AI Business Professional AB-730 Practice Test 3
Question 20
A staff member sees a surprisingly detailed Copilot result and assumes it must have read a colleague's locked mailbox. The team implements: Explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations. Which observed result would most directly verify success?
- A responsible policy owner signs off after comparing the text with current rules
- A permitted test user sees the item while the unauthorized account still cannot
- Every published quote can be located in an authentic authorized source
- The cited sources are accessible to the requester, and a restricted test item remains unavailable
Explanation
Correct Answer
D:The cited sources are accessible to the requester, and a restricted test item remains unavailable. This verifies the expected result of explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations, instead of merely assuming it worked.
Incorrect Answers
A:A responsible policy owner signs off after comparing the text with current rules. This would verify route the high-impact claim to a qualified reviewer and require the authoritative policy text under a different business condition; it does not test the stated outcome.
B:A permitted test user sees the item while the unauthorized account still cannot. This would verify check effective file permissions, sharing settings, and indexing before drawing conclusions under a different business condition; it does not test the stated outcome.
C:Every published quote can be located in an authentic authorized source. This would verify remove or qualify unverifiable citations and locate direct supporting evidence under a different business condition; it does not test the stated outcome.
Question 21
A new employee believes Copilot's detailed reply proves it can see every private Teams chat in the company. Which action best meets the stated business requirement?
- Explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations
- Use the approved records-access or ownership-transfer process instead of relying on model workarounds
- Recalculate the figures from source data and correct discrepancies before publication
- Assume the model has unrestricted access to all Microsoft 365 content because it names a project
Explanation
Correct Answer
A:Explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations. Copilot respects the effective Microsoft 365 permissions of the signed-in user. In this scenario, the key acceptance result is: the cited sources are accessible to the requester, and a restricted test item remains unavailable.
Incorrect Answers
B:Use the approved records-access or ownership-transfer process instead of relying on model workarounds. This is better suited to a different case: A team tries to retrieve records of a departed employee that their current account cannot access. It does not directly satisfy the access, source, or output constraint here.
C:Recalculate the figures from source data and correct discrepancies before publication. This is better suited to a different case: A slide deck contains an attractive AI-created chart but the categories total over 100 percent. It does not directly satisfy the access, source, or output constraint here.
D:A plausible answer is not evidence that private data or denied files were accessed. Thus assume the model has unrestricted access to all Microsoft 365 content because it names a project fails here. Explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations is the more appropriate control.
Question 22
A new employee believes Copilot's detailed reply proves it can see every private Teams chat in the company. The proposed approach is: Explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations. Why does this approach meet the requirement?
- Responsible use keeps accountable people and authoritative records in the decision loop
- Human verification and source grounding are essential for high-impact factual assertions
- Derived AI output may inherit confidentiality obligations from its inputs
- Copilot respects the effective Microsoft 365 permissions of the signed-in user
Explanation
Correct Answer
D:Copilot respects the effective Microsoft 365 permissions of the signed-in user. The proposed approach, explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations, specifically addresses the stated requirement. Verification would show: the cited sources are accessible to the requester, and a restricted test item remains unavailable.
Incorrect Answers
A:Responsible use keeps accountable people and authoritative records in the decision loop. That property explains use the AI summary as decision support and apply policy-based human review to the underlying evidence for another task, rather than the proposed control here.
B:Human verification and source grounding are essential for high-impact factual assertions. That property explains treat unsupported AI assertions as potentially inaccurate and inspect the primary contract before acting for another task, rather than the proposed control here.
C:Derived AI output may inherit confidentiality obligations from its inputs. That property explains verify source sensitivity and recipient permissions before sharing the output for another task, rather than the proposed control here.
Question 23
A new employee believes Copilot's detailed reply proves it can see every private Teams chat in the company. A colleague suggests: "Assume the model has unrestricted access to all Microsoft 365 content because it names a project." What specific flaw makes that shortcut unsuitable?
- Generated predictions are not verified historical measurements
- Language generation does not replace domain expertise or required approvals
- Prompt wording cannot override underlying organizational data access controls
- A plausible answer is not evidence that private data or denied files were accessed
Explanation
Correct Answer
D:A plausible answer is not evidence that private data or denied files were accessed. The suggested shortcut, assume the model has unrestricted access to all Microsoft 365 content because it names a project, leaves the requirement unmet. A better approach is to explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations.
Incorrect Answers
A:Generated predictions are not verified historical measurements. This is the limitation of the different shortcut present generated projections as observed operational results, not the alternative identified here.
B:Language generation does not replace domain expertise or required approvals. This is the limitation of the different shortcut allow the model to certify legal compliance without a human reviewer, not the alternative identified here.
C:Prompt wording cannot override underlying organizational data access controls. This is the limitation of the different shortcut ask Copilot repeatedly to reveal the restricted content through differently worded prompts, not the alternative identified here.
Question 24
A new employee believes Copilot's detailed reply proves it can see every private Teams chat in the company. The team implements: Explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations. Which observed result would most directly verify success?
- The prompt contains only policy-permitted fields and uses the approved work account
- Recomputed totals, labels, and units agree with the approved underlying dataset
- The cited sources are accessible to the requester, and a restricted test item remains unavailable
- Records are handled through authorized recovery and the AI uses only available materials
Explanation
Correct Answer
C:The cited sources are accessible to the requester, and a restricted test item remains unavailable. This verifies the expected result of explain that Copilot can use only accessible, permission-scoped work content and request explicit source citations, instead of merely assuming it worked.
Incorrect Answers
A:The prompt contains only policy-permitted fields and uses the approved work account. This would verify use the governed organizational Copilot experience and minimize or redact sensitive details as policy requires under a different business condition; it does not test the stated outcome.
B:Recomputed totals, labels, and units agree with the approved underlying dataset. This would verify recalculate the figures from source data and correct discrepancies before publication under a different business condition; it does not test the stated outcome.
D:Records are handled through authorized recovery and the AI uses only available materials. This would verify use the approved records-access or ownership-transfer process instead of relying on model workarounds under a different business condition; it does not test the stated outcome.
Question 25
A security officer plans to use Copilot on a regulated draft and needs to know where prompts can be reviewed. Which action best meets the stated business requirement?
- Enable authorized work grounding or provide a permitted file instead of inventing missing internal details
- Promise that enterprise data protection makes all work prompts invisible to tenant administrators
- Open the cited source, verify the exact figure, its date, and whether it applies to this decision
- Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience
Explanation
Correct Answer
D:Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience. Work-account Copilot usage can be governed and logged by organizational controls. In this scenario, the key acceptance result is: the compliance owner confirms the approved audit and retention configuration for the use case.
Incorrect Answers
A:Enable authorized work grounding or provide a permitted file instead of inventing missing internal details. This is better suited to a different case: A response includes publicly available company information but the prompt requests private project milestones. It does not directly satisfy the access, source, or output constraint here.
B:Enterprise protection does not mean tenant audit and compliance tools are disabled. Thus promise that enterprise data protection makes all work prompts invisible to tenant administrators fails here. Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience is the more appropriate control.
C:Open the cited source, verify the exact figure, its date, and whether it applies to this decision. This is better suited to a different case: A proposal cites an internal budget figure but its source document is dated two fiscal years ago. It does not directly satisfy the access, source, or output constraint here.
Question 26
A security officer plans to use Copilot on a regulated draft and needs to know where prompts can be reviewed. The proposed approach is: Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience. Why does this approach meet the requirement?
- Information protection can legitimately restrict what a prompt may retrieve
- Verification requires traceable underlying evidence, not decorative reference markers
- Work-account Copilot usage can be governed and logged by organizational controls
- Human verification and source grounding are essential for high-impact factual assertions
Explanation
Correct Answer
C:Work-account Copilot usage can be governed and logged by organizational controls. The proposed approach, follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience, specifically addresses the stated requirement. Verification would show: the compliance owner confirms the approved audit and retention configuration for the use case.
Incorrect Answers
A:Information protection can legitimately restrict what a prompt may retrieve. That property explains check effective file permissions, sharing settings, and indexing before drawing conclusions for another task, rather than the proposed control here.
B:Verification requires traceable underlying evidence, not decorative reference markers. That property explains remove or qualify unverifiable citations and locate direct supporting evidence for another task, rather than the proposed control here.
D:Human verification and source grounding are essential for high-impact factual assertions. That property explains treat unsupported AI assertions as potentially inaccurate and inspect the primary contract before acting for another task, rather than the proposed control here.
Question 27
A security officer plans to use Copilot on a regulated draft and needs to know where prompts can be reviewed. A colleague suggests: "Promise that enterprise data protection makes all work prompts invisible to tenant administrators." What specific flaw makes that shortcut unsuitable?
