Free AB-650 Practice Exam Questions 2026 (With Explanations) — Copilot & AI Services Administrator

Q: [OVERVIEW]Contoso Enterprise Holdings has 2,000 M365 E5 licensed employees and is launching a pilot for Microsoft 365 Copilot across Finance, HR, and IT before full SharePoint permission remediation is finished.[/OVERVIEW] [ENVIRONMENT]• SharePoint Online: Over 1,400 legacy team sites created over 8 years; many contain overly broad 'Everyone except external users' read permissions. • Timeline Constraint: Full SharePoint Advanced Management (SAM) site access reviews will take 4 months to finish.

D. Restricted SharePoint Search (RSS) — Restricted SharePoint Search (RSS) allows organizations to temporarily restrict Copilot from searching organization-wide content, limiting grounding to an allowed list of up to 100 SharePoint sites while permissions are audited.

Q: [OVERVIEW]Woodgrove Bank operates a tier-2 VIP customer support desk receiving 450 escalation emails daily into a shared Exchange Online mailbox (`vip-support@woodgrovebank.com`).[/OVERVIEW] [ENVIRONMENT]• Tooling Stack: Microsoft Copilot Studio connected to Dataverse, Exchange Online connectors, and Microsoft Teams adaptive card approvals. • Risk Tolerance: Automated AI responses must NEVER go out unreviewed when financial compensation or contract terms are referenced.[/ENVIRONMENT] [REQUIREMEN

A. Autonomous Triggers combined with generative orchestration and Human-in-the-Loop approval steps — Autonomous agents in Copilot Studio support event-based triggers, autonomous planning, and human-in-the-loop interactions to pause execution until a human manager approves high-impact actions.

Q: Which Microsoft Entra ID log category records all authentication attempts and token requests performed by autonomous AI agents and Service Principals?

D. Service Principal sign-in logs — Authentication by non-human identities (service principals, managed identities, autonomous agents) is recorded in the Service Principal sign-ins tab in Entra ID monitoring logs.

Q: Which Microsoft Entra Workload ID feature enables applying Conditional Access policies directly to Service Principals and autonomous AI agents (such as restricting agent access to trusted corporate IP addresses)?

D. Conditional Access for Workload Identities — Conditional Access for Workload Identities allows securing machine and agent identities by enforcing location restrictions (trusted named locations/IP ranges) and risk-based access policies.

Q: If an organization decides to immediately deactivate an autonomous Copilot agent due to suspected compromise, what is the fastest administrative action in Microsoft Entra ID?

D. Disable the Enterprise Application / Service Principal in Microsoft Entra ID (setting "Enabled for users to sign-in?" to No) — Setting "Enabled for users to sign in?" to No on the Service Principal object in Microsoft Entra instantly prevents any user or process from obtaining tokens for that application, blocking all activity.

Q: [SCENARIO]Contoso maintains an M&A strategy workbook (`Project-Falcon.docx`) protected with a Microsoft Purview Sensitivity Label (`Confidential - Executive Board`) configured with Azure Rights Management encryption restricting View/Extract permissions exclusively to `ExecBoard@contoso.com`.[/SCENARIO] [SOLUTION]User1, a Marketing Analyst who is NOT a member of the `ExecBoard` group and holds no RMS usage rights on `Project-Falcon.docx`, opens Microsoft 365 Copilot Chat and prompts: 'Summarize t

B. Copilot cannot access the document and informs User1 that no information was found or access is denied — Copilot honors Azure Information Protection encryption and user Rights Management permissions. Because User1 lacks Usage Rights to open the file, Copilot cannot read or summarize it.

Q: [SCENARIO]Your Chief Compliance Officer requires technical guarantees that Microsoft 365 Copilot cannot surface Credit Card PANs or EU National ID numbers inside generated summaries returned back to unauthorized employees—even if the user bypasses prompt filters via indirect phrasing.[/SCENARIO] [SOLUTION]You create a Microsoft Purview Data Loss Prevention (DLP) policy targeting the 'Microsoft 365 Copilot and Copilot experiences' location configured to detect sensitive information types (SITs) a

B. Yes, Purview DLP evaluates both incoming user prompts and outgoing generated AI responses — Microsoft Purview DLP protects both input prompts and output responses in Microsoft 365 Copilot, ensuring sensitive data isn't leaked through generative responses.

Q: Your enterprise is deploying Microsoft 365 Copilot. Before enabling licenses, security leadership requires restricting Copilot enterprise grounding to an approved list of up to 100 SharePoint sites while data governance cleans up legacy public sites. Which TWO steps are required to implement Restricted SharePoint Search (RSS)? (Choose two.)

B. Populate the allowed sites list using the Add-SPOTenantRestrictedSearchAllowedSites cmdlet. & E. Execute the PowerShell cmdlet Set-SPOTenant -RestrictedSearchMode $true in the SharePoint Online Management Shell. — CORRECT: Options B and E. - Restricted SharePoint Search is enabled using Set-SPOTenant -RestrictedSearchMode . - Allowed sites (up to 100) are explicitly granted using Add-SPOTenantRestrictedSearchAllowedSites. INCORRECT DISTRACTORS: - Option A causes massive catastrophic data loss. - Options C and D are completely unrelated to SharePoint Copilot grounding.

Q: How does the Semantic Index for Copilot enhance user search and grounding results compared to standard keyword indexing in Microsoft 365? Which TWO statements accurately describe the Semantic Index? (Choose two.)

A. It creates vectorized maps of user and enterprise data to understand intent, synonyms, and natural language context. & C. It requires all documents to be formatted in plain ASCII text without formatting. — CORRECT: Options B and D. - The Semantic Index uses vectorization to understand conceptual relationships and synonyms. - It strictly respects Microsoft 365 permission boundaries; users never see results for files they do not already have permission to access. INCORRECT DISTRACTORS: - Option A is a misconception; Copilot strictly respects user permissions. - Options C and E are completely false.

Q: You need to control web search grounding in Microsoft 365 Copilot so that employees can receive public web insights without risking corporate prompt leakage to public search indices. Which TWO statements describe how web search in Microsoft 365 Copilot works? (Choose two.)

D. Administrators can toggle web search on or off tenant-wide or by user group in the Microsoft 365 Admin Center. & E. Copilot extracts anonymized search queries from the prompt before sending them to the Bing search service. — CORRECT: Options C and D. - Copilot creates de-identified, stripped query strings when consulting Bing to prevent data leakage. - Tenant administrators can enable or disable web search grounding via admin center controls or PowerShell. INCORRECT DISTRACTORS: - Option A violates commercial data protection (corporate data is never used to train foundational models). - Options B and E are false.

Q1 / 10 CASE STUDY Moderate

AI Services & Copilot Governance

[OVERVIEW]Contoso Enterprise Holdings has 2,000 M365 E5 licensed employees and is launching a pilot for Microsoft 365 Copilot across Finance, HR, and IT before full SharePoint permission remediation is finished.[/OVERVIEW] [ENVIRONMENT]• SharePoint Online: Over 1,400 legacy team sites created over 8 years; many contain overly broad 'Everyone except external users' read permissions. • Timeline Constraint: Full SharePoint Advanced Management (SAM) site access reviews will take 4 months to finish. • Approved Pilot Sites: Exactly 85 vetted SharePoint sites contain clean permissions and curated knowledge bases.[/ENVIRONMENT] [REQUIREMENTS]The Security Steering Committee prohibits delaying the Copilot rollout, but mandates an immediate tenant control restricting Microsoft 365 Copilot enterprise search strictly to up to 100 explicitly approved SharePoint sites (plus users' own OneDrive and recent files) until hygiene completes.[/REQUIREMENTS] [QUESTION]Which SharePoint & Copilot governance feature must you enable to satisfy this temporary search boundary requirement?[/QUESTION]

Q2 / 10 CASE STUDY Expert

Copilot Studio & Custom Declarative Agents

[OVERVIEW]Woodgrove Bank operates a tier-2 VIP customer support desk receiving 450 escalation emails daily into a shared Exchange Online mailbox (`vip-support@woodgrovebank.com`).[/OVERVIEW] [ENVIRONMENT]• Tooling Stack: Microsoft Copilot Studio connected to Dataverse, Exchange Online connectors, and Microsoft Teams adaptive card approvals. • Risk Tolerance: Automated AI responses must NEVER go out unreviewed when financial compensation or contract terms are referenced.[/ENVIRONMENT] [REQUIREMENTS]Design an agent that automatically wakes up when a high-priority email arrives in the shared mailbox, classifies the root complaint using generative reasoning, drafts a policy-compliant reply, and pauses workflow execution until a human supervisor approves before sending.[/REQUIREMENTS] [QUESTION]What Copilot Studio architectural concept orchestrates this event-driven, paused approval workflow?[/QUESTION]

Q3 / 10 MCQ Moderate

Identity & Agent 365 Governance

Which Microsoft Entra ID log category records all authentication attempts and token requests performed by autonomous AI agents and Service Principals?

