Practice Exams:

View All

Microsoft 365 Copilot AB-900 DLP Alerts Communication Compliance And Activity Explorer Practice Test

Skills 2.3 • 30 original questions

This Microsoft AB-900 Microsoft 365 Copilot and Agent Administration Fundamentals practice test focuses on dlp alerts communication compliance and activity explorer through original scenario-based questions aligned to the Skills measured as of July 22, 2026. Use the full ExamSnap AB-900 collection for broader practice across all current skill areas. For broader exam preparation, review the Microsoft AB-900 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; each distractor includes a reason it is not the best choice for that scenario.

Question 1

The Microsoft 365 administrator at Proseware is asked to identify the Purview feature that produces data-loss-prevention alerts. What is the most appropriate next step? The team wants the smallest change that directly addresses the requirement.

Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Run the appropriate Data access governance report from the SharePoint admin center

Correct answer: A

Why: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This directly addresses the stated requirement.

Option review:

A: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This directly addresses the stated requirement.

B: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

C: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

D: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

E: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Learning point: Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action. DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss.

Question 2

Lucerne Publishing has validated the surrounding services. The remaining requirement is to review potentially inappropriate or policy-violating messages in supported communication channels. Which choice is correct? The decision must address the stated requirement rather than a different Microsoft 365 control.

Run the appropriate Data access governance report from the SharePoint admin center
Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted
Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access

Correct answer: C

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

A: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

B: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

C: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

D: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

E: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

Learning point: Use Microsoft Purview Communication Compliance to review policy violations in supported communications. Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation.

Question 3

An administrator reviewing licensing change for City Power & Light must investigate activity patterns such as labeling, sharing, or policy interactions. Which Microsoft 365 control or object should be used? The team will validate the result immediately after the change.

Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears
Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access

Correct answer: A

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

B: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

C: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

D: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

E: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Learning point: Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content. Activity explorer provides visibility into supported activities across data protection and governance workloads.

Question 4

Northwind Traders is documenting its administrative model. Which choice most accurately describes the capability needed to identify the Purview feature that produces data-loss-prevention alerts? No unrelated tenant settings should be changed.

Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use Microsoft Purview Insider Risk Management to identify and investigate potentially risky user activity
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action

Correct answer: E

Option review:

A: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

B: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

C: Insider Risk Management correlates configured indicators and user activity to surface potential insider-risk cases for review. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

D: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

E: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This directly addresses the stated requirement.

Question 5

The IT team at Fourth Coffee wants to review potentially inappropriate or policy-violating messages in supported communication channels. Which Microsoft 365 capability should it use? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access

Correct answer: B

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

A: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

B: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

C: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

D: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

E: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

Question 6

While handling a tenant cleanup, the IT administrator needs to investigate activity patterns such as labeling, sharing, or policy interactions. Which answer most directly addresses the stated need? The choice should follow normal Microsoft 365 administrative practice.

Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users

Correct answer: C

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

B: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

C: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

D: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

E: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 7

During a Copilot adoption project at Contoso, the identity administrator must identify the Purview feature that produces data-loss-prevention alerts. Which Microsoft 365 action or concept most directly satisfies the requirement? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
Use SharePoint data access governance and related sharing or permissions reports to identify overshared sites and content
Run the appropriate Data access governance report from the SharePoint admin center

Correct answer: B

Option review:

A: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

B: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This directly addresses the stated requirement.

C: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

D: Data access governance reports reveal broad permissions and sharing activity so administrators can focus remediation on the highest-risk sites. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Question 8

Litware is documenting its administrative model. Which choice most accurately describes the capability needed to review potentially inappropriate or policy-violating messages in supported communication channels? The team needs a direct administrative answer, not a broad redesign.

Run the appropriate Data access governance report from the SharePoint admin center
Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions

Correct answer: C

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

B: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

C: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

D: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

E: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

Question 9

A support case at Trey Research says administrators must investigate activity patterns such as labeling, sharing, or policy interactions. Which option is the best fit? The administrator wants an action that is easy to audit later.

Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use Microsoft Purview Communication Compliance to review policy violations in supported communications

Correct answer: A

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

B: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

D: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

E: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 10

For a oversharing investigation at Consolidated Messenger, which Microsoft 365 approach correctly addresses the need to identify the Purview feature that produces data-loss-prevention alerts? The solution should preserve least privilege and existing governance where possible.

Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
Run the appropriate Data access governance report from the SharePoint admin center
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears

Correct answer: D

Option review:

A: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

B: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

C: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

D: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This directly addresses the stated requirement.

E: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Question 11

The service desk lead at Woodgrove Bank is asked to review potentially inappropriate or policy-violating messages in supported communication channels. What is the most appropriate next step? The team wants the smallest change that directly addresses the requirement.

Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
Run the appropriate Data access governance report from the SharePoint admin center
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use Microsoft Purview Insider Risk Management to identify and investigate potentially risky user activity
Use Microsoft Purview Communication Compliance to review policy violations in supported communications

Correct answer: E

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

A: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

B: SharePoint Data access governance reports provide snapshot and activity views for permissions, sharing links, sensitivity labels, and broad-sharing patterns. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

C: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

D: Insider Risk Management correlates configured indicators and user activity to surface potential insider-risk cases for review. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

E: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Question 12

Wide World Importers is documenting its administrative model. Which choice most accurately describes the capability needed to investigate activity patterns such as labeling, sharing, or policy interactions? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use SharePoint data access governance and related sharing or permissions reports to identify overshared sites and content
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria

Correct answer: C

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Data access governance reports reveal broad permissions and sharing activity so administrators can focus remediation on the highest-risk sites. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

B: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

C: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

E: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 13

An administrator reviewing security review for Southridge Video must identify the Purview feature that produces data-loss-prevention alerts. Which Microsoft 365 control or object should be used? The team will validate the result immediately after the change.

Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users

Correct answer: A

Option review:

B: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

C: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

D: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

E: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Question 14

A design review at Fabrikam identifies one specific goal: review potentially inappropriate or policy-violating messages in supported communication channels. Which option best matches that goal? No unrelated tenant settings should be changed.

Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Apply a Microsoft Purview sensitivity label appropriate to the information sensitivity and required protection
Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement

Correct answer: A

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

A: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

B: Sensitivity labels classify content and can drive protections and handling controls such as markings, encryption, and container settings where supported. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

C: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

D: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

E: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

Question 15

The IT team at Wingtip Toys wants to investigate activity patterns such as labeling, sharing, or policy interactions. Which Microsoft 365 capability should it use? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use Microsoft Purview Insider Risk Management to identify and investigate potentially risky user activity
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears

Correct answer: B

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Insider Risk Management correlates configured indicators and user activity to surface potential insider-risk cases for review. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

B: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

C: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

E: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 16

VanArsdel is documenting its administrative model. Which choice most accurately describes the capability needed to identify the Purview feature that produces data-loss-prevention alerts? The choice should follow normal Microsoft 365 administrative practice.

Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use Microsoft Purview Communication Compliance to review policy violations in supported communications

Correct answer: D

Option review:

A: Compliance Manager helps organizations assess compliance against standards and provides improvement actions and scoring. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

B: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

C: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

E: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Question 17

During a admin-center audit at Bellows College, the Microsoft 365 administrator must review potentially inappropriate or policy-violating messages in supported communication channels. Which Microsoft 365 action or concept most directly satisfies the requirement? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears
Run the appropriate Data access governance report from the SharePoint admin center
Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
Use SharePoint data access governance and related sharing or permissions reports to identify overshared sites and content
Use Microsoft Purview Communication Compliance to review policy violations in supported communications

Correct answer: E

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

A: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

C: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

D: Data access governance reports reveal broad permissions and sharing activity so administrators can focus remediation on the highest-risk sites. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

E: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Question 18

Tailspin Toys is preparing a licensing change. The team needs to investigate activity patterns such as labeling, sharing, or policy interactions. What should the security administrator choose? The team needs a direct administrative answer, not a broad redesign.

Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks

Correct answer: B

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

B: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

C: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

D: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

E: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 19

A support case at Coho Winery says administrators must identify the Purview feature that produces data-loss-prevention alerts. Which option is the best fit? The administrator wants an action that is easy to audit later.

Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears
Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content

Correct answer: C

Option review:

A: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

B: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

C: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This directly addresses the stated requirement.

D: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

E: Activity explorer provides visibility into supported activities across data protection and governance workloads. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Question 20

Humongous Insurance is documenting its administrative model. Which choice most accurately describes the capability needed to review potentially inappropriate or policy-violating messages in supported communication channels? The solution should preserve least privilege and existing governance where possible.

Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks

Correct answer: C

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

A: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

B: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

C: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

D: Restricted Access Control adds a site-level access restriction that can prevent broader access even when other permissions or links exist. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

E: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

Question 21

The compliance administrator at Adventure Works is asked to investigate activity patterns such as labeling, sharing, or policy interactions. What is the most appropriate next step? The team wants the smallest change that directly addresses the requirement.

Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears
Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents

Correct answer: C

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

B: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

C: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

D: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

E: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 22

Blue Yonder Airlines has validated the surrounding services. The remaining requirement is to identify the Purview feature that produces data-loss-prevention alerts. Which choice is correct? The decision must address the stated requirement rather than a different Microsoft 365 control.

Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action
Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use Microsoft Purview retention policies or retention labels to govern how long content is retained and when it can be deleted

Correct answer: A

Option review:

C: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

E: Retention controls preserve or delete content according to lifecycle and regulatory requirements. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Question 23

An administrator reviewing identity hardening effort for Relecloud must review potentially inappropriate or policy-violating messages in supported communication channels. Which Microsoft 365 control or object should be used? The team will validate the result immediately after the change.

Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions
Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot
Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears

Correct answer: B

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

B: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

D: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

E: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

Question 24

Lamna Healthcare is documenting its administrative model. Which choice most accurately describes the capability needed to investigate activity patterns such as labeling, sharing, or policy interactions? No unrelated tenant settings should be changed.

Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
Use Content search in Microsoft Purview eDiscovery to locate files and emails that match the search criteria
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use SharePoint data access governance and related sharing or permissions reports to identify overshared sites and content
Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot

Correct answer: C

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

B: Content search is designed to search supported Microsoft 365 content for investigation and eDiscovery purposes. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

C: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

D: Data access governance reports reveal broad permissions and sharing activity so administrators can focus remediation on the highest-risk sites. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

E: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 25

The IT team at Proseware wants to identify the Purview feature that produces data-loss-prevention alerts. Which Microsoft 365 capability should it use? The environment uses current Microsoft 365 services and the July 2026 AB-900 scope.

Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears
Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
Use SharePoint Advanced Management Restricted Access Control to limit site access to the approved group or users
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action

Correct answer: E

Option review:

A: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

B: Data Explorer provides visibility into classified and sensitive information so administrators can understand exposure and plan protection. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

C: Microsoft Purview brings together information protection, DLP, risk, compliance, AI data security posture, and lifecycle governance capabilities. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Question 26

While handling a service desk escalation, the security administrator needs to review potentially inappropriate or policy-violating messages in supported communication channels. Which answer most directly addresses the stated need? The choice should follow normal Microsoft 365 administrative practice.

Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks

Correct answer: D

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

A: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

B: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

C: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

D: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

E: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

Question 27

During a production readiness check at City Power & Light, the service desk lead must investigate activity patterns such as labeling, sharing, or policy interactions. Which Microsoft 365 action or concept most directly satisfies the requirement? The administrator must choose the Microsoft 365 feature that matches the stated goal.

Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
Use Microsoft Purview Data Explorer to investigate sensitive information and where it appears
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action

Correct answer: A

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

B: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

C: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

E: DLP detects configured policy matches and can generate alerts with context that administrators use to investigate and respond to potential data loss. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 28

Use the Microsoft Purview capability that corresponds to the data protection, compliance, risk, or lifecycle requirement
Use Microsoft Purview data classification capabilities to identify and understand sensitive information across supported data
Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Use Microsoft Purview Insider Risk Management to identify and investigate potentially risky user activity
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action

Correct answer: E

Option review:

B: Data classification provides visibility into sensitive information types, labels, and related data so protection and governance can be targeted. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

C: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

D: Insider Risk Management correlates configured indicators and user activity to surface potential insider-risk cases for review. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to identify the Purview feature that produces data-loss-prevention alerts.

Question 29

A support case at Fourth Coffee says administrators must review potentially inappropriate or policy-violating messages in supported communication channels. Which option is the best fit? The administrator wants an action that is easy to audit later.

Use Microsoft Graph-grounded Microsoft 365 context so Copilot can retrieve relevant work data that the user is permitted to access
Use the underlying Microsoft 365 permissions together with Microsoft Purview and Microsoft Defender controls to protect data used by Copilot
Apply responsible AI principles and appropriate human review to the design and use of Copilot and agents
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview Compliance Manager to assess compliance posture and review recommended improvement actions

Correct answer: D

Why: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Option review:

A: Microsoft Graph provides signals and relationships across Microsoft 365 that can ground Copilot responses in authorized work context. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

B: Copilot operates within existing Microsoft 365 security and compliance boundaries, so permission hygiene and protection policies remain fundamental. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

C: Responsible AI requires governance and oversight around fairness, reliability and safety, privacy and security, inclusiveness, transparency, and accountability. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to review potentially inappropriate or policy-violating messages in supported communication channels.

D: Communication Compliance detects content that matches configured communication policies and provides a workflow for review and remediation. This directly addresses the stated requirement.

Question 30

For a agent governance review at Alpine Ski House, which Microsoft 365 approach correctly addresses the need to investigate activity patterns such as labeling, sharing, or policy interactions? The solution should preserve least privilege and existing governance where possible.

Use Microsoft Purview Data Security Posture Management for AI to discover AI activity and manage AI-related data security risks
Use Microsoft Purview Activity explorer to review recorded user activities involving sensitive or governed content
Rely on the user existing Microsoft 365 permissions and access controls because Copilot grounds work responses only in content the user is authorized to access
Use Microsoft Purview Communication Compliance to review policy violations in supported communications
Use Microsoft Purview DLP and review the generated alert, policy match, activity, user, and content details before taking the appropriate remediation action

Correct answer: B

Why: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

Option review:

A: DSPM for AI provides visibility and controls focused on AI use, sensitive-data interactions, and related security posture. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

B: Activity explorer provides visibility into supported activities across data protection and governance workloads. This directly addresses the stated requirement.

C: Copilot respects the underlying Microsoft 365 permissions and does not create new access rights to protected content. This can be appropriate in another Microsoft 365 scenario, but it does not directly satisfy the requirement to investigate activity patterns such as labeling, sharing, or policy interactions.

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Question 20

Question 21

Question 22

Question 23

Question 24

Question 25

Question 26

Question 27

Question 28

Question 29

Question 30

Related posts: