Microsoft AB-900 - Questions & Answers

An app registration creates the Microsoft Entra application object that a third-party cloud service uses for authentication and permissions. MFA and Conditional Access protect user access, and a Copilot connector is not the identity object. The requirement is external application authentication, so the Entra app registration fits.

The Microsoft Defender portal is used to review security incidents, alerts, and threat protection information, including phishing impact for email users. The Microsoft 365 admin center handles tenant administration, Entra focuses on identity, and Exchange admin center handles mail configuration. The requirement is security incident review, so Defender is the best fit.

Microsoft Entra sign-in logs show failed sign-in attempts, authentication details, MFA results, Conditional Access decisions, and risk information. Other portals may show workload or compliance activity, but they do not provide the identity sign-in evidence required here. The rule is to troubleshoot Microsoft 365 sign-in failures from Entra sign-in logs.

SharePoint site sharing settings and permissions control whether site content can be shared externally.
The other choices relate to different Microsoft 365 administration areas and do not directly prevent external sharing for one SharePoint site. The requirement is site-level content sharing control, so SharePoint administration is the relevant path.

Microsoft Entra ID Protection can detect risky sign-ins and apply automated controls such as blocking access or requiring remediation. Defender for Identity monitors identity threats in Active Directory, but risky cloud sign-in response belongs to Entra ID Protection. The requirement specifically describes automatic response to risky sign-in activity.

Authorization determines what an authenticated identity is allowed to access or perform. Authentication verifies who or what the identity is, and MFA strengthens authentication rather than authorization. The requirement asks for the meaning of authorization in Microsoft 365, so the permission decision definition is correct.

Zero Trust is a security strategy based on principles such as verify explicitly, use least privilege, and assume breach. It is not a single product or a simple perimeter model. Other statements that imply automatic trust or network-location trust do not match the Zero Trust requirement.