Q4 / 10 MCQ Expert

Identity & Agent 365 Governance

Which Microsoft Entra Workload ID feature enables applying Conditional Access policies directly to Service Principals and autonomous AI agents (such as restricting agent access to trusted corporate IP addresses)?

Q5 / 10 MCQ Beginner

Identity & Agent 365 Governance

If an organization decides to immediately deactivate an autonomous Copilot agent due to suspected compromise, what is the fastest administrative action in Microsoft Entra ID?

Q6 / 10 YES NO Expert

Information Protection & DSPM for AI

[SCENARIO]Contoso maintains an M&A strategy workbook (`Project-Falcon.docx`) protected with a Microsoft Purview Sensitivity Label (`Confidential - Executive Board`) configured with Azure Rights Management encryption restricting View/Extract permissions exclusively to `ExecBoard@contoso.com`.[/SCENARIO] [SOLUTION]User1, a Marketing Analyst who is NOT a member of the `ExecBoard` group and holds no RMS usage rights on `Project-Falcon.docx`, opens Microsoft 365 Copilot Chat and prompts: 'Summarize the key acquisition metrics in Project-Falcon.docx.'[/SOLUTION] [QUESTION]What is the outcome when User1 attempts to summarize this RMS-encrypted document using Copilot?[/QUESTION]

Q7 / 10 YES NO Moderate

Information Protection & DSPM for AI

[SCENARIO]Your Chief Compliance Officer requires technical guarantees that Microsoft 365 Copilot cannot surface Credit Card PANs or EU National ID numbers inside generated summaries returned back to unauthorized employees—even if the user bypasses prompt filters via indirect phrasing.[/SCENARIO] [SOLUTION]You create a Microsoft Purview Data Loss Prevention (DLP) policy targeting the 'Microsoft 365 Copilot and Copilot experiences' location configured to detect sensitive information types (SITs) across both prompt evaluation and response generation.[/SOLUTION] [QUESTION]Can a Microsoft Purview DLP policy inspect and block sensitive content from appearing in Copilot-generated responses (output protection)?[/QUESTION]

Q8 / 10 MULTIPLE CHOICE Expert

AI Services & Copilot Governance

Your enterprise is deploying Microsoft 365 Copilot. Before enabling licenses, security leadership requires restricting Copilot enterprise grounding to an approved list of up to 100 SharePoint sites while data governance cleans up legacy public sites. Which TWO steps are required to implement Restricted SharePoint Search (RSS)? (Choose two.)

☑️ Multiple Choice — select all correct answers, then click Check Answer:

Q9 / 10 MULTIPLE CHOICE Expert

AI Services & Copilot Governance

How does the Semantic Index for Copilot enhance user search and grounding results compared to standard keyword indexing in Microsoft 365? Which TWO statements accurately describe the Semantic Index? (Choose two.)

☑️ Multiple Choice — select all correct answers, then click Check Answer:

Q10 / 10 MULTIPLE CHOICE Moderate

AI Services & Copilot Governance

You need to control web search grounding in Microsoft 365 Copilot so that employees can receive public web insights without risking corporate prompt leakage to public search indices. Which TWO statements describe how web search in Microsoft 365 Copilot works? (Choose two.)

☑️ Multiple Choice — select all correct answers, then click Check Answer:

Free AB-650 Practice Exam 2026 — 10 Real Questions

10 Interactive AB-650 Sample Practice Questions

Which Microsoft Entra ID log category records all authentication attempts and token requests performed by autonomous AI agents and Service Principals?

Which Microsoft Entra Workload ID feature enables applying Conditional Access policies directly to Service Principals and autonomous AI agents (such as restricting agent access to trusted corporate IP addresses)?

If an organization decides to immediately deactivate an autonomous Copilot agent due to suspected compromise, what is the fastest administrative action in Microsoft Entra ID?

How does the Semantic Index for Copilot enhance user search and grounding results compared to standard keyword indexing in Microsoft 365? Which TWO statements accurately describe the Semantic Index? (Choose two.)

You need to control web search grounding in Microsoft 365 Copilot so that employees can receive public web insights without risking corporate prompt leakage to public search indices. Which TWO statements describe how web search in Microsoft 365 Copilot works? (Choose two.)

2026 AB-650 Exam Blueprint & Domain Coverage

Configure Microsoft 365 Copilot & tenant readiness

Implement Purview DSPM for AI & data governance

Manage Copilot Studio agents, connectors & extensibility

Monitor adoption, security & compliance

Why Engineers Choose MSEndpoint Academy Over Static PDF Dumps & MeasureUp

True Pearson VUE Formats

Verified Microsoft Learn Links

All 5 Certs From €19/mo

Explore All 5 Microsoft Practice Exam Guides (2026)