MS-900 Practice Test 20 — 15 Questions

Question 1

A security team wants to ensure that only devices that are compliant with company security policies (e.g., antivirus enabled, disk encrypted) can access Exchange Online and SharePoint Online. Which feature should they configure in Microsoft 365?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) allow administrators to enforce device compliance as a condition for granting access to cloud apps like Exchange Online and SharePoint Online. By integrating with Microsoft Intune device compliance policies (e.g., requiring antivirus, disk encryption), Conditional Access can block or allow access based on real-time device health signals, ensuring only compliant devices can connect.

Answer

Data loss prevention (DLP) policies

Answer

Information Rights Management (IRM)

Answer

Microsoft Defender for Office 365

Question 2

A multinational organization with 5,000 users is licensed with Microsoft 365 E3. They need to comply with a regulation that requires retaining all Exchange Online mailbox content for 7 years and providing advanced eDiscovery capabilities (including predictive coding) to search through that data. Which Microsoft 365 add-on license should they purchase to meet these requirements most cost-effectively?

Accepted Answer

Microsoft 365 E5 Compliance add-on. Microsoft 365 E5 Compliance add-on provides the required 7-year retention via retention policies and advanced eDiscovery (including predictive coding) without upgrading the entire E3 suite. This add-on is the most cost-effective way to meet regulatory retention and advanced search needs while keeping the existing E3 licensing.

Answer

Exchange Online Archiving for Exchange Online Plan 2

Answer

Microsoft 365 E5 (full suite upgrade)

Answer

Microsoft Purview Audit (Standard) add-on

Question 3

Which TWO Microsoft 365 compliance features are available in Microsoft Purview to help organizations manage and protect sensitive data?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (B) is correct because it enables organizations to govern their data through retention policies and retention labels, automatically retaining or deleting content based on regulatory requirements. Data Loss Prevention (DLP) (E) is correct because it identifies, monitors, and protects sensitive data across Microsoft 365 services (Exchange, SharePoint, OneDrive, Teams) by applying policies that prevent unauthorized sharing or leakage.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID Protection

Answer

Microsoft Defender XDR

Question 4

A company uses a cloud service where they can rent virtual machines and storage. They have full control over the operating system and applications, while the provider manages the physical hardware. Which cloud service model is being used?

Accepted Answer

Infrastructure as a Service (IaaS). This scenario describes Infrastructure as a Service (IaaS) because the company rents virtual machines and storage, retains full control over the operating system and applications, while the cloud provider manages the underlying physical hardware. In IaaS, the provider abstracts the physical infrastructure (servers, networking, storage) and delivers it as on-demand virtualized resources, which aligns with the customer's responsibility for OS and app configuration.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

On-premises deployment

Question 5

A company wants to use a cloud service where they can deploy their own custom applications without managing the underlying operating system or hardware. The cloud provider handles the runtime, middleware, and infrastructure. Which cloud service model best fits this requirement?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) is the correct model because it provides a managed environment where the company can deploy custom applications without managing the underlying OS, hardware, runtime, or middleware. The cloud provider handles all infrastructure and platform layers, allowing developers to focus solely on code and application logic.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Desktop as a Service (DaaS)

Question 6

You are the Microsoft 365 administrator for Contoso Ltd., a multinational company with 5,000 employees. The company uses Microsoft 365 E5 licenses for all users. The HR department has requested a solution to onboard new employees more efficiently. Currently, when a new employee is hired, IT manually creates a user account in Microsoft Entra ID (formerly Azure AD), assigns licenses, creates a mailbox in Exchange Online, and provisions a OneDrive for Business account. This process takes approximately 2 hours per employee and is prone to errors. The HR team uses a third-party HR system (Workday) to manage employee records. When an employee is hired in Workday, HR wants the process to be automated so that within 15 minutes, the employee has a Microsoft 365 account, appropriate licenses based on their department, and access to Microsoft Teams and SharePoint Online. Additionally, the employee should be automatically added to a Microsoft 365 group for their department. The solution must minimize manual intervention and ensure that only authorized HR personnel can trigger the automation. What should you implement?

Accepted Answer

Configure Workday to Microsoft Entra ID user provisioning in the Microsoft Entra admin center.. Workday to Microsoft Entra ID user provisioning is a built-in, cloud-native integration that automates the entire lifecycle of user accounts—creation, license assignment, group membership, and access to apps like Teams and SharePoint—directly from Workday HR events. It meets the 15-minute requirement, minimizes manual intervention, and can be scoped to allow only authorized HR personnel to trigger the automation via role-based access control in Entra ID.

Answer

Deploy Microsoft Identity Manager (MIM) to synchronize Workday with on-premises AD, then sync to Entra ID.

Answer

Create a Power Automate flow that triggers when a new employee is added to a SharePoint Online list, then uses Graph API to create the user.

Answer

Develop a custom solution using Microsoft Graph API and Azure Functions that polls Workday for changes.

Question 7

A development team wants to deploy a custom web application. They choose a cloud service that provides the operating system, web server, and database management system. The team is responsible only for uploading and managing their application code. Which cloud service model does this represent?

Accepted Answer

Platform as a Service (PaaS). This scenario describes Platform as a Service (PaaS) because the cloud provider manages the underlying infrastructure—operating system, web server, and database management system—while the development team is responsible only for deploying and managing their custom application code. PaaS abstracts the platform layer, allowing developers to focus on code without worrying about OS patches, web server configuration, or database administration.

