The correct selections are No, Yes, No . Microsoft defines Zero Trust as a security strategy and explicitly states that it isn’t a product or a service . Instead, it is an approach based on principles such as verify explicitly , use least privilege access , and assume breach . That makes statement 2 true.

Statement 1 is false because Zero Trust does not require an Azure subscription. Microsoft provides Zero Trust guidance across many environments, including Microsoft 365, Copilot, Azure, and hybrid scenarios. It is a strategy that can be implemented with different technologies and is not dependent on owning Azure specifically.

Statement 3 is also false because there is no single switch in the Microsoft 365 admin center to “enable Zero Trust” for an organization. Microsoft’s documentation presents Zero Trust as a set of policies, configurations, and deployment steps across services such as Microsoft Entra, Intune, Defender, and Microsoft 365 workloads, not as one admin-center toggle.

Top of Form

Bottom of Form

The correct answer is Require multifactor authentication for administrative roles . In the exhibit, each recommendation shows its available Secure Score points . The listed values are 1/1 for Use least privileged administrative roles , 8/8 for Do not expire passwords , 0.73/8 for Enable policy to block legacy authentication , and 0/10 for Require multifactor authentication for administrative roles . Because 10 points is the highest value among the options shown, resolving that recommendation would improve the Identity Secure Score the most.

Microsoft Learn explains that Identity Secure Score in Microsoft Entra is based on Microsoft security recommendations, and each recommendation contributes a specific number of points depending on its impact and implementation state. Recommendations related to administrator protection are especially important because privileged accounts are high-value attack targets. Microsoft also emphasizes multifactor authentication for admin roles as a core identity security best practice. Therefore, both from the screenshot and from Microsoft’s identity guidance, the recommendation with the greatest score improvement is Require multifactor authentication for administrative roles .

Communications Compliance uses OCR (optical character recognition) and machine learning to detect offensive or risky text inside images , including those in SharePoint and OneDrive.

By default, Communications Compliance pseudonymizes user identities to reduce investigator bias. Admins can later de ‑anonymize if needed.

It does not add disclaimers. It silently monitors communications and flags policy violations; disclaimers are handled by Exchange transport rules, not Communications Compliance.

The correct selections are No, No, Yes . Microsoft states that for Microsoft 365 Copilot , customer prompts, responses, and Microsoft Graph grounding data aren’t used to train foundation models . Microsoft also explains that Copilot processes organizational data within the service boundary and applies the same commitments that protect Microsoft 365 customer data. That makes statements 1 and 2 No . Microsoft further documents that Microsoft 365 Copilot grounds responses using Microsoft Graph and only surfaces data that the user is permitted to access , so it respects existing identity, access, and permission controls in the tenant. That makes statement 3 Yes .

This behavior is a core part of Copilot’s enterprise design. Microsoft describes Copilot as inheriting your organization’s existing Microsoft 365 permissions model, including access controls on content in SharePoint, OneDrive, Exchange, Teams, and other Microsoft 365 services. So Copilot does not grant new access; it works within the permissions already assigned to the signed-in user.

The correct answer is C. a custom Microsoft 365 Copilot agent . Microsoft Learn explains that Agent Builder in Microsoft 365 Copilot lets you create agents with specific instructions , dedicated knowledge sources , and starter prompts . Starter prompts are designed to help users understand the most common supported scenarios, which directly matches the requirement to provide users with a list of common queries. Microsoft also documents that an agent can be grounded in selected SharePoint sites, folders, or files , allowing the response scope to be targeted to the HR policy content in Site1 rather than broad enterprise or web data.

The other options do not fit the requirement. Copilot in Word is document-focused and is not intended to create a reusable, shared query experience grounded only in one SharePoint source. Copilot notebooks group materials and chats, but they are not the right tool for publishing a guided HR policy assistant with starter prompts. Researcher is designed for broader, multi-step research using work data and web content, so it does not satisfy the requirement to keep answers grounded only in Site1.

The correct answer is B. data loss prevention (DLP) policies . Microsoft Learn states that Microsoft Purview Data Loss Prevention helps organizations identify, monitor, and automatically protect sensitive information across Microsoft 365 locations such as Exchange, SharePoint, OneDrive, Teams, and devices . Microsoft specifically documents scenarios for preventing sensitive items from being shared with external users in SharePoint and OneDrive, and DLP policies can also block or restrict sharing based on sensitive information types, labels, or policy conditions. This is exactly the control used when the requirement is to stop users from sharing corporate financial data outside the organization.

Option A is incorrect because retention labels manage how long content is kept or deleted, not whether it can be shared externally. Option C is incorrect because role groups are used for permissions and administrative access delegation, not content-sharing prevention. Option D is incorrect because Insider Risk Management is designed to detect and investigate risky user behavior, not to directly block external sharing transactions in the way DLP policies do. For proactive enforcement of external-sharing restrictions on sensitive financial information, Microsoft’s documented solution is DLP policies .

The correct selections are No, Yes, Yes . Statement 1 is No because Microsoft documents that Agent Builder in Microsoft 365 Copilot is included with the Microsoft 365 Copilot license , and agents built with that feature are part of that licensed experience. Microsoft also states that the capability is enabled by default in Microsoft 365 Copilot licensed tenants . While Copilot Chat users with qualifying Microsoft 365 licenses can access web-grounded chat experiences, creating Microsoft 365 Copilot agents in the app is documented under the Copilot-licensed Agent Builder experience, not as an E5-only entitlement.

Statement 2 is Yes because Microsoft states that Researcher and Analyst were deployed to users with Microsoft 365 Copilot licenses . Statement 3 is Yes because Microsoft says users can build agents in Agent Builder by using natural language or manually .