AB-900 lesson 12: Cross-domain scenarios
AB-900 questions are usually built the same way: a short situation describes a problem, and the answer is the one tool, setting or role that solves it. The exam lasts 45 minutes and Microsoft does not publish the number of questions, so fast recognition beats long deliberation. A single story can involve a licence, a Conditional Access block and an overshared site, and each part points to a different tool.
Why the domains blur
Most items hold a context (who, with which service), a symptom or goal, and a verb that narrows the answer. Distractors are usually real tools aimed at the wrong job. For pacing and the verb-to-tool shortcuts, see the exam tips; this lesson adds a symptom table and cross-domain practice.
Symptom to where to look
| Symptom or goal | Where to look |
|---|---|
| User blocked from home but not the office | Entra sign-in logs, Conditional Access result |
| Want to know who changed a setting or deleted a file | Audit log |
| Identity security posture score | Identity Secure Score |
| Admin needs elevated rights only for a few hours | Privileged Identity Management |
| Mailbox or distribution group change | Exchange admin center |
| Site, library or folder permissions | SharePoint admin center |
| Team, channel or Teams policy | Teams admin center |
| Licence assignment, domains, org settings | Microsoft 365 admin center |
| File must be encrypted and marked | Sensitivity label |
| Content must be kept or deleted after a period | Retention label or policy |
| Sensitive data being shared out | DLP policy and alerts |
| Risky behaviour by a departing employee | Insider Risk Management |
| Inappropriate messages | Communication Compliance |
| Evidence of regulatory gaps | Compliance Manager |
| Find where sensitive information sits | Data classification, Data Explorer |
| Search mail and files for a case | eDiscovery Content search |
| What are people doing with AI | DSPM for AI |
| Copilot reveals too much | Data access governance report, SharePoint Advanced Management |
| Adoption of licensed Copilot | Copilot usage report, Copilot Analytics |
| Cost for occasional users | Pay-as-you-go billing policy |
| Agent not visible org-wide | Requests in the agent management pages |
Three worked scenarios
Scenario one: the salary summary. A 200-person company rolls out Copilot, and a junior employee receives a summary of a pay review spreadsheet. Copilot only shows content the user may already open, so this is a permissions problem. The admin runs a data access governance report to find sites with broad access, narrows them with restricted access control, and applies a sensitivity label to protect the file itself. DSPM for AI helps check what Copilot interactions touched sensitive data.
Scenario two: the departing manager. A manager has resigned. The company worries about files leaving and wants evidence if something goes wrong. Insider Risk Management scores risky activity, DLP can warn or block sharing of sensitive content, and the audit log shows what the account did. If a legal case follows, an eDiscovery Content search finds the relevant mail and files. The manager’s shared agent becomes ownerless, so the admin assigns a new owner.
Scenario three: the pilot. A 300-person company wants 40 people to use Copilot daily and everyone else to try an agent grounded on one SharePoint site. The admin assigns licences to a group of 40, creates a pay-as-you-go billing policy and connects it to SharePoint agents, then checks the usage report after a month. The site’s access is reviewed first, because agents respect permissions and cannot fix oversharing.
A reading routine for scenario questions
- Read the last sentence first to find the actual ask.
- Name the domain: identity and basics, data protection, or Copilot administration.
- Predict the tool before reading the options.
- Eliminate options that are real tools aimed at a different job.
- In a multi-part story, solve one part at a time and match each to its own tool.
- If no answer emerges quickly, mark the item and return with the time left.
Key points
- Questions describe a problem and ask for the tool; the verb narrows the choice.
- Domain two is the largest at 35 to 40 percent, but all three domains appear in single scenarios.
- Copilot respects permissions, so oversharing is fixed at the source.
- Reports measure adoption; Purview tools protect and investigate.
- Solve multi-part stories one part at a time.
Check yourself
Question 1. A company wants to be warned automatically when employees try to email documents containing customer card numbers to outside addresses. Which tool fits?
- A. Insider Risk Management
- B. eDiscovery Content search
- C. Identity Secure Score
- D. A DLP policy
Show answer
Answer: D
A DLP policy detects sensitive information in outgoing content and can warn, block and raise alerts. Insider Risk Management scores behavioural risk rather than matching content, Content search finds content after the fact, and Identity Secure Score measures identity posture.
Want more questions like this? Full AB-900 practice tests →
Question 2. A new Copilot user in a 60-person firm can chat but cannot find the shared leave-policy agent that a colleague built for the whole company yesterday. The colleague confirms it works for them. What is the first thing to check?
- A. Whether a retention label was applied to the agent
- B. The Requests list in the agent management pages
- C. Whether the user’s sign-ins are being recorded
- D. Whether the agent’s knowledge file is encrypted
Show answer
Answer: B
Agents shared with the whole organisation wait for admin approval, so the pending request is the first thing to check. A retention label does not hide an agent, a sensitivity label affects documents, and a Conditional Access policy would block sign-in instead of one agent.
Want more questions like this? Full AB-900 practice tests →
Question 3. Auditors ask a company to show how its configuration compares with a regulatory standard and what to improve. Which Purview tool provides assessments and recommended actions?
- A. Communication Compliance
- B. Activity explorer
- C. Compliance Manager
- D. DSPM for AI
Show answer
Answer: C
Compliance Manager assesses controls against regulations and recommends improvement actions. Communication Compliance reviews messages for policy violations, activity explorer shows user activities on labelled content, and DSPM for AI focuses on AI activity.
Want more questions like this? Full AB-900 practice tests →
This lesson closes the course and draws on all three exam domains: core features (30 to 35 percent), data protection (35 to 40 percent) and Copilot and agents (25 to 30 percent). Pair it with the cheat sheet and the exam tips.