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Answer

Function as a Service (FaaS)

Question 8

Which THREE Microsoft 365 services can be used to enforce data classification and protection?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (A) is correct because it acts as a Cloud Access Security Broker (CASB) that can enforce data classification and protection by applying policies to control data in transit and at rest across cloud applications. It can automatically classify sensitive data using built-in DLP engines and enforce actions like blocking downloads or applying encryption based on content inspection.

Answer

Microsoft Intune

Answer

Microsoft Entra ID

Question 9

A cloud provider serves thousands of customers using the same physical hardware. Each customer's data and applications are isolated from one another through virtualization. The provider can dynamically allocate resources to customers based on demand. Which cloud characteristic does this describe?

Accepted Answer

Resource pooling. This scenario describes resource pooling, where the cloud provider's computing resources (e.g., storage, processing, memory, network bandwidth) are pooled to serve multiple customers using a multi-tenant model. Virtualization isolates each customer's data and applications, while physical and virtual resources are dynamically assigned and reassigned according to consumer demand. This is a core characteristic of cloud computing as defined by NIST SP 800-145.

Answer

On-demand self-service

Answer

Rapid elasticity

Answer

Measured service

Question 10

A compliance-aware administrator is selecting the right Microsoft 365 capability to guide assignment of Microsoft 365 admin roles. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Least privilege. The principle of least privilege is the most relevant concept for guiding assignment of Microsoft 365 admin roles because it dictates that administrators should be granted only the permissions necessary to perform their job functions, minimizing security risks. This directly aligns with compliance requirements by ensuring that no user has excessive access to sensitive administrative functions. The other options (Whiteboard, Stream, Forms) are productivity or collaboration tools unrelated to role-based access control or compliance.

Answer

Microsoft Whiteboard

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 11

A global organization with 20,000 users is running Microsoft 365 E5 licenses. Due to budget cuts, the CIO wants to reduce licensing costs by 20% while ensuring that all users still have access to Exchange Online, SharePoint, Teams, and OneDrive. The organization also needs to maintain compliance with industry regulations that require eDiscovery and retention policies. The security team is willing to give up advanced threat protection features like Microsoft Defender for Office 365 P2 and Microsoft Purview Data Loss Prevention. Which licensing strategy should the organization adopt?

Accepted Answer

Downgrade all users to Microsoft 365 E3. Microsoft 365 E3 includes Exchange Online, SharePoint, Teams, and OneDrive, and provides eDiscovery and retention policies via Microsoft Purview compliance features. Downgrading from E5 to E3 reduces licensing costs by approximately 20-30% per user while retaining the required core productivity and compliance capabilities, and removes advanced threat protection (Defender for Office 365 P2, DLP) that the security team is willing to give up.

Answer

Switch to Microsoft 365 F3 for all users

Answer

Keep E5 but remove all add-on licenses

Answer

Switch to Microsoft 365 Business Premium for all users

Question 12

An e-commerce application runs in the cloud and automatically adjusts the number of virtual machines based on real-time traffic. When traffic spikes, more VMs are added; when traffic drops, VMs are removed. Which cloud computing characteristic does this behavior exemplify?

Accepted Answer

Rapid elasticity. Rapid elasticity is the cloud characteristic that enables resources to scale out (add VMs) and scale in (remove VMs) automatically in response to real-time demand. In this e-commerce scenario, the application adjusts VM count based on traffic spikes and drops, which directly matches the definition of rapid elasticity as defined by NIST SP 800-145.

Answer

Measured service

Answer

Resource pooling

Answer

On-demand self-service

Question 13

A project manager needs to assign tasks to team members, set deadlines, and track progress in a shared workspace. The workspace should integrate with Outlook and Teams. Which Microsoft 365 app is best suited for this requirement?

Accepted Answer

Microsoft Planner. Microsoft Planner is best suited because it provides a shared workspace with task assignment, deadline setting, and progress tracking via Kanban boards, and it integrates natively with Outlook for task synchronization and with Teams as a tab app for collaborative access.

Answer

Microsoft To Do

Answer

SharePoint

Answer

Microsoft Lists

Question 14

A marketing team needs to collaboratively create and edit documents in real time, share files securely, and track version history. Which Microsoft 365 service should they primarily use?

Accepted Answer

SharePoint Online. SharePoint Online is the correct choice because it is designed for team collaboration with real-time co-authoring, granular permission-based file sharing, and built-in version history that tracks every change. Unlike OneDrive, which is optimized for individual file storage and sharing, SharePoint provides a centralized team site where multiple users can simultaneously edit documents and manage versions at the site or library level.

Answer

Microsoft Teams

Answer

OneDrive for Business

Answer

Microsoft Viva Engage

Question 15

Your organization has Microsoft 365 E5 licenses. You want to ensure that users can access sensitive data only from compliant devices. Which Microsoft 365 service should you use?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct answer because it provides mobile device management (MDM) and mobile application management (MAM) capabilities that enforce compliance policies on devices before granting access to sensitive data. With Intune, you can define conditional access policies that require devices to be compliant (e.g., encrypted, jailbreak-detected, or running a minimum OS version) and then integrate with Microsoft Entra ID to block non-compliant devices from accessing corporate resources. This directly addresses the requirement to ensure users can access sensitive data only from compliant devices.

Answer

Microsoft Entra ID

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview