Free Microsoft AB-900 Exam Dumps August 2026

The correct answer is D. a sensitivity label policy. In Microsoft Purview, creating a sensitivity label by itself does not make it available to users. Microsoft Learn states that after you create sensitivity labels, you must publish them by creating a label policy so that users and groups can see and apply those labels in Microsoft 365 apps and services. Publishing controls which labels are available and to whom they are shown. This is why a sensitivity label policy is required to ensure that users can apply Label1 to files.

The other options do not meet the requirement. Auto-labeling policies apply labels automatically when content matches conditions, but they are not the primary mechanism for simply making a label available for user selection. A trainable classifier is used to identify content categories, not to publish a label. A retention label policy publishes retention labels for records and lifecycle purposes, which is different from sensitivity labeling for classification and protection. Therefore, the correct Microsoft-documented method to let users apply Label1 to files is to publish it using a sensitivity label policy.

The correct answer is C. a custom Microsoft 365 Copilot agent. Microsoft Learn explains that Agent Builder in Microsoft 365 Copilot lets you create agents with specific instructions, dedicated knowledge sources, and starter prompts. Starter prompts are designed to help users understand the most common supported scenarios, which directly matches the requirement to provide users with a list of common queries. Microsoft also documents that an agent can be grounded in selected SharePoint sites, folders, or files, allowing the response scope to be targeted to the HR policy content in Site1 rather than broad enterprise or web data.

The other options do not fit the requirement. Copilot in Word is document-focused and is not intended to create a reusable, shared query experience grounded only in one SharePoint source. Copilot notebooks group materials and chats, but they are not the right tool for publishing a guided HR policy assistant with starter prompts. Researcher is designed for broader, multi-step research using work data and web content, so it does not satisfy the requirement to keep answers grounded only in Site1.

The correct answers are A and D because both tasks are supported directly in the Exchange admin center (EAC). Microsoft Learn states that administrators can manage mail flow rules in Exchange Online from the EAC under Mail flow > Rules, which includes creating and managing transport rules for organizational email handling. Microsoft Learn also states that administrators can create shared mailboxes in the EAC under Recipients > Mailboxes, where a shared mailbox can be added and then delegated to users.

Option B is incorrect because adding a custom domain is normally done in the Microsoft 365 admin center, specifically on the Domains page. Although Exchange can later work with accepted domains and related mail flow settings, the act of adding and verifying a custom domain is not an Exchange admin center task. Option C is incorrect because license assignment is handled through Microsoft 365 or Microsoft Entra administrative tools, not the Exchange admin center.

The correct answer is D. Data Lifecycle Management. Microsoft Learn states that Microsoft Purview retention policies and retention labels, managed under Data Lifecycle Management, support three core outcomes: retain-only, delete-only, and retain and then delete. The requirement in this question is exact: keep email for seven years and then permanently delete it. That is a textbook retain and then delete retention configuration, which Microsoft documents as part of Purview's retention capabilities. Microsoft also recommends using Microsoft 365 retention policies and labels for retaining and deleting emails rather than relying on older Exchange-only approaches in most modern compliance scenarios.

The other options do not meet the requirement. Information Protection focuses on labeling and protecting sensitive information. Insider Risk Management is used to detect and investigate risky user behavior. Data Loss Prevention helps prevent inappropriate sharing or exfiltration of sensitive data. None of those are designed to enforce a timed seven-year retention period followed by automatic permanent deletion. The Microsoft Purview solution explicitly built for that lifecycle requirement is Data Lifecycle Management.

The correct answer is B. using a custom agent that is grounded in work data. Microsoft Learn states that agents that access shared tenant data, such as SharePoint or Graph Connector content, are billed based on metered consumption. Microsoft also describes pay-as-you-go for Microsoft 365 as applying to agents in Microsoft 365 Copilot Chat, where organizations pay only for the messages used instead of assigning a full Microsoft 365 Copilot license. That is exactly the scenario described in option B: a custom agent grounded in work data.

The other options are not the intended pay-as-you-go scenario. A Teams meeting recap and Copilot in Word are standard Microsoft 365 Copilot application experiences tied to licensed Copilot functionality, not metered agent consumption. Researcher is an advanced Microsoft 365 Copilot agent available as part of Microsoft 365 Copilot capabilities, not the documented example of pay-as-you-go replacing a Copilot license. Microsoft's pay-as-you-go guidance centers on agent-based usage, especially agents grounded in organizational work data.

The correct answer is B. Data explorer. Microsoft Learn states that Data explorer in Microsoft Purview shows a current snapshot of items that have been classified as a sensitive information type in your organization. Microsoft's sensitive information type documentation specifically lists examples such as social security numbers and credit card numbers, which means Data explorer is the appropriate portal feature for identifying files and emails that contain those data types. Data explorer is designed to help administrators see where sensitive data exists across supported Microsoft 365 locations.

The other options are less appropriate for this task. Information Protection reports focus more broadly on label and protection reporting. Information Protection policies are for configuring classification and protection behavior, not for finding existing files and emails containing SSNs or credit card numbers. Activity explorer is primarily used to review user and policy-related activities, such as label changes or DLP events, rather than to provide the direct sensitive-data inventory view requested here. Since the question asks to identify the files and emails containing specific sensitive information types, Microsoft's documented answer is Data explorer.