EarnYourCert
Open the app
Exams › AB-900 › Domain 1 of 3
AB-900 · Domain 1 of 3 · 30-35% of the exam

M365 concepts and security

Domain 1 of AB-900 accounts for 30-35% of the exam. EarnYourCert has 192 original questions for this domain, all with explanations: 124 multiple choice, 39 yes/no and 29 completion or ordering items, like the real exam.

Practice domain 1 for free →No sign-up. Choose how many questions you want.

What this domain covers

  • Core Microsoft 365 services and their admin centers
  • Identity with Microsoft Entra ID: MFA, Conditional Access and Zero Trust
  • Admin roles and the principle of least privilege
  • Threat protection with Microsoft Defender

Domain 1 sample questions

8 questions from our 192-question bank for this domain. Try to answer before revealing the solution.

1. You need a group of employees to receive mail sent to a single address, without a common mailbox to manage. Which object do you use?

  1. A calendar room mailbox
  2. A directory security group
  3. A team shared mailbox
  4. A mail distribution list
Show answer

Correct answer: D. The distribution list forwards mail from one address to all its members, with no common mailbox. The shared mailbox does have a mailbox, the room mailbox manages bookings, and the security group grants access.

2. Which default SharePoint group receives the Full Control permission level over a site?

  1. The site Members group
  2. The external Readers group
  3. The site Visitors group
  4. The site Owners group
Show answer

Correct answer: D. The Owners group receives Full Control over the site. Visitors get Read, Members get Edit, and there is no default External Readers group with Full Control.

3. Which lets you grant a user only the minimum permissions needed for their task?

  1. Shared full access gives broad rights to everyone
  2. A single admin account concentrates all the power
  3. Least privilege grants only the permissions needed
  4. Open anonymous permission lets anyone come in
Show answer

Correct answer: C. Correct: Least privilege grants only the permissions needed.

4. What does the Identity Secure Score provide as a value?

  1. The number of Copilot agents that have been deployed and approved in the org
  2. The estimated monthly cost of all licenses assigned to the tenant's users
  3. A measure of the identity security posture with recommendations to improve it
  4. The total number of mailboxes currently provisioned in the tenant
Show answer

Correct answer: C. Identity Secure Score is a percentage measure of identity security posture along with recommended improvement actions. It does not measure mailboxes, license costs, or agents.

5. You need to periodically review and certify that users still need their access to certain groups or applications. Which Entra feature should you use?

  1. Access reviews
  2. Sign-in logs from the Microsoft Entra portal
  3. App registrations in the Microsoft Entra portal
  4. Identity Secure Score with excessive permission recommendations for the tenant
Show answer

Correct answer: A. Access reviews periodically recertify users' access to groups and applications. Sign-in logs, Secure Score, and App registrations do not recertify access.

6. You need to retain a record of admin and user activities (config changes, access) for investigations. Which feature should you consult?

  1. The audit logs of Microsoft Entra and Microsoft Purview
  2. The Identity Secure Score, which measures the identity security posture
  3. Conditional Access policies, which enforce access controls
  4. App registrations, where applications are registered in the tenant
Show answer

Correct answer: A. Audit logs record admin and user activities for investigations. Secure Score measures posture; App registrations registers apps; Conditional Access applies controls, not full activity history.

7. You need to keep a history of admin and user activities to investigate them later. What do you check?

  1. The current tenant's Identity Secure Score
  2. The current tenant's app registrations
  3. The Entra Conditional Access policies
  4. The Entra and Purview audit logs
Show answer

Correct answer: D. Audit logs keep the history of admin and user activities for investigation. The Secure Score measures posture, app registrations register apps, and Conditional Access applies controls.

8. Where does an admin assign Microsoft 365 Copilot licenses to users?

  1. In the web browser's settings page directly
  2. In the Microsoft 365 admin center for the tenant
  3. In the device's local File Explorer window
  4. In the network router's control panel page
Show answer

Correct answer: B. Correct: In the Microsoft 365 admin center for the tenant.

Practice domain 1 for free →

Other AB-900 domains

2Data security and compliance35-40% 3Copilot and agent administration25-30% AB-900: full practice exam→