MS-900 Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. You have a Conditional Access policy as shown. A user reports they cannot access Exchange Online from a non-compliant device. What is the most likely reason?

Accepted Answer

The device is not marked as compliant. The Conditional Access policy shown requires device compliance for Exchange Online access. When a device is non-compliant, the policy blocks access regardless of user identity or MFA status. The most likely reason for the user's inability to access Exchange Online is that the device is not marked as compliant, which is the condition explicitly enforced by the policy.

Answer

The policy only applies to administrators

Answer

The user has not registered for MFA

Answer

The policy is disabled

Question 2

A company has employees who frequently work from home on personal devices. They need to ensure corporate data in Microsoft 365 is protected even if the device is lost or compromised, without managing the entire device. What should they implement?

Accepted Answer

Microsoft Intune App Protection Policies. Microsoft Intune App Protection Policies (MAM) protect data at the app level without device enrollment. Conditional Access controls access. DLP prevents data loss. MAM is the correct approach for unmanaged devices.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Purview Data Loss Prevention

Question 3

Your company is deploying Microsoft Purview to manage data subject requests (DSRs) under GDPR. Users need to submit requests to access or delete their personal data. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Data Subject Requests. Microsoft Purview Data Subject Requests is the dedicated solution for managing data subject requests (DSRs) under GDPR. It provides a centralized interface for users to submit requests to access or delete their personal data, and for administrators to track and fulfill those requests. The other options are incorrect: Records Management handles retention and disposition of records, Audit (Premium) provides logging and investigation capabilities, and Data Loss Prevention (DLP) protects against data leaks. Therefore, option A is the correct answer.

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview Data Loss Prevention (DLP)

Question 4

Which three of the following are characteristics of Microsoft 365 subscription plans? (Choose three.)

Accepted Answer

Add-on services, such as Microsoft 365 Copilot, can be purchased to supplement existing plans.. Microsoft 365 subscription plans offer monthly and annual commitment terms, giving customers flexibility in billing. Business plans are specifically categorized as Business Basic, Business Standard, and Business Premium, each with different feature sets. Add-on services like Microsoft 365 Copilot can be purchased to enhance existing subscriptions, allowing organizations to scale capabilities without changing their base plan.

Answer

Enterprise plans are licensed on a per-user basis with a minimum of 5 seats.

Answer

Plans can be upgraded or downgraded at any time without any restrictions.

Answer

All subscription plans include the full desktop version of Office applications.

Question 5

A multinational corporation must comply with GDPR. They need to ensure that personal data of EU residents is retained for a specific period and then securely deleted. Additionally, they must be able to respond to data subject access requests (DSARs) within 30 days by finding and exporting relevant data. Which two Microsoft Purview solutions should they use together? (Choose two.)

Accepted Answer

Retention policies. Retention policies (A) are correct because they allow organizations to define rules that retain personal data for a specific period and then automatically delete it, meeting GDPR retention and secure deletion requirements. eDiscovery (Premium) (C) is correct because it enables searching, collecting, and exporting data from various Microsoft 365 workloads to fulfill data subject access requests (DSARs) within the 30-day regulatory timeframe.

Answer

Data Lifecycle Management (via sensitivity labels)

Answer

Audit (Standard)

Question 6

A company must comply with a regulation that requires all data stored in Microsoft 365 to remain within the European Union. Which Microsoft 365 feature should an administrator configure to enforce this geographic restriction?

Accepted Answer

Data Residency policies. Data Residency policies in Microsoft 365 allow administrators to define the geographic location where data at rest is stored. By configuring a Data Residency policy for the European Union, the administrator ensures that all data remains within EU data centers, meeting regulatory requirements.

Answer

Data Loss Prevention (DLP)

Answer

Information Rights Management (IRM)

Answer

Customer Lockbox

Question 7

A healthcare organization must ensure that electronic protected health information (ePHI) in Microsoft 365 is encrypted both at rest and in transit. Which Microsoft 365 feature provides encryption for data in transit?

Accepted Answer

TLS/SSL encryption. TLS/SSL encryption is the Microsoft 365 feature that protects data in transit — all Microsoft 365 services use TLS by default for client-to-service and service-to-service communication, and TLS 1.2+ is enforced for modern clients. This directly satisfies the requirement to encrypt ePHI in transit, complementing at-rest encryption provided by BitLocker and service-side encryption.

Answer

Azure Information Protection

Answer

BitLocker Drive Encryption

Answer

Microsoft Purview Information Protection

Question 8

A multinational organization with 500 users currently has Microsoft 365 E3 licenses. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a security incident. They also need the ability to automatically isolate infected endpoints. What is the most cost-effective licensing addition?

Accepted Answer

Microsoft 365 E5 Security. Microsoft 365 E5 Security is the most cost-effective addition because it provides advanced threat hunting via Microsoft 365 Defender (including queries across email, endpoints, and identities) and automated endpoint isolation through Microsoft Defender for Endpoint. This add-on delivers the required capabilities without the full cost of upgrading all users to Microsoft 365 E5, which would also include unnecessary features like advanced compliance and analytics.

Answer

Microsoft 365 E5

Answer

Microsoft 365 E5 Compliance

Answer

Enterprise Mobility + Security (EMS) E5

Question 9

Which TWO Microsoft 365 services can be used to create and manage tasks?

