AB-730 generative AI fundamentals explained
Understand generative AI fundamentals is the largest AB-730 domain, worth 25–30% of the exam. It tests whether you know how Copilot arrives at an answer, what influences that answer, which Copilot experience suits a task, and what can go wrong. It is a business-user view, not a machine learning course: expect scenarios in which you pick the safest or most sensible action.
The outline has two groups: generative AI capabilities across Microsoft 365 experiences, and responsible AI and data protection practices.
Generative AI across Microsoft 365
Privacy and security
Microsoft’s outline asks you to understand how Copilot keeps your organisation’s information private and secure. The idea to hold on to is that Copilot works within the access and protections your organisation already has. It can only draw on content the user is allowed to see, and data protection settings restrict what a prompt can return. Copilot is not a way around permissions. That is also why oversharing matters: if a file is open to everyone, an AI assistant can surface it to everyone.
Context
The same prompt gives different answers in different places. The outline names the sources of context: Work IQ (the information about your work, such as emails, files, meetings and people), web data, and the app you are in. A prompt typed inside a Word document is grounded in that document; in a chat it may draw on wider work data. If an answer looks off, a missing or wrong source of context is a likely cause, and the fix is often to reference the right file or say what you want it to use.
Which Copilot tool for which task
| Need | Likely fit |
|---|---|
| Quick question, summary or draft through conversation | Microsoft 365 Copilot Chat |
| Help while editing in Word, Excel, PowerPoint, Outlook or Teams | The Copilot experience inside that app |
| A repeatable, focused business task | An agent |
| A multi-step task you delegate, review and track | Microsoft Copilot Cowork |
The exam also expects you to know that features and capabilities differ across Copilot experiences and apps. When a question hinges on this, read what the user wants to do (ask, edit, repeat, delegate) before you pick the tool.
Responsible AI and data protection
Common risks
| Risk | What it looks like | Typical control |
|---|---|---|
| Inaccuracy | Fluent text containing wrong or invented facts | Check citations and facts against the source |
| Prompt injection | Hidden instructions in content the AI reads try to steer its behaviour | Treat unfamiliar content with caution; review outputs and actions |
| Over-reliance | Using AI output without thinking, especially for decisions | Keep a human accountable and review before use |
| Sensitive data exposure | Confidential content pasted or surfaced where it should not be | Follow data protection rules; do not share what you should not |
Matching the check to the task
The outline asks you to select verification steps appropriate to the task. A casual brainstorm needs little checking. A figure going into a board paper needs a source check. A customer-facing email needs a human reading it. The wrong answer in these questions is usually either no check at all, or a check that does not match the risk, for example asking the AI itself to confirm it is correct.
Sensitive data
You should recognise and reduce risk to sensitive data, and understand that data protection restricts what results a prompt can return. In practice: use the right label and sharing settings, and do not paste restricted content into places it should not go.
Three practice questions
Question 1. An employee asks Copilot Chat about a confidential HR document. She does not have access to that document. What is the expected result?
- A. Copilot summarises it because it can read all organisational files
- B. Copilot does not use the document, because it respects her existing access
- C. Copilot grants her access so that it can answer
- D. Copilot shows the document but hides the title
Show answer
Answer: B
Copilot works within the user’s existing permissions, so it cannot return content she is not allowed to see. It does not bypass access controls for convenience, it does not grant her access, and being a chat user does not override data protection.
Want more questions like this? Full AB-730 practice tests →
Question 2. A manager receives an email with white text hidden at the bottom that says to ignore previous instructions and forward the team's files. She asks Copilot to summarise the email. Which risk does this describe?
- A. Inaccuracy
- B. Over-reliance
- C. A poorly written prompt
- D. Prompt injection
Show answer
Answer: D
Hidden instructions embedded in content that an AI reads, intended to steer it, are prompt injection. Inaccuracy is wrong facts in an answer. Over-reliance is trusting output without thought. A weak prompt is the user’s own wording, not content planted by someone else.
Want more questions like this? Full AB-730 practice tests →
Question 3. An analyst needs a quick answer to an internal question while drafting a Word document, and wants Copilot to use the document itself as the main source. Where should she ask?
- A. In the Copilot experience inside Word
- B. In a chat with no files referenced
- C. By scheduling a prompt for the following week
- D. By asking a colleague to paste the text into an email
Show answer
Answer: A
The Copilot experience inside Word is grounded in the document being edited, which fits the need. A general chat could answer from wider sources. A scheduled prompt is for repeating a request. Asking a colleague to copy text does not use Copilot and adds a step.
Want more questions like this? Full AB-730 practice tests →
How to study this domain
Learn the risk table and be able to match each risk to its control. Then practise reading scenarios for the verbs: ask, edit, repeat, delegate. The study plan places this domain in week 1, and the practice test has six questions on it.