MS-900 Exam Questions and Answers

SharePoint Online

SharePoint Online is the correct choice because it provides team sites with document libraries designed for collaborative content creation and editing at scale. Its capabilities include real-time co-authoring, version history, check-in/check-out, and fine-grained permission management, all of which are essential for a marketing team working on shared assets. SharePoint serves as the central file repository for Microsoft 365, powering file collaboration across Teams and other apps.

Power Automate

Power Automate is the correct choice because it is Microsoft's dedicated workflow automation service, enabling users to create cloud flows that connect to hundreds of services, including Microsoft Teams and Dynamics 365. For a global sales team, you can design an approval flow triggered by a new lead or a Teams message, automatically routing the approval request to the appropriate manager and tracking its status in real time. It provides prebuilt templates for approval scenarios and supports both automated and manual triggers, making it the ideal solution for streamlining sales communications and approvals.

Microsoft Viva Engage

Microsoft Viva Engage is an enterprise social network that allows organizations to create company-wide announcements, topic-based communities, and integrate with other apps like SharePoint and Power BI. It is the intended service for broad employee communication.

Microsoft Dynamics 365 Sales

Microsoft Dynamics 365 Sales is a purpose-built CRM application that leverages the Dataverse (Common Data Service) to store leads, contacts, accounts, and opportunities with full relationship hierarchies. It records customer interactions such as emails, calls, meetings, and notes as activities, while sales automation features—including workflows and Power Automate connectors—can trigger follow-up actions automatically. Its dashboards and built-in sales insights give managers the analytics needed to monitor pipeline health, making it the correct choice here.

Microsoft Planner

Microsoft Planner is a collaborative task management tool built around a visual Kanban board where each task has assignees, due dates, checklists, labels, and file attachments. Every Planner plan is backed by a Microsoft 365 Group, giving the team a shared mailbox, calendar, and SharePoint document library for co-authoring, and the Board can be embedded into Teams as a tab. Its simplicity and native Teams integration make it the correct choice for a shared workspace with assignments and deadlines.

Microsoft Power Automate

Microsoft Power Automate enables no-code/low-code cloud flows that use built-in connectors and triggers to react to events in third-party HR systems. These flows can orchestrate user provisioning, send approval emails, and update Microsoft Entra ID or other systems automatically, making it the correct tool for automating HR-driven identity workflows.

Upgrade all users to Microsoft 365 E5

Upgrading all users to Microsoft 365 E5 is the correct choice because E5 directly includes both Defender for Office 365 Plan 1 and Microsoft Purview Information Protection. E5 bundles all E3 features with advanced security and compliance workloads, eliminating the need for additional add-ons and ensuring both the email protection and information protection requirements are met under a single license.

Microsoft 365 Business Premium

Microsoft 365 Business Premium is the correct choice because it includes the full Microsoft 365 Apps for Enterprise desktop applications, hosted Exchange, Teams, SharePoint, and advanced security features like Microsoft Defender for Office 365 and Intune, and it can be licensed on a true monthly basis with no annual commitment—making it a flexible, comprehensive solution for 200 employees.

Modify the maximum message size in the Exchange admin center

The correct solution is for an administrator to raise the organization's transport limit in the Exchange admin center (Mail flow > Message size limits). Exchange Online allows configuration of the maximum send/receive message size up to 150 MB, so changing this setting directly raises the attachment ceiling. Since the user was blocked by the default 25 MB policy, only this change at the service level resolves the issue for all users in the organization.

Microsoft Entra ID Free

The Microsoft Entra ID Free tier only supports cloud-only identities and does not support password hash synchronization from on-premises Active Directory. It also provides no Microsoft 365 workloads, so it cannot handle the hybrid directory requirements or deliver the needed productivity services to the organization's users.

Ensure recurring billing is enabled

Ensuring recurring billing is enabled is the correct action because, with this setting on, Microsoft automatically charges the stored payment method on the subscription's expiry date and renews the Microsoft 365 Business Basic license without interruption. You can verify this in the Microsoft 365 admin center under Billing > Your products, where the recurring billing toggle should be set to On for continuous service. If recurring billing was previously disabled, re-enabling it guarantees that the subscription follows the standard auto-renewal process and avoids any gap in services or user access.

Purchase Microsoft 365 Business Basic licenses

Microsoft 365 Business Basic provides a 50 GB Exchange Online mailbox, Microsoft Teams, and browser-based versions of Office apps (Outlook, Word, Excel, PowerPoint) at a low per-user monthly price. For temporary contractors who need core productivity and email without desktop apps, Business Basic is a cost-effective and appropriate license, hence the correct answer.

