score to review identity-security recommendations and track posture improvements

Correct answer: D

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

A: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

C: Microsoft Entra sign-in data exposes the authentication result, Conditional Access evaluation, and risk information needed for targeted troubleshooting. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

D: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Question 27

During a admin-center audit at Proseware, the compliance administrator must strengthen sign-in by requiring an additional factor. Which Microsoft 365 action or concept most directly satisfies the requirement? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use Microsoft security threat-protection and threat-intelligence capabilities to detect, investigate, and understand malicious activity
Use Microsoft Defender XDR to correlate alerts and investigate incidents across supported Microsoft security workloads

Correct answer: C

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

C: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

E: Defender XDR provides cross-domain detection, incident correlation, investigation, and response across Microsoft security signals. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

Question 28

Which Microsoft 365 concept is the strongest match for the following need at Lucerne Publishing: limit the blast radius of a compromised account? The team needs a direct administrative answer, not a broad redesign.

Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature
Apply Zero Trust by verifying explicitly, using least-privilege access, and assuming breach
Use Identity Secure Score to review identity-security recommendations and track posture improvements
Use single sign-on so an authenticated user can access multiple integrated applications without repeatedly entering credentials
Use Microsoft Entra Privileged Identity Management to provide eligible, time-bound, and governed privileged-role activation

Correct answer: B

Why: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

Option review:

A: Feature access depends on the services included in the assigned license. Group-based licensing can simplify assignment for changing groups of users. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

B: Zero Trust treats every access request as something to verify and limits privileges and impact if compromise occurs. This directly addresses the stated requirement.

D: SSO improves usability and can centralize authentication while maintaining application authorization decisions. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to limit the blast radius of a compromised account.

Question 29

A support case at City Power & Light says administrators must explain why successful sign-in does not automatically grant access to every Microsoft 365 resource. Which option is the best fit? The administrator wants an action that is easy to audit later.

Evaluate authorization after authentication to determine what the identity is allowed to access or do
Review Microsoft Entra sign-in information and the relevant Conditional Access, MFA, or risk details for the affected attempt
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Review the appropriate Microsoft 365 or Microsoft Entra audit log for the recorded user or administrator activity
Use an app registration for the application identity definition and the enterprise application service principal for tenant-specific access, assignments, consent, and SSO

Correct answer: A

Why: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

Option review:

A: Authentication establishes identity; authorization evaluates permissions, roles, policies, and resource access for that identity. This directly addresses the stated requirement.

C: Conditional Access evaluates signals and applies controls such as MFA, compliant device requirements, or blocking access. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to explain why successful sign-in does not automatically grant access to every Microsoft 365 resource.

Question 30

For a pilot rollout at Northwind Traders, which Microsoft 365 approach correctly addresses the need to strengthen sign-in by requiring an additional factor? The solution should preserve least privilege and existing governance where possible.

Assign the least-privileged SharePoint site role or permission level that satisfies the user requirement
Use an appropriate Microsoft Entra authentication method, such as passwordless or multifactor authentication, to verify the user identity
Use a Microsoft Entra Conditional Access policy that evaluates the relevant conditions and applies the required access control
Use the Exchange admin center to configure the required mailbox or distribution group
Assign the appropriate Microsoft 365 license to the user or eligible group that needs the feature

Correct answer: B

Why: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Option review:

A: SharePoint site roles and permissions should be scoped to the content and actions the user actually needs. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to strengthen sign-in by requiring an additional factor.

B: Authentication methods are mechanisms used to prove identity during sign-in; they are distinct from authorization. This directly addresses the stated requirement.

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Related posts: