Microsoft Updated AB-900 Exam Questions and Answers by abiha

The correct answer is B. Data explorer. Microsoft Learn states that Data explorer in Microsoft Purview shows a current snapshot of items that have been classified as a sensitive information type in your organization. Microsoft’s sensitive information type documentation specifically lists examples such as social security numbers and credit card numbers, which means Data explorer is the appropriate portal feature for identifying files and emails that contain those data types. Data explorer is designed to help administrators see where sensitive data exists across supported Microsoft 365 locations.

The other options are less appropriate for this task. Information Protection reports focus more broadly on label and protection reporting. Information Protection policies are for configuring classification and protection behavior, not for finding existing files and emails containing SSNs or credit card numbers. Activity explorer is primarily used to review user and policy-related activities, such as label changes or DLP events, rather than to provide the direct sensitive-data inventory view requested here. Since the question asks to identify the files and emails containing specific sensitive information types, Microsoft’s documented answer is Data explorer.

The correct answer is D. Data Lifecycle Management . Microsoft Learn states that Microsoft Purview retention policies and retention labels, managed under Data Lifecycle Management , support three core outcomes: retain-only , delete-only , and retain and then delete . The requirement in this question is exact: keep email for seven years and then permanently delete it. That is a textbook retain and then delete retention configuration, which Microsoft documents as part of Purview’s retention capabilities. Microsoft also recommends using Microsoft 365 retention policies and labels for retaining and deleting emails rather than relying on older Exchange-only approaches in most modern compliance scenarios.

The other options do not meet the requirement. Information Protection focuses on labeling and protecting sensitive information. Insider Risk Management is used to detect and investigate risky user behavior. Data Loss Prevention helps prevent inappropriate sharing or exfiltration of sensitive data. None of those are designed to enforce a timed seven-year retention period followed by automatic permanent deletion. The Microsoft Purview solution explicitly built for that lifecycle requirement is Data Lifecycle Management .

The correct answer is C. Site lifecycle management . In the SharePoint admin center, Microsoft includes a Site ownership policy under Site lifecycle management that can identify sites with too few owners and drive remediation. Microsoft documents that this policy can detect sites with fewer than the required number of owners, notify site owners, and if the issue is not fixed, enforce an action such as making the site read-only . That directly matches the requirement that sites with fewer than two owners be marked as read-only when they are not remediated.

The other options do not fit this scenario. Site-level access restriction is about controlling who can access a site, not enforcing ownership-count governance. Data access governance reports help identify oversharing and permissions exposure, but they do not enforce a minimum-owner remediation policy that makes sites read-only. Block download policy for SharePoint and OneDrive is used to restrict downloading from unmanaged devices or similar access scenarios, not to handle insufficient site ownership. Therefore, the Microsoft-documented feature to configure is Site lifecycle management .

The correct selections are The Microsoft 365 admin center and A billing policy . Microsoft documents that Microsoft 365 Copilot pay-as-you-go is administered in the Microsoft 365 admin center , specifically under Copilot > Billing & usage , where admins create and manage billing policies . Microsoft explains that a billing policy defines the billing infrastructure for pay-as-you-go, including the Azure subscription and the set of users covered by that policy. That user scoping is what allows organizations to separate usage and spending by groups such as departments.

Microsoft also documents that billing policies support budgets , spending views , and monitoring current expenses for services linked to the policy. This supports the requirement for greater visibility into Copilot usage costs and forecasting departmental spending. By assigning different departments to different billing policies, the organization can track Copilot costs by department. The other listed features do not fit: auto-claim policy is unrelated to cost tracking, and Copilot connector is for external data grounding, not billing segmentation.