Infrastructure as a Service (IaaS)

IaaS offers virtualized compute, storage, and networking resources via services like Azure Virtual Machines, with the customer retaining control over the guest OS, applications, and middleware while the provider manages the physical datacenter. This service model supports a direct lift-and-shift migration of on-premises servers, including preservation of existing OS images and system configurations, with minimal re-architecture. Because the evaluation specifically targets moving infrastructure, IaaS is the correct choice as it gives the needed visibility and control over the entire computing stack.

On-demand self-service

On-demand self-service is the NIST-defined characteristic that lets a consumer unilaterally provision computing capabilities—such as virtual machines, storage, or network services—as needed automatically, without requiring human interaction with the service provider. This is typically delivered through a web portal, CLI, or API, meaning the user can spin up resources in minutes without opening a support ticket. It directly matches the scenario in the question: the user can obtain resources automatically and without manual intervention.

Hybrid cloud

Hybrid cloud is correct because it explicitly combines an on-premises environment with one or more public cloud services, connected through a secure, dedicated network (e.g., VPN gateway, Azure ExpressRoute) and often unified identity for consistent management. This architecture allows a critical application to remain running on-premises while 'bursting' into the public cloud during peak load—scaling out additional instances or offloading batch processing to the cloud. The company's stated goal directly matches the hybrid cloud value proposition of preserving existing investments while gaining elastic capacity and resilience.

Measured service

Measured service is the cloud characteristic that automatically monitors, controls, and reports resource usage, enabling providers to bill customers for exactly the compute, storage, or network capacity they consume. This metering capability makes pay-per-use pricing possible, so the CFO only pays for the compute actually used, avoiding fixed upfront costs. Without measured service, usage-based billing and cost optimization would not be feasible.

Platform as a Service (PaaS)

PaaS delivers a fully managed hosting environment that includes the operating system, language runtime, web server, and deployment tooling as part of the service. The startup only manages its application code and data, while the platform provider automatically handles patching, scaling, and infrastructure maintenance—exactly matching the requirement to focus purely on development and deployment.

Rapid elasticity

Rapid elasticity is the cloud characteristic that lets an e-commerce application dynamically add or remove compute capacity—such as VM instances or containers—in near-real time as traffic spikes or falls. An autoscaling group monitors metrics like CPU utilization or request count and adjusts resources automatically, so the application always has enough capacity without manual intervention. This exactly matches the scenario's automatic scaling based on demand.

Microsoft Purview Message Encryption

Microsoft Purview Message Encryption is the correct answer. It is a dedicated email encryption capability built on Azure Rights Management, allowing organizations to send and receive encrypted messages across domains. You can configure mail flow rules (transport rules) to automatically encrypt messages based on conditions such as the presence of sensitive content, specified users, or message classifications. This directly achieves the goal of encrypting sensitive emails, both in transit and at rest, and provides a secure access experience for recipients.

Data Loss Prevention (DLP) policies

DLP policies inspect content in Exchange email and SharePoint, detecting credit card numbers via sensitive information types and blocking external sharing. This directly satisfies the requirement to prevent accidental external disclosure of documents containing card numbers across both channels.

Microsoft provides default encryption for data at rest and in transit.

Microsoft applies encryption automatically, without requiring any customer configuration. Data at rest, including SharePoint patient records, is protected with BitLocker disk encryption and Storage Service Encryption, while data in transit is secured with industry-standard TLS 1.2+ protocols. These default protections cover every Microsoft 365 workload, so encryption is always on from the moment data is written.

Insider Risk Management

Insider Risk Management is the Microsoft Purview solution built specifically to identify, triage, and respond to risky user behavior by aggregating signals from Windows, Microsoft 365, and HR systems into a consolidated risk score. It uses predefined risk indicator policies—such as mass file downloads, unusual device connections, or repeated data exfiltration—and applies machine learning to surface anomalous patterns with a case-management workflow. When a threshold is met, it can automatically escalate to an investigation, notify the user, or trigger a policy response, making it the correct choice for monitoring and remediating potential data loss from insiders.

Microsoft Intune

Microsoft Intune is a cloud-based endpoint management service (MDM/MAM) that can deploy device configuration profiles to Windows, macOS, iOS, and Android devices. For instance, an Intune configuration profile can apply a Policy CSP to set the "Configure ExtensionSettings" policy for Microsoft Edge, blocking extension installations or allowlisting only approved extensions. Intune also integrates with Entra ID so that Conditional Access can require device compliance, but the actual endpoint restriction is enforced by Intune's policy delivery.

Microsoft Purview Audit (Standard)

Microsoft Purview Audit (Standard) is the correct tool because it records timestamped events for user and admin actions across Exchange, SharePoint, OneDrive, Teams, and Microsoft Entra ID. Investigators can query the unified audit log to identify exactly when a file was accessed, downloaded, shared, or deleted and which account performed the action. This historical, activity-level evidence is essential for monitoring, triaging, and thoroughly investigating a potential data breach, with default retention of 90 days for standard events.