What AB-650 Questions and Answers feature?

Legal: Files & other data assets; Research: Groups & sites

Microsoft Purview sensitivity labels support multiple scopes that determine which resources the labels can protect and which protection settings administrators can configure.

First selection: Files & other data assets.

The legal department requires document-level protection for Microsoft Word files stored in SharePoint and distributed to external counsel.

The Files & other data assets scope supports sensitivity labels that apply encryption and content markings directly to supported documents.

Because the protection is associated with the document itself, configured encryption and markings can remain with the file when it is downloaded or shared outside its original SharePoint location.

Second selection: Groups & sites.

The research department requires collaboration-level protection for a Microsoft Teams environment.

The Groups & sites scope supports sensitivity labels applied to Microsoft Teams, Microsoft 365 groups, and SharePoint sites. These labels can configure privacy settings, guest access restrictions, external sharing controls, and access restrictions for unmanaged devices.

The Emails scope is intended for email protection, while the Meetings scope controls supported meeting and chat protection capabilities.

Technical consideration: Groups & sites labels do not automatically encrypt every document stored within the associated container. Additionally, restrictions for unmanaged devices require the supporting Microsoft Entra Conditional Access configuration.

Therefore, Files & other data assets is appropriate for Legal, while Groups & sites is appropriate for Research.

Microsoft References:

https://learn.microsoft.com/en-us/purview/sensitivity-labels

https://learn.microsoft.com/en-us/purview/sensitivity-labels-teams-groups-sites

List the AI app and agent inventory: AI observability; Review interactions: Activity explorer; Identify SharePoint exposure concerns: Data risk assessments

Microsoft Purview Data Security Posture Management (DSPM) combines AI activity visibility, sensitive-data investigations, and exposure assessments within a centralized data security framework.

First selection: AI observability. This capability provides an inventory of AI applications and agents, including their activity, risk characteristics, and sensitive interactions. Administrators can identify recently used agents and investigate potentially risky AI applications.

Second selection: Activity explorer. DSPM Activity explorer enables administrators to investigate events associated with sensitive information. Its AI activities view provides visibility into AI interactions, prompts and responses where supported, sensitive information detections, and data loss prevention policy matches. This makes it suitable for examining whether confidential SharePoint information was involved in an AI interaction.

Third selection: Data risk assessments. This capability identifies potential data exposure and oversharing risks. Administrators can assess sensitive content and investigate SharePoint locations where excessive access permissions or sharing configurations may expose information.

The remaining options perform different functions. Posture provides an overall data security dashboard, Remediation actions supports implementing security controls, and Reports provides summarized security information.

Consequently, AI observability, Activity explorer, and Data risk assessments are the correct selections for the three investigation requirements.

Microsoft References:

https://learn.microsoft.com/en-us/purview/data-security-posture-management-learn-about

Microsoft SharePoint Restricted Content Discovery (RCD) provides a site-specific mechanism for limiting how SharePoint content appears in organization-wide Microsoft 365 search and Microsoft 365 Copilot experiences.

Option B is correct because the administrator can apply Restricted Content Discovery directly to Site1 without modifying the search behavior of the other 999 SharePoint sites.

When RCD is enabled for Site1, its content is generally excluded from organization-wide discovery experiences and Copilot responses. This reduces the risk of confidential documents appearing in broad search results.

Restricted Content Discovery does not modify existing SharePoint permissions or remove files from the Microsoft 365 search index.

Option A is incorrect because Restricted SharePoint Search uses a tenant-wide allowlist approach and can affect search results across many SharePoint sites. Microsoft also began blocking new enablement of that feature on July 31, 2026.

Option C is incorrect because Copilot connectors integrate external data sources rather than restrict the discovery of existing SharePoint content.

Option D is incorrect because Microsoft Search bookmarks promote selected resources rather than restrict document discoverability.

Implementation qualification: Microsoft documents exceptions for content users own or have recently interacted with. RCD is not an absolute security boundary. If all access must be prevented, SharePoint permissions or Restricted Access Control must also be considered.

Microsoft References:

https://learn.microsoft.com/en-us/sharepoint/restricted-content-discovery

https://learn.microsoft.com/en-us/sharepoint/restricted-sharepoint-search