Get Microsoft AB-731 Exam Practice Questions - Real and Updated

Answer : B

Preventing generative AI from accessing confidential or classified information is primarily a data access and classification control problem. The most effective broad solution is data governance (B)---the framework of policies and controls that ensures sensitive content is identified, classified, protected, and access is restricted using least privilege. Data governance includes information classification/sensitivity labels, access control reviews, secure sharing practices, data loss prevention (DLP), and auditing---controls that directly limit what data is available to the AI through permission trimming and policy enforcement.

An information barrier (A) policy is more specific: it's intended to prevent communication and collaboration between defined user groups (often for regulatory/ethical walls). It does not comprehensively address document classification or restrict AI access to sensitive files across the tenant. A data retention policy (C) governs how long content is kept and when it's deleted; it's not a primary access-prevention mechanism. Communication monitoring (D) is a detection/oversight control; it can help identify risky activity, but it does not itself prevent access to confidential content by the AI.

Therefore, to prevent AI from surfacing confidential/classified data during summarization and analysis, you should recommend data governance as the primary control layer.

Answer : C, D

By default, Microsoft 365 Copilot is grounded in your organization's Microsoft 365 data through Microsoft Graph, and it respects the user's existing permissions. For ''find and summarize information across internal documents,'' the most direct default document repositories in Microsoft 365 are SharePoint (team sites and shared libraries) and OneDrive (a user's work files). That is why C (Microsoft SharePoint) and D (Microsoft OneDrive) are the correct selections. Microsoft explicitly describes Copilot as accessing organizational content via Microsoft Graph, including user documents and related work content.

The other options are not ''by default'' sources. A (on-premises file share) is not automatically part of Microsoft Graph unless you integrate/migrate content or use connectors to make it discoverable in Microsoft 365 experiences. B (custom CRM) similarly requires an integration approach (for example, Microsoft 365 Copilot connectors / Graph connectors) to index and expose that data for Copilot to use. E (Microsoft Sway) is not a primary default content source for Copilot's document grounding and is not typically referenced as a core internal document repository compared to SharePoint/OneDrive.

Answer : A

The requirement is to analyze text and identify ''people, locations, and companies'' mentioned in news articles. This is a classic Named Entity Recognition (NER) / entity extraction scenario, which falls under natural language processing. Azure Language in Foundry Tools is the correct choice because it provides text analytics capabilities that detect and categorize entities in unstructured text---commonly including Person, Location, and Organization. This enables downstream experiences such as topic tagging, search filters (e.g., ''all articles mentioning Company X''), trend dashboards (top people/places mentioned this week), and improved content discovery.

The other options do not match the requirement. Content Safety focuses on moderating harmful or policy-violating content (for example, hate, violence, self-harm, sexual content) and is not the primary tool for extracting named entities. Azure Vision is for analyzing images and performing OCR; it would only be relevant if the articles were images or scans, but the task here is entity extraction from text articles. Azure Speech is for speech-to-text, text-to-speech, and audio analysis; it would be used if your input were audio recordings rather than written articles.

Answer : D

The core business concern in the scenario is data leakage---employees using consumer tools where corporate data could be pasted, stored, or processed outside the organization's governance boundary. The key differentiator of Microsoft 365 Copilot is that it's designed to work inside your Microsoft 365 tenant and to respect the organization's existing security, compliance, identity, and data access controls. Therefore, D is the best answer: Copilot accesses internal work data (Microsoft Graph-connected content such as mail, files, chats, meetings) in accordance with existing Microsoft 365 policies and permissions---meaning it can only surface content the user is already allowed to access, and it operates under enterprise-grade controls (authentication, auditing, compliance boundaries, and admin governance).

Options B and C describe general generative AI capabilities that personal ChatGPT can also provide (brainstorming, drafting, rewriting). A can be done in multiple tools as well, and it is not the primary ''enterprise value'' difference tied to the stated risk. The scenario's driver is governance: reducing the likelihood of proprietary data leaving controlled systems while still enabling productivity. Rolling out Copilot addresses that by providing ''work-safe'' AI anchored to organizational content and managed through the same tenant controls your company already uses.

Answer : D

An AI governance council (often called an ''AI Council'') exists primarily to set direction and provide cross-functional oversight so AI adoption stays aligned to the organization's values, risk posture, and Responsible AI commitments. That maps most directly to D. Microsoft's guidance on creating an AI Council describes leadership responsibilities such as defining and communicating the organization's AI vision, values, and policies, reviewing and approving AI use cases/projects, and coordinating with enablement and technical readiness teams to understand risks, issues, and opportunities. It also emphasizes representation across distinct functions (for example: senior leadership, legal, compliance, risk, ethics, data, technology, business, HR) to ensure governance decisions reflect a broad, accountable perspective.

The other options describe activities that may be supporting outcomes of governance, but they are not the council's primary purpose. A is narrow (IT policy enforcement/user monitoring) and is typically handled by security/compliance operations rather than the top-level governance body. B is user enablement/training (commonly owned by adoption/change management teams). C focuses on technical delivery and performance management (often owned by engineering/MLOps/service owners). The governance council's central value is strategic guidance + oversight + cross-functional alignment to ensure Responsible AI adoption is consistent, accountable, and sustainable across the business.