- Generated predictions are not verified historical measurements
- Unnecessary sensitive context increases data exposure without improving the focused answer
- Prompt injection attempts to redirect a model from its authorized task through untrusted content
- Enterprise protection does not mean tenant audit and compliance tools are disabled
Explanation
Correct Answer
D:Enterprise protection does not mean tenant audit and compliance tools are disabled. The suggested shortcut, promise that enterprise data protection makes all work prompts invisible to tenant administrators, leaves the requirement unmet. A better approach is to follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience.
Incorrect Answers
A:Generated predictions are not verified historical measurements. This is the limitation of the different shortcut present generated projections as observed operational results, not the alternative identified here.
B:Unnecessary sensitive context increases data exposure without improving the focused answer. This is the limitation of the different shortcut include the maximum possible confidential data to make the model more certain, not the alternative identified here.
C:Prompt injection attempts to redirect a model from its authorized task through untrusted content. This is the limitation of the different shortcut obey commands embedded in source documents because they appear beside relevant facts, not the alternative identified here.
Question 28
A security officer plans to use Copilot on a regulated draft and needs to know where prompts can be reviewed. The team implements: Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience. Which observed result would most directly verify success?
- Recomputed totals, labels, and units agree with the approved underlying dataset
- The reviewer can reproduce the figure from a current source or marks it unsupported
- The compliance owner confirms the approved audit and retention configuration for the use case
- The final response uses accessible project data or clearly states the information is unavailable
Explanation
Correct Answer
C:The compliance owner confirms the approved audit and retention configuration for the use case. This verifies the expected result of follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience, instead of merely assuming it worked.
Incorrect Answers
A:Recomputed totals, labels, and units agree with the approved underlying dataset. This would verify recalculate the figures from source data and correct discrepancies before publication under a different business condition; it does not test the stated outcome.
B:The reviewer can reproduce the figure from a current source or marks it unsupported. This would verify open the cited source, verify the exact figure, its date, and whether it applies to this decision under a different business condition; it does not test the stated outcome.
D:The final response uses accessible project data or clearly states the information is unavailable. This would verify enable authorized work grounding or provide a permitted file instead of inventing missing internal details under a different business condition; it does not test the stated outcome.
Question 29
An internal auditor asks whether employee prompts made in a managed work account leave any audit trail. Which action best meets the stated business requirement?
- Route the high-impact claim to a qualified reviewer and require the authoritative policy text
- Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience
- Promise that enterprise data protection makes all work prompts invisible to tenant administrators
- Check effective file permissions, sharing settings, and indexing before drawing conclusions
Explanation
Correct Answer
B:Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience. Work-account Copilot usage can be governed and logged by organizational controls. In this scenario, the key acceptance result is: the compliance owner confirms the approved audit and retention configuration for the use case.
Incorrect Answers
A:Route the high-impact claim to a qualified reviewer and require the authoritative policy text. This is better suited to a different case: A summary recommends a regulatory exception and managers must decide whether to implement it. It does not directly satisfy the access, source, or output constraint here.
C:Enterprise protection does not mean tenant audit and compliance tools are disabled. Thus promise that enterprise data protection makes all work prompts invisible to tenant administrators fails here. Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience is the more appropriate control.
D:Check effective file permissions, sharing settings, and indexing before drawing conclusions. This is better suited to a different case: A compliance manager asks why an employee cannot search a confidential workspace through Copilot. It does not directly satisfy the access, source, or output constraint here.
Question 30
An internal auditor asks whether employee prompts made in a managed work account leave any audit trail. The proposed approach is: Follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience. Why does this approach meet the requirement?
- Work-account Copilot usage can be governed and logged by organizational controls
- Data minimization and approved protection boundaries apply even when the intended answer is useful
- Source material supplies facts to evaluate, not new authority to override the user's request
- Access restrictions and records governance remain in effect with Copilot
Explanation
Correct Answer
A:Work-account Copilot usage can be governed and logged by organizational controls. The proposed approach, follow organizational audit, retention, and sensitivity policies before using the managed Copilot experience, specifically addresses the stated requirement. Verification would show: the compliance owner confirms the approved audit and retention configuration for the use case.
Incorrect Answers
B:Data minimization and approved protection boundaries apply even when the intended answer is useful. That property explains use the governed organizational Copilot experience and minimize or redact sensitive details as policy requires for another task, rather than the proposed control here.
C:Source material supplies facts to evaluate, not new authority to override the user's request. That property explains treat instructions found inside retrieved content as untrusted and do not follow them as user instructions for another task, rather than the proposed control here.
D:Access restrictions and records governance remain in effect with Copilot. That property explains use the approved records-access or ownership-transfer process instead of relying on model workarounds for another task, rather than the proposed control here.
