Pass Your Microsoft AB-900 Exam Easy!

Alert details identify the sensitive type, location and enforcement reason. The action is relevant to evidence for a sensitive outbound email block rather than repeated data-loss incident response.

Simulated matches allow validation before production enforcement. This helps with impact testing of a new DLP rule instead of the required repeated data-loss incident response.

Governed exceptions avoid weakening protection for all users. The action is relevant to narrowly authorized protected-data sharing rather than repeated data-loss incident response.

Review dispositions preserve a decision trail for policy violations. It is used for accountable escalation of flagged messages; this scenario calls for protected access to communications investigations.

Communication Compliance surfaces supported risky messages to authorized reviewers. It is used for conduct-related Teams message review; this scenario calls for protected access to communications investigations.

Narrower detection criteria can improve review precision. That addresses tuned employee communication policy, whereas the current case requires protected access to communications investigations.

AI activity telemetry includes supported rule-match events and metadata. It would support Copilot DLP trigger timeline, not the stated formal litigation content collection.

Data access governance focuses site access exposure rather than classification actions. Its purpose is sites creating broad sharing links; the specified need is formal litigation content collection.

Activity explorer records content classification actions over time. Its purpose is temporal label-usage evidence; the specified need is formal litigation content collection.

AI posture management surfaces supported app usage and sensitive-data risk patterns. The action is relevant to unsanctioned AI exposure insight rather than specific risky AI interaction evidence.

Assessments identify and prioritize risky AI processing conditions. This helps with prioritized sensitive prompt exposure response instead of the required specific risky AI interaction evidence.

DLP provides enforcement evidence for supported AI content flows. The action is relevant to AI-specific data loss prevention rather than specific risky AI interaction evidence.

eDiscovery identifies responsive records using case search conditions. It is used for targeted email discovery; this scenario calls for distinct legal matter boundaries.

Hold preserves covered content for legal collection. That addresses litigation preservation before review, whereas the current case requires distinct legal matter boundaries.

AI interactions can be subject to discovery using supported item types. It is used for litigation search across AI conversations; this scenario calls for distinct legal matter boundaries.

Audit events can expose rule modifications and the acting principal. Its purpose is historical mailbox-rule mutation evidence; the specified need is timely reaction to concerning activity.

Audit event records attribute supported administrative operations. Its purpose is actor for an access-permission change; the specified need is timely reaction to concerning activity.

AI interaction audit records provide relevant usage evidence. It would support time evidence of Copilot activity, not the stated timely reaction to concerning activity.

Disposition review inserts accountable review into content deletion. This helps with approved records destruction instead of the required recurring regulatory assessment.

Alert casework supports remediation beyond a simple block. The action is relevant to governed data incident follow-up rather than recurring regulatory assessment.

Site owners can confirm needed access without security staff guessing business relationships. The action is relevant to owner-driven oversharing remediation rather than recurring regulatory assessment.

AI-aware DLP can inspect and control supported content exchanges. It is used for sensitive prompt leakage prevention; this scenario calls for prevention of unauthorized AI source discovery.

AI posture reporting combines supported usage patterns with sensitive data findings. That addresses AI adoption-associated data risk context, whereas the current case requires prevention of unauthorized AI source discovery.

Auditing provides user and time attribution for supported AI interactions. It is used for traceable sensitive Copilot activity; this scenario calls for prevention of unauthorized AI source discovery.

DLP activity captures the rule and destination context for a violation. Its purpose is file-sharing policy incident evidence; the specified need is hold-compliant preservation.

Reviewers assess policy context and document their disposition. It would support conduct violation assessment, not the stated hold-compliant preservation.

Insider risk contextualizes configured user behavior for triage. Its purpose is suspicious worker file-exfiltration investigation; the specified need is hold-compliant preservation.

EDM identifies values known to belong to the protected dataset. The action is relevant to precise matching of known customer IDs rather than recognition of standard legal forms.

Content classification reports where structured sensitive data is found. The action is relevant to discovery of structured financial identifiers rather than recognition of standard legal forms.

Semantic classification can identify document themes beyond fixed patterns. This helps with discovery of unstructured trade secret content instead of the required recognition of standard legal forms.

RAC adds a site-level group boundary above ordinary link permissions. That addresses hard restriction of a high-risk site, whereas the current case requires trend monitoring of insider-risk alerts.

Retention policies are controls rather than just reports. It is used for mandatory preservation of AI interaction data; this scenario calls for trend monitoring of insider-risk alerts.

Sharing reports reveal potentially overshared sites and trends. It is used for broad link-exposure risk identification; this scenario calls for trend monitoring of insider-risk alerts.