AB-900 Practice Online

Tailwind Traders is redesigning its security architecture. A network engineer proposes that once a user connects from a managed device on the corporate LAN or VPN, their traffic should bypass conditional access checks and device compliance validation to “reduce friction,” because the internal network is considered trusted. The security architect argues this approach conflicts with the organization’s Zero Trust strategy. In a Zero Trust model, it is acceptable to fully trust any user and device solely because they are connected from an internal corporate network segment, and to skip further verification for resource access.

A Microsoft 365 administrator is hardening access to Copilot and other cloud apps. They decide to:

Require multifactor authentication for admins and high-risk users.

Use Microsoft Entra Conditional Access policies to evaluate user identity, device compliance, location, and sign-in risk.

Apply these checks to every sign-in, regardless of whether the user is on the corporate network or remote.

They want to describe which Zero Trust principle this design demonstrates most clearly.

Which Zero Trust principle best describes this approach?

Fabrikam is onboarding 200 seasonal warehouse workers who all need access to the same three Microsoft 365 apps and a single internal HR portal. The access will be removed at the end of the season, and new workers will be added next year. The identity team wants a solution that scales across seasons and keeps access reviews simple.

Which security object approach best meets these requirements?

Your organization has rolled out Microsoft 365 Copilot and several third-party AI assistants, and leadership is worried about where AI is being used and what corporate data is being exposed in prompts and responses. They want a single location in Microsoft Purview where security and compliance teams can see AI interactions, view risk insights, and drive remediation without building their own logging pipeline. Which action should you take to centrally discover and manage this AI activity?

A company is moving dozens of line-of-business applications to the cloud. Users complain about having to remember multiple passwords and reauthenticate for each app, while security leadership insists on enforcing MFA for sensitive applications and blocking access from high-risk sign-ins. The solution must:

Provide a single identity and sign-in for users across Microsoft 365 and third-party SaaS apps.

Enforce different controls (such as MFA or blocking) for risky sign-ins and sensitive apps without creating separate credentials per app.

Avoid forcing users through full credential prompts every time they switch applications.

You propose several approaches. Which proposed solution best satisfies these requirements?