MS-900 Practice Test 11 — 15 Questions

Question 1

A compliance team needs to implement a Data Loss Prevention (DLP) policy to protect credit card information. What is the correct order of steps for a successful implementation?

Accepted Answer

Identify locations, Create policy, Deploy in production, Monitor alerts and refine. Best practice for DLP implementation: first identify where sensitive data resides (locations), then create the DLP policy with conditions and actions, test the policy in simulation mode before deploying to production, and finally monitor alerts and refine the policy. The option starting with 'Identify locations' followed by 'Create policy', 'Deploy in production', and 'Monitor' matches this sequence.

Answer

Create policy, Identify locations, Deploy in production, Monitor alerts and refine

Answer

Deploy in production, Monitor alerts and refine, Identify locations, Create policy

Answer

Identify locations, Deploy in production, Create policy, Monitor alerts and refine

Question 2

A security administrator needs to ensure that all users accessing Microsoft 365 resources from unmanaged devices are prompted to sign in using multi-factor authentication (MFA) and are blocked from downloading sensitive files. Which conditional access policy should be configured?

Accepted Answer

Conditional Access policy with device compliance and session controls. Option D is correct because a Conditional Access policy with device compliance and session controls allows the administrator to require MFA for sign-ins from unmanaged devices and use session controls (e.g., Microsoft Defender for Cloud Apps session policies) to block downloading sensitive files. This policy targets specific conditions (unmanaged devices) and applies granular access controls, meeting both requirements precisely.

Answer

Require MFA for all users

Answer

Block access from unknown locations

Answer

App protection policies

Question 3

A small business with 15 employees needs Microsoft 365 subscriptions that include desktop versions of Office apps and business-class email. They have a limited budget. Which is the most cost-effective plan that meets these requirements?

Accepted Answer

Microsoft 365 Business Standard. Microsoft 365 Business Standard is the most cost-effective plan that includes both desktop versions of Office apps (e.g., Word, Excel, PowerPoint) and business-class email (Exchange Online with a 50 GB mailbox and custom domain). Business Basic only provides web and mobile Office apps without desktop installations, while Business Premium adds advanced security and device management features that exceed the small business's limited budget and stated requirements. Office 365 E1 is an enterprise plan that lacks desktop Office apps entirely.

Answer

Microsoft 365 Business Basic

Answer

Microsoft 365 Business Premium

Answer

Office 365 E1

Question 4

A startup with 25 employees needs business-grade email (50 GB mailbox per user), web versions of Office apps, and 1 TB of cloud storage per user. They do not need the desktop versions of Office or advanced security features. Which Microsoft 365 plan is the most cost-effective choice?

Accepted Answer

Microsoft 365 Business Basic. Microsoft 365 Business Basic provides business-grade email with 50 GB mailboxes, web versions of Office apps (Word, Excel, PowerPoint, etc.), and 1 TB of cloud storage per user via OneDrive for Business. Since the startup does not need desktop Office apps or advanced security features, this plan meets all stated requirements at the lowest cost.

Answer

Microsoft 365 Business Standard

Answer

Microsoft 365 Business Premium

Answer

Microsoft 365 Apps for business

Question 5

An administrator is reviewing a request from users who need to analyze attachments in a protected environment before delivery. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Safe Attachments. Safe Attachments is the correct Microsoft 365 Defender capability that detonates email attachments in a virtual, protected environment before delivery. It uses behavioral analysis and machine learning to detect malicious content, ensuring that only safe attachments reach the user's inbox. This directly addresses the requirement to analyze attachments in a protected environment.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 6

A consulting firm needs a tool to allow customers to schedule appointments with specific consultants online. The tool must show available time slots, send confirmation emails, and allow customers to reschedule. Which Microsoft 365 app should they use?

Accepted Answer

Microsoft Bookings. Microsoft Bookings is the correct app because it is specifically designed for scheduling appointments, showing real-time availability of staff, sending automated confirmation and reminder emails, and allowing customers to self-manage rescheduling or cancellations. It integrates with Exchange Online for calendar synchronization and Teams for virtual meetings, meeting all stated requirements.

Answer

Microsoft Forms

Answer

Microsoft To Do

Answer

Microsoft Planner

Question 7

A sales team wants to maintain a shared list of high-priority leads with custom columns for company name, contact person, deal value, and stage. Team members need to update the list in real time and view the change history. Which Microsoft 365 app should they use?

Accepted Answer

Microsoft Lists. Microsoft Lists is designed for creating and sharing flexible lists with custom columns, real-time collaboration, and version history. Excel can be shared but is not as purpose-built for list management. SharePoint can host lists, but Microsoft Lists is the dedicated app. Teams can display a list as a tab, but the underlying app is Lists.

