Pass Your Microsoft AB-900 Exam Easy!

Case segregation controls evidence scope and reviewer authority. This helps with distinct legal matter boundaries instead of the required litigation preservation before review.

eDiscovery identifies responsive records using case search conditions. The action is relevant to targeted email discovery rather than litigation preservation before review.

AI interactions can be subject to discovery using supported item types. The action is relevant to litigation search across AI conversations rather than litigation preservation before review.

Audit events can expose rule modifications and the acting principal. It is used for historical mailbox-rule mutation evidence; this scenario calls for time evidence of Copilot activity.

Monitoring converts historical event data into actionable detection. That addresses timely reaction to concerning activity, whereas the current case requires time evidence of Copilot activity.

Audit event records attribute supported administrative operations. It is used for actor for an access-permission change; this scenario calls for time evidence of Copilot activity.

Alert casework supports remediation beyond a simple block. Its purpose is governed data incident follow-up; the specified need is approved records destruction.

Assessment tasks track required control maturity and remediation. It would support recurring regulatory assessment, not the stated approved records destruction.

Site owners can confirm needed access without security staff guessing business relationships. Its purpose is owner-driven oversharing remediation; the specified need is approved records destruction.

AI-aware DLP can inspect and control supported content exchanges. The action is relevant to sensitive prompt leakage prevention rather than AI adoption-associated data risk context.

Auditing provides user and time attribution for supported AI interactions. The action is relevant to traceable sensitive Copilot activity rather than AI adoption-associated data risk context.

AI grounding respects effective source permissions; oversharing is a source governance fault. This helps with prevention of unauthorized AI source discovery instead of the required AI adoption-associated data risk context.

Hold requirements prevent loss of evidence despite ordinary deletion schedules. That addresses hold-compliant preservation, whereas the current case requires conduct violation assessment.

DLP activity captures the rule and destination context for a violation. It is used for file-sharing policy incident evidence; this scenario calls for conduct violation assessment.

Insider risk contextualizes configured user behavior for triage. It is used for suspicious worker file-exfiltration investigation; this scenario calls for conduct violation assessment.

EDM identifies values known to belong to the protected dataset. Its purpose is precise matching of known customer IDs; the specified need is discovery of unstructured trade secret content.

Document fingerprints match against a reference form structure. It would support recognition of standard legal forms, not the stated discovery of unstructured trade secret content.

Content classification reports where structured sensitive data is found. Its purpose is discovery of structured financial identifiers; the specified need is discovery of unstructured trade secret content.

Retention policies are controls rather than just reports. The action is relevant to mandatory preservation of AI interaction data rather than hard restriction of a high-risk site.

Aggregated risk reporting describes activity patterns without changing access. This helps with trend monitoring of insider-risk alerts instead of the required hard restriction of a high-risk site.

Sharing reports reveal potentially overshared sites and trends. The action is relevant to broad link-exposure risk identification rather than hard restriction of a high-risk site.

Communication Compliance handles supported workplace conduct messages. It is used for review of harmful employee messages; this scenario calls for investigation of sensitive document transfer.

Insider-risk evidence combines configured user-activity risk signals. It is used for insider-driven exfiltration case; this scenario calls for investigation of sensitive document transfer.

eDiscovery organizes litigation-related content finding and holding. That addresses formal legal evidence collection, whereas the current case requires investigation of sensitive document transfer.

Content policy and data-loss alerts address different violation classes. It would support AI-related communication policy triage, not the stated classified information used during AI interactions.

Compliance Manager supports framework-mapped control review and improvements. Its purpose is assessment of AI-relevant compliance duties; the specified need is classified information used during AI interactions.

eDiscovery can retrieve supported recorded AI interactions for cases. Its purpose is legally responsive Copilot conversations; the specified need is classified information used during AI interactions.

Communication Compliance is designed for supported conduct and policy review of messages. The action is relevant to problematic workplace messages rather than suspected malicious insider activity.

Compliance Manager organizes compliance-control assessments and improvement tasks. This helps with framework evidence and control tracking instead of the required suspected malicious insider activity.

Content classification discovery identifies data locations and matched types. The action is relevant to locating sensitive identity data rather than suspected malicious insider activity.

Assessment templates map controls to a selected framework. It is used for regulation-specific control assessment; this scenario calls for regulatory readiness progress.

Improvement actions can track implementation evidence for assessment controls. That addresses documented proof of a compliance control, whereas the current case requires regulatory readiness progress.

The assessment assigns responsibility for relevant controls. It is used for responsibility partition for assessed controls; this scenario calls for regulatory readiness progress.