Understand data protection and governance tasks for Microsoft 365 and Copilot

AB-900 · 77 questions

• A 311 resident-services desk needs to classify and protect council executive packets with Microsoft Purview capabilities. Which family fits?
• A transit authority wants the Microsoft Purview family associated with labeling and protecting sensitive documents. Which choice fits?
• A water utility wants public-health attachments protected with classification and protection before they enter email workflows. Which Purview focus fits?
• An emergency-management office wants to reduce accidental Social Security number leakage from benefits case email. Which Purview capability fits?
• A housing authority sees inspectors emailing unredacted resident IDs and wants a Purview control that can warn or block that sharing. Which capability fits?
• A public library system explains Purview capabilities that can block or warn when staff try to exfiltrate sensitive patron data. Which capability fits?
• Parks and recreation leaders want signals when staff mass-download resident files shortly before leaving city employment. Which Purview capability fits?
• Municipal courts IT suspects a departing clerk may be stealing case files and wants the Purview capability aimed at insider data-theft risk. Which choice fits?
• A fire department IT lead reviews Teams chats among crews for harassment and other policy risks. Which Microsoft Purview capability fits that communication-risk review?
• A police records bureau needs to identify policy violations when staff share inappropriate content in Microsoft 365 channels. Which Purview feature should the bureau identify?
• A city open-data portal team wants visibility into where AI experiences interact with municipal sensitive data. Which Purview capability should the team use?
• A school district IT office is auditing how Copilot and agents may expose district data. Which Microsoft Purview family should it identify for AI data-security posture?
• A county IT shared-services team needs retention and deletion lifecycle concepts applied to old permit archives in Microsoft 365. Which Purview capability fits?
• A port authority must keep certain operational records for the period the legal schedule requires. Which Purview capability should administrators identify?
• An airport operations IT team needs executive closed-session minutes marked as highly confidential in Microsoft 365. Which Purview use case fits?
• Wastewater treatment plant operations wants labeled process documents so external sharing of sensitive content is constrained. What sensitivity-label outcome should they seek?
• City council support staff must treat resident PII differently from public park maps in Microsoft 365. Which Purview concept should guide that distinction?
• A public works department wants Purview help finding unmarked sensitive fields in municipal datasets. Which concept should the department apply?
• An elections office must keep election records for the legally required retention period in Microsoft 365. Which Purview concept applies?
• An animal control administrator needs deleted case items to remain discoverable when policy still requires retention. Which retention outcome matches that need?
• A building inspections unit learns how Microsoft 365 Copilot decides which inspection files to surface. What access rule should staff understand?
• A social services casework office asks why overshared SharePoint case files become visible to many staff through Copilot. What explanation fits?
• Municipal HR/payroll tests whether a clerk without access to a restricted benefits library still sees those files in Copilot. What result should they expect?
• A city attorney's office wants a clear map of what Copilot can reach for each attorney. What should that map be based on?
• Planning and zoning managers worry that Copilot might be a backdoor past folder ACLs on sealed variance files. What should IT emphasize?
• Stormwater management staff want a fundamentals-level picture of what influences Copilot grounding across Microsoft 365. Which fabric should they identify?
• A municipal call center explains why mail and files shape Copilot answers for agents. Which influence should the explanation highlight?
• A county assessor's office connects Graph permissions reality to what a transit planner sees in Copilot. What connection is correct?
• Public hospital district IT must explain Graph's influence on Copilot without writing Graph API code. What fundamentals statement fits?
• A city clerk relates Copilot meeting and email summaries to underlying Microsoft 365 connectivity. Which influence should the clerk identify?
• A county public-health department wants layered controls that reduce Copilot risk around sensitive case content. Which control combination fits AB-900 fundamentals?
• A municipal permitting office explains layered protections against Copilot misuse of sensitive permit packets. What should the explanation emphasize?
• A 311 resident-services desk tightens library permissions on sealed complaint files and wants to know the Copilot effect. What should administrators expect?
• A transit authority maps which control families govern Copilot data risk in Microsoft 365. What should that map emphasize?
• A water utility applies responsible AI expectations to a permitting chatbot. Which principle set should leaders emphasize?
• An emergency-management office documents accountability for Copilot outputs used in public notices. What practice matches responsible AI?
• A housing authority rejects opaque AI advice for benefit eligibility without human review. Which responsible AI stance is that?
• A public library system maps responsible AI principles to municipal AI governance policy. What should that mapping support?