Answer

Microsoft Excel

Answer

Microsoft SharePoint

Answer

Microsoft Teams

Question 8

An administrator is reviewing a request from users who need to let users provision resources from a portal without provider interaction. Cloud concept or benefit best matches this requirement?

Accepted Answer

On-demand self-service. The requirement describes users provisioning resources from a portal without provider interaction, which is the core definition of on-demand self-service as defined by NIST SP 800-145. In Microsoft 365, this maps to capabilities like users creating Teams, SharePoint sites, or Azure resources via self-service portals without IT intervention.

Answer

Data Loss Prevention (DLP)

Answer

Microsoft Planner

Answer

Sensitivity labels

Question 9

During a Microsoft 365 planning workshop, create a Microsoft 365 support request. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Microsoft 365 admin center support area. The question asks for the most relevant concept when creating a Microsoft 365 support request during a planning workshop. The Microsoft 365 admin center includes a dedicated support area (under Help & support) where administrators can create service requests, track their status, and access troubleshooting tools. This directly aligns with the scenario of initiating a support request, making D the correct answer.

Answer

Microsoft Whiteboard

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 10

In a Software as a Service (SaaS) model, which of the following responsibilities is typically handled by the cloud provider?

Accepted Answer

Patching the underlying operating system and application. In a SaaS model, the cloud provider is responsible for managing the underlying infrastructure, including patching the operating system and the application itself. This is a core tenet of the shared responsibility model, where the provider handles the security and maintenance of the software stack, while the customer is responsible for data and user access. For example, in Microsoft 365, Microsoft automatically applies security updates to Exchange Online and SharePoint without customer intervention.

Answer

Managing user passwords and accounts

Answer

Configuring application settings for the organization

Answer

Backing up customer data

Question 11

A small business with 10 users needs Microsoft 365 desktop versions of Office apps (Word, Excel, PowerPoint), business-grade email, and 1 TB of cloud storage per user. They do not need advanced security or compliance features. Which Microsoft 365 plan is the most cost-effective choice?

Accepted Answer

Microsoft 365 Business Standard. Microsoft 365 Business Standard is the most cost-effective plan that includes desktop versions of Office apps (Word, Excel, PowerPoint), business-grade email (Exchange Online), and 1 TB of OneDrive cloud storage per user. Business Basic only provides web and mobile apps, not desktop versions. Business Premium adds advanced security and compliance features (e.g., Microsoft Defender for Office 365, Azure Information Protection) that the customer explicitly does not need. E3 is an enterprise plan with similar features but at a higher per-user cost, making it overkill for a 10-user small business.

Answer

Microsoft 365 Business Basic

Answer

Microsoft 365 Business Premium

Answer

Microsoft 365 E3

Question 12

An organization wants to retain mailbox content for legal investigation. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

eDiscovery and retention capabilities in Microsoft Purview. Security and compliance controls should be selected by risk scenario and tested before tenant-wide enforcement.

Answer

It requires every document to be made public

Answer

It replaces the need for identity and access management

Question 13

An enterprise needs advanced analytics, voice, and advanced security/compliance capabilities beyond E3. Which option best matches the requirement?

Accepted Answer

Microsoft 365 E5. Microsoft 365 E5 is the correct choice because it includes advanced analytics via Power BI Pro, voice capabilities through Phone System and Audio Conferencing, and advanced security/compliance features such as Microsoft Defender for Office 365, Microsoft Purview Information Protection, and Insider Risk Management. These capabilities are not available in E3, which lacks the advanced security, compliance, and voice features required by the enterprise.

Answer

Microsoft Defender for Cloud only

Answer

Azure Virtual Desktop only

Answer

A free personal Microsoft account only

Question 14

A training department needs to create interactive learning modules that include content pages, quizzes, and surveys. They also need to track completion and results for each learner. Which Microsoft 365 app should they use as the primary authoring tool for the quizzes and surveys?

Accepted Answer

Microsoft Forms. Microsoft Forms is the correct primary authoring tool because it is specifically designed for creating quizzes, surveys, and polls with automatic grading, branching logic, and result tracking. It integrates seamlessly with Microsoft Lists and Power Automate to record completion and results per learner, making it ideal for interactive learning modules.

Answer

Microsoft Stream

Answer

Microsoft Sway

Answer

Microsoft Viva Learning

Question 15

Which cloud computing characteristic allows users to provision resources such as virtual machines and storage without requiring human interaction with the service provider?

Accepted Answer

On-demand self-service. On-demand self-service is one of the five essential characteristics of cloud computing defined by NIST. It enables users to automatically provision computing resources as needed through a web portal or API, without requiring manual intervention from the service provider.

Answer

Measured service

Answer

Resource pooling

Answer

Rapid elasticity