Pass Your Microsoft AB-900 Exam Easy!

RAC adds a site-level group boundary above ordinary link permissions. That addresses hard restriction of a high-risk site, whereas the current case requires trend monitoring of insider-risk alerts.

Retention policies are controls rather than just reports. It is used for mandatory preservation of AI interaction data; this scenario calls for trend monitoring of insider-risk alerts.

Sharing reports reveal potentially overshared sites and trends. It is used for broad link-exposure risk identification; this scenario calls for trend monitoring of insider-risk alerts.

Communication Compliance handles supported workplace conduct messages. Its purpose is review of harmful employee messages; the specified need is formal legal evidence collection.

DLP incidents show sensitive data matches and policy enforcement. It would support investigation of sensitive document transfer, not the stated formal legal evidence collection.

Insider-risk evidence combines configured user-activity risk signals. Its purpose is insider-driven exfiltration case; the specified need is formal legal evidence collection.

Compliance Manager supports framework-mapped control review and improvements. The action is relevant to assessment of AI-relevant compliance duties rather than AI-related communication policy triage.

AI-specific signals can surface use of protected data categories. This helps with classified information used during AI interactions instead of the required AI-related communication policy triage.

eDiscovery can retrieve supported recorded AI interactions for cases. The action is relevant to legally responsive Copilot conversations rather than AI-related communication policy triage.

Broad internal access can expose files beyond a business need. That addresses widespread internal file visibility, whereas the current case requires recent anonymous sharing link exposure.

Permission snapshots describe a site's current effective permission footprint. It is used for point-in-time site permission breadth; this scenario calls for recent anonymous sharing link exposure.

Classification snapshot reporting relates protected content to site-level exposure. That addresses classification-aware site exposure, whereas the current case requires recent anonymous sharing link exposure.

Events and permission changes show how unintended sharing arose. It would support forensic link-creation attribution, not the stated explicit group-only site access despite old links.

Reports detect access risk before a remediation decision is made. It would support assessment before disruptive restriction, not the stated explicit group-only site access despite old links.

Direct permission cleanup addresses who can actually read content. Its purpose is removal of unneeded site and item readers; the specified need is explicit group-only site access despite old links.

Governance reports can identify candidate sites for delegated review. The action is relevant to targeted review of a high-exposure site rather than owner-led permission recertification.

SharePoint site access review has product scope limitations and is not interchangeable with OneDrive. This helps with respecting site-access-review scope instead of the required owner-led permission recertification.

Review completion should include remediation and an accountable disposition. This helps with removal of abandoned project membership instead of the required owner-led permission recertification.

Site-specific sharing design can allow intended public resources while controlling risk. That addresses bounded anonymous public publication, whereas the current case requires prevention of future anonymous links.

Removing the link closes the existing possession-based access path. It is used for remediation of an exposed file link; this scenario calls for prevention of future anonymous links.

Sharing link reports summarize past link creation for risk analysis. That addresses counting anonymous sharing exposure, whereas the current case requires prevention of future anonymous links.

Broad internal access can be appropriate for deliberately shared public-to-staff content. It would support deliberate all-employee document availability, not the stated limiting companywide finance access.

Governance reports identify tenant-wide exposure patterns. Its purpose is discovery of Everyone-except-external-users sharing; the specified need is limiting companywide finance access.

Permission review validates actual access after group changes. It would support current site reader inventory, not the stated limiting companywide finance access.

Lifecycle policies govern recurring site ownership and inactivity risk. This helps with standardized site sprawl governance instead of the required orphaned inactive site disposition.

Owners are responsible for reviewing and approving site-level access. This helps with defined data ownership for site access instead of the required orphaned inactive site disposition.

Change records identify modifications that may increase exposure. The action is relevant to timing of site security changes rather than orphaned inactive site disposition.

File-level encryption protects permitted use after download. It is used for persistent content protection beyond site access; this scenario calls for confidentiality label with overly broad source access.

Copilot follows effective access; source governance determines visibility. That addresses underlying permissions correction for AI retrieval, whereas the current case requires confidentiality label with overly broad source access.

Combined sensitivity and permissions evidence prioritizes oversharing risk. That addresses high-impact oversharing prioritization, whereas the current case requires confidentiality label with overly broad source access.

Standard site permissions cover everyday membership and access decisions. It would support ordinary site membership changes, not the stated hard site access boundary.

Governance reports consolidate access patterns at organizational scale. Its purpose is tenant-wide oversharing assessment; the specified need is hard site access boundary.

Delegated reviews use owners' business knowledge to validate readers. It would support distributed site permission remediation, not the stated hard site access boundary.