• A parks and recreation department uses Compliance Manager to see improvement actions for a privacy framework. What does Compliance Manager help identify?
• Municipal courts identify compliance risks and recommendations before a Copilot go-live. Which Purview experience supports that review?
• A fire department IT lead presents Compliance Manager scores to the risk committee. What do those scores help communicate?
• A police records bureau distinguishes Compliance Manager from Identity Secure Score. What difference should staff understand?
• A city open-data portal team uses Data Explorer to locate unmarked SSNs across municipal repositories. What capability are they using?
• School district IT identifies sensitive information sprawl before enabling Copilot broadly. Which Purview capability supports that discovery?
• County IT shared services explains Data Explorer as a discovery lens for sensitive content. What should that explanation emphasize?
• A port authority prioritizes libraries found via Data Explorer for labeling first. Why is that a sound governance step?
• Airport operations IT triages an Insider Risk alert about unusual downloads of resident files. What is Insider Risk Management designed to help identify?
• Wastewater treatment plant ops distinguishes insider risk signals from malware detections. What should they understand about Insider Risk Management?
• City council support staff escalates insider risk findings involving a departing systems admin. Which Purview capability surfaces that class of risk?
• A public works department explains what Insider Risk Management is designed to surface. Which description is accurate?
• An elections office responds when a clerk emails a spreadsheet of taxpayer IDs and a Purview alert appears. What should staff recognize?
• An animal control admin identifies and acknowledges Purview DLP alerts in the compliance workflow. What skill does that exercise?
• A building inspections unit studies why Copilot prompt content might relate to DLP concepts. What fundamentals idea should they keep?
• A social services casework office distinguishes DLP alerts from Communication Compliance conduct alerts. What distinction is correct?
• Municipal HR/payroll reviews a Communication Compliance policy violation in a crew Teams chat. What are they identifying?
• A city attorney's office identifies harassment or threat language flagged for supervisor review. Which Purview capability produces that class of finding?
• Planning and zoning explains Communication Compliance violations versus DLP sensitive-data hits. Which contrast is accurate?
• Stormwater management uses activity explorer to see labeling and DLP match activities by user. What does activity explorer help identify?
• A municipal call center needs to identify which staff recently performed labeling or protection activities on highly sensitive classified files. Which Purview experience surfaces those user activities?
• A county assessor's office explains activity explorer to auditors as a Purview reporting surface. What should that explanation emphasize?
• A public hospital district IT team discovers AI experiences interacting with confidential case libraries and wants to manage that posture. Which Purview capability is designed for discovering and managing AI activity?
• A city clerk wants to review AI application posture findings before expanding custom agents into more departments. What should the clerk use DSPM for AI to do?
• A county public-health department needs to identify which AI experiences interact with municipal sensitive sites. Which capability supports discovering that AI activity?
• A municipal permitting office must locate emails and files related to a public-records request topic across Microsoft 365. Which Purview eDiscovery capability should they use?
• A 311 resident-services desk needs one Purview search that can find relevant files across Exchange mailboxes and SharePoint libraries. Which capability fits?
• A transit authority expects that legal holds may follow an investigation and needs to search relevant Microsoft 365 content first. What should administrators understand about Content search?
• A water utility needs tools that reveal broadly shared links on a planning SharePoint site so oversharing can be fixed. What should administrators look for?
• An emergency-management office finds that everyone in the tenant can open a confidential folder and must troubleshoot the cause. Which approach aligns with AB-900 oversharing guidance?
• A housing authority hears surprising Copilot answers about sealed case files and wants to investigate oversharing before blaming Copilot itself. What should staff do first?
• A public library system teaches staff that oversharing often precedes surprising Copilot answers. What should that teaching emphasize?
• A parks and recreation department wants a SharePoint report on data access governance for the permits site collection. What should they run?
• Municipal courts want to find sites with too many Everyone links before a Copilot expansion. Which SharePoint reporting approach fits?
• A fire department IT lead must explain the purpose of SharePoint data access governance reports to leadership. Which explanation is accurate?
• A police records bureau prioritizes remediation from data access governance output before enabling Copilot widely. Why is that a sound sequence?
• A city open-data portal team considers SharePoint Advanced Management restricted access control for sensitive HR sites. What capability are they evaluating?
• School district IT needs SharePoint Advanced Management capabilities that help limit oversharing on sensitive libraries. Which description is accurate?
• County IT shared services explains restricted access control as a SharePoint Advanced Management-related governance feature. What should staff understand?