MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Questions

Question 1

An organization is concerned about data leakage from sensitive emails. They want to enforce encryption on emails containing financial information automatically. Which Microsoft 365 solution should they configure?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (Option B) is the correct solution because it enables organizations to send and receive encrypted email messages, and it can be configured with mail flow rules to automatically encrypt emails containing sensitive financial information. This service leverages Azure Rights Management (Azure RMS) to provide persistent protection that follows the email, ensuring only authorized recipients can decrypt and read the content.

Answer

Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Information Protection (Microsoft Purview Information Protection)

Answer

Exchange Online Protection (EOP)

Question 2

A financial services company must prevent users from accidentally sharing sensitive customer data externally. They want to block sharing of any document containing a credit card number via email or SharePoint. What combination of Microsoft 365 compliance solutions should they use?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and block the sharing of sensitive information, such as credit card numbers, across email (Exchange Online) and SharePoint. By scanning content for predefined sensitive info types (e.g., credit card numbers using regex patterns from the DLP engine), DLP can automatically block or warn users before external sharing occurs, meeting the company's requirement.

Answer

Sensitivity labels and Microsoft Purview Information Protection (Microsoft Purview Information Protection)

Answer

Microsoft Purview Compliance Manager

Answer

Exchange Online Protection (EOP) and Microsoft Defender for Microsoft 365

Question 3

A company needs to ensure that all email and document content is preserved for legal purposes, even if users permanently delete items. This requirement demands that content be kept indefinitely until the legal hold is released. Which Microsoft 365 feature should they enable?

Accepted Answer

Litigation hold. Litigation hold is the correct feature because it preserves all mailbox and document content in its original state indefinitely until the hold is explicitly released. Unlike a retention policy, which can delete content after a specified period, Litigation hold ensures that even permanently deleted items are retained in the Recoverable Items folder, meeting the legal preservation requirement.

Answer

Retention policy

Answer

eDiscovery

Answer

Data Loss Prevention (DLP)

Question 4

A healthcare organization must protect patient health information (PHI) from being accidentally shared externally via email. They need to automatically block emails containing medical record numbers from being sent outside the organization and also encrypt any email that does contain PHI when it is allowed. Which two Microsoft Purview solutions should they combine? (Choose two.)

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is correct because it can automatically detect sensitive data, such as medical record numbers (PHI), in emails and apply policy actions like blocking external transmission. This directly addresses the requirement to prevent accidental sharing of PHI via email.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit (Standard)

Question 5

A healthcare organization stores patient records in SharePoint Online. They need to ensure that the data is encrypted at rest and in transit. Which statement is true regarding Microsoft 365 encryption?

Accepted Answer

Microsoft provides default encryption for data at rest and in transit.. Microsoft 365 provides default encryption for data at rest and in transit across all workloads, including SharePoint Online, Exchange Online, and OneDrive for Business. For data at rest, Microsoft uses BitLocker Drive Encryption and service-side encryption with per-file keys, while data in transit is secured using TLS 1.2+ and IPSec. This means the healthcare organization's patient records in SharePoint Online are automatically encrypted without any manual configuration.

Answer

Customers must enable encryption at rest manually for each workload.

Answer

Encryption only applies to Exchange Online, not SharePoint or OneDrive.

Answer

Encryption is optional and can be turned off if a customer chooses.

Question 6

A company uses Microsoft Purview to monitor for potential data security incidents. They want to automatically detect and remediate activities like downloading large amounts of data to a personal device. Which solution should they configure?

Accepted Answer

Insider Risk Management. Insider Risk Management is the correct solution because it is specifically designed to detect and remediate risky user activities that could lead to data security incidents, such as downloading large amounts of data to a personal device. It uses machine learning and behavioral analytics to identify anomalous patterns and can trigger automated remediation actions like blocking the activity or notifying the user.

Answer

Data Loss Prevention (DLP)

Answer

Audit

Answer

eDiscovery

Question 7

A company wants to ensure that only IT administrators can install browser extensions in Microsoft Edge. Which Microsoft 365 security feature should be used?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct choice because it provides mobile device management (MDM) and mobile application management (MAM) capabilities that allow administrators to configure Microsoft Edge settings via configuration profiles. Specifically, Intune can enforce the 'Installation of browser extensions' policy to restrict extension installation to IT administrators only, using the Administrative Templates for Edge within the Settings Catalog.

Answer

Conditional Access

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID Identity Protection

Question 8

An administrator needs to monitor and investigate potential data breaches by reviewing detailed records of file access and sharing activities across Microsoft 365. They require a centralized report showing who accessed what, from where, and any unusual patterns. Which tool should they use?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) is the correct tool because it provides a centralized, searchable log of all file access and sharing activities across Microsoft 365 services, including who accessed what, from which IP address, and when. This allows administrators to detect and investigate unusual patterns indicative of data breaches by reviewing detailed audit records.

Answer

Microsoft 365 Defender

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Secure Score

Question 9

A compliance officer wants to ensure that all data in Microsoft 365 is encrypted using a key that the organization manages and stores in their own Azure Key Vault. Microsoft will not have access to the key. Which solution should they implement?

Accepted Answer

Double Key Encryption (DKE). Double Key Encryption (DKE) is the correct solution because it allows an organization to use their own key stored in Azure Key Vault for encrypting sensitive Microsoft 365 data, while ensuring that Microsoft cannot access the key. With DKE, the encryption key is split into two parts: one managed by Microsoft and one managed by the customer in their own Azure Key Vault, so both parties must be compromised to decrypt the data. This meets the compliance officer's requirement for exclusive control over the encryption key.

Answer

Customer Lockbox

Answer

Information Rights Management (IRM)

Answer

Microsoft Purview Data Lifecycle Management

Question 10

A security administrator needs to ensure that all users accessing Microsoft 365 resources from unmanaged devices are prompted to sign in using multi-factor authentication (MFA) and are blocked from downloading sensitive files. Which conditional access policy should be configured?

Accepted Answer

Conditional Access policy with device compliance and session controls. Option D is correct because a Conditional Access policy with device compliance and session controls allows the administrator to require MFA for sign-ins from unmanaged devices and use session controls (e.g., Microsoft Defender for Cloud Apps session policies) to block downloading sensitive files. This policy targets specific conditions (unmanaged devices) and applies granular access controls, meeting both requirements precisely.

Answer

Require MFA for all users

Answer

Block access from unknown locations

Answer

App protection policies

Describe security, compliance, privacy, and trust in Microsoft 365

MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 — Key Topics

Where candidates lose marks on Describe security, compliance, privacy, and trust in Microsoft 365