Accepted Answer

Microsoft Planner. Microsoft Planner (B) is a dedicated Microsoft 365 task-management service where teams create plans, buckets, and tasks with assignments, due dates, checklists, and progress tracking, so it directly satisfies the requirement to create and manage tasks. Microsoft To Do (D) is the personal task-management app in Microsoft 365 that lets users create task lists, set reminders, due dates, steps, and sync tasks (including flagged Outlook items and assigned Planner tasks), so it also directly creates and manages tasks. Power Automate (A) is a workflow/automation service that triggers actions across services rather than a task-management tool itself, so it does not belong. Microsoft Word (C) is a document-authoring application with no native task-management capability, and SharePoint (E) is a collaboration and content platform whose lists can store task-like items but it is not one of the two designated task creation/management services here.

Answer

Power Automate

Answer

Microsoft Word

Answer

SharePoint

Question 10

Which TWO of the following are required to use Microsoft 365 Apps for enterprise?

Accepted Answer

A supported operating system. Option A is correct because Microsoft 365 Apps for enterprise (Word, Excel, PowerPoint, Outlook, etc.) can only be installed and run on a supported operating system, such as Windows 10/11, the current or previous two versions of Windows Server with RDS, or one of the three most recent major versions of macOS; an unsupported OS means the apps cannot be installed or receive updates. Option D is correct because the applications require a valid Microsoft 365 license (for example, Microsoft 365 E3/E5 or Apps for enterprise) assigned to a user; without an active license, the apps run in reduced-functionality or read-only mode and cannot be activated. Option B is not required, since Exchange Online is only needed for hosted mailboxes and not for installing or using the Office applications themselves. Option C is not required, because the apps can be installed and used offline after activation, with internet connectivity needed only periodically for license revalidation and updates. Option E is not required, since Microsoft Entra ID (Azure AD) is used for identity and sign-in but is not a prerequisite for the apps to function.

Answer

Exchange Online mailbox

Answer

Persistent internet connectivity

Answer

Microsoft Entra ID

Question 11

Your company, Contoso Ltd., has a Microsoft 365 E5 subscription with 500 users. The IT department recently discovered that some employees are sharing sensitive customer data via email with external parties. You need to implement a solution that automatically detects and prevents the sharing of credit card numbers and social security numbers in emails. The solution should notify the sender when a potential violation occurs and allow them to override the block by providing a business justification. The compliance team must be able to review these overrides. What should you configure?

Accepted Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy in the Microsoft Purview compliance portal.. A Microsoft Purview Data Loss Prevention (DLP) policy can detect sensitive information types such as credit card numbers and social security numbers, and can be configured to block emails containing that data, notify the sender with an option to override by providing a business justification, and allow compliance team review of overrides. Option A is incorrect because Microsoft Defender for Office 365 Safe Attachments and Safe Links protect against malicious attachments and links, not against data leakage of sensitive information. Option C is incorrect because sensitivity labels are used for classification and protection (e.g., encryption) but not for blocking emails based on content. Option D is incorrect because an Exchange mail flow rule can block emails based on patterns but lacks the built-in sensitive info types, override with justification, and compliance review capabilities that DLP provides.

Answer

Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links.

Answer

Create a sensitivity label with auto-labeling for emails containing sensitive data.

Answer

Create an Exchange mail flow rule to block emails containing sensitive data and send a non-delivery report.

Question 12

A company is deploying Microsoft 365 and wants to ensure that customer financial data remains within the European Union. Which Microsoft 365 feature should the administrator configure?

Accepted Answer

Configure Data Location settings in the Microsoft 365 admin center.. The Data Location settings in the Microsoft 365 admin center allow administrators to specify the geographic region where data at rest is stored, including the European Union. This ensures compliance with data residency requirements by controlling where customer financial data is physically stored, leveraging Microsoft's commitment to data sovereignty within defined geo-boundaries.

Answer

Apply sensitivity labels using Microsoft Purview.

Answer

Set up Conditional Access policies in Microsoft Entra ID.

Answer

Implement Data Loss Prevention (DLP) policies.

Question 13

During requirements gathering, an IT manager says the organization must license frontline workers with lighter productivity needs. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Plans designed for frontline worker scenarios. The IT manager's requirement specifically calls for licensing frontline workers with lighter productivity needs. Microsoft 365 offers dedicated plans (e.g., Microsoft 365 F1, F3) designed precisely for frontline worker scenarios, providing essential productivity and communication tools at a lower cost per user. This makes option A the most relevant concept for the given requirement.

Answer

Microsoft Whiteboard

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 14

An organization wants to prevent employees from sharing sensitive files with external users via SharePoint Online, but they need to allow sharing with a specific external partner for a single project. What is the most efficient configuration?

Accepted Answer

Disable external sharing at the tenant level and enable it only for the specific project site. It allows the organization to disable external sharing globally at the tenant level via the SharePoint admin center, which prevents all users from sharing with external users by default. Then, by enabling external sharing only for the specific project site (site-level override), the organization can grant the necessary access to the external partner while maintaining the broad restriction. This is the most efficient approach because it uses a single configuration change at the tenant level and a targeted exception at the site level, avoiding complex policies or labels.

Answer

Change the default sharing link type to 'Specific people' and add the partner's domain to an allow list

Answer

Apply sensitivity labels with encryption to all files

Answer

Configure a DLP policy to block external sharing except for the partner domain

Question 15

Your company is subject to the General Data Protection Regulation (GDPR). Which Microsoft 365 compliance feature helps you respond to a Data Subject Request (DSR) to export a user's personal data?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery (Standard or Premium) is the compliance tool designed to identify, collect, preserve, and export content in response to Data Subject Requests under GDPR. It can search across Exchange, SharePoint, OneDrive, Teams, and other workloads, then export the results in a review set that satisfies the DSR 'right of access' and 'right to data portability' requirements.

Answer

Microsoft Information Protection

Answer

Data Loss Prevention

Answer

Unified audit log