A fire department IT lead must explain the purpose of SharePoint data access governance reports to leadership. Which explanation is accurate?

A fire-department IT lead should tell leadership that DAG reports help identify sharing and access patterns so oversharing risks can be monitored and remediated. That is the purpose of SharePoint data access governance reporting: visibility into how widely content is shared, enabling prioritized cleanup rather than guesswork.

DAG reports do not identify retention schedules and disposal trends to monitor lifecycle risks; retention and disposal is a separate lifecycle management workload governed by retention policies, not sharing and access reporting. They do not identify guest account lifecycles and reviews to monitor identity risks—that is an identity governance and access review task, not a sharing and access reporting task. They do not identify eDiscovery holds and case exports to monitor litigation risks; eDiscovery is a separate compliance and preservation workload. Each distractor fails by assigning DAG an unrelated or dangerous role.

Exam caveat: Distinguish DAG reporting from other reporting workloads — lifecycle retention reporting, identity guest reviews, and eDiscovery preservation reporting. AB-900 expects DAG to be explained as identifying sharing/access patterns for monitoring and remediation—not as a retention schedule and disposal trend monitor, a guest lifecycle and review monitor, or an eDiscovery hold and export monitor.

Operational check: Present leadership a DAG summary for fire-department sites showing counts of broad sharing, pick the top risky sites, assign remediation owners with due dates, keep DLP policies intact during cleanup, and report a follow-up DAG trend showing reduced oversharing before Copilot or agent pilots expand.