A fire department IT lead is organizing confidential case notes in SharePoint and must choose an appropriate content structure. What is an accurate characterization of libraries and folders?

For a fire department organizing confidential case notes in SharePoint, an accurate characterization is that document libraries hold related files on a site, and folders can further organize items inside a library. Libraries are the primary SharePoint containers for documents; folders (and metadata) provide additional structure within a library. That model fits confidential case notes that must live on a governed site with clear containment boundaries. ‘Document libraries hold related items inside a folder, and sites can further organize folders across a library’ fails by concept: libraries are containers on a site that hold files, not items inside a folder, and sites contain libraries which contain folders — sites do not organize folders across a library. ‘Document libraries hold related files across sites, and folders can further organize items inside a library’ fails because a library holds related files on a site, not across sites, even though folders do further organize items inside a library. ‘Folders hold related files on a site, and libraries can further organize items inside a folder view’ fails because folders do not serve as the site-level container for files, and libraries do not organize items inside a folder view — folders organize items inside a library. Exam caveat: AB-900 fundamentals expect site → library → folder (plus metadata) mental models. Distractors that invert that containment, put libraries inside folders, stretch a library across sites, or swap library and folder roles are common. Operational check: on the fire department site, create a document library for case notes, apply permissions appropriate to confidentiality, create folders (or preferably metadata views) for case categories, upload a test note, and verify only authorized Members/Owners can edit while Visitors—if any—remain read-only. Confirm audit and sharing settings align with confidential case-handling policy.