MS-900 Practice Test 23 — 15 Questions

Question 1

Your company uses Microsoft 365 Business Premium and wants to enable remote wipe of company data on employees' personal mobile devices if they are lost or stolen. Which service provides this capability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Intune Mobile Application Management (MAM). Microsoft Intune Mobile Application Management (MAM) enables selective remote wipe of company data from personal mobile devices without wiping personal data. This is achieved through app-level policies that can remove corporate data from managed apps (e.g., Outlook, Teams) when a device is lost or stolen, using the Intune company portal or a wipe command triggered by an administrator.

Answer

Microsoft Entra ID

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Compliance Manager

Question 2

A business stakeholder asks how Microsoft 365 can help them determine which apps a licensed user can access. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Enabled service plans within the assigned license. Enabled service plans within a Microsoft 365 license define which specific applications and services a user can access. Administrators can view and manage these service plans via the Microsoft 365 admin center under 'Licenses' > 'Assignments', allowing granular control over app availability per user.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Whiteboard

Question 3

A tenant administrator needs help from Microsoft for a service issue affecting Exchange Online. Which option best matches the requirement?

Accepted Answer

Microsoft 365 admin center support request. The Microsoft 365 admin center is the correct portal for tenant administrators to submit support requests for service issues affecting Exchange Online. It provides direct access to Microsoft's support team, including options for severity-based tickets and service health monitoring, which are essential for resolving production-impacting issues.

Answer

Microsoft Defender for Cloud only

Answer

Azure Virtual Desktop only

Answer

A free personal Microsoft account only

Question 4

Contoso Ltd. is a medium-sized company with 500 employees using Microsoft 365 E5. They have a mixed environment: 300 Windows 10 devices are managed by Microsoft Intune, and 200 are unmanaged but Azure AD joined. The company uses Microsoft Teams for collaboration and SharePoint Online for document storage. The security team wants to implement the following: restrict access to company data from unmanaged devices, require multi-factor authentication (MFA) for all external users accessing SharePoint, and ensure that sensitive documents labeled 'Highly Confidential' are automatically encrypted when shared via email. Currently, the company has no conditional access policies, no MFA enforced, and no data classification policies. The administrator needs to design a solution using Microsoft 365 built-in capabilities without purchasing additional licenses. What should the administrator do?

Accepted Answer

Create a conditional access policy to grant access from compliant devices, require MFA for external users, and configure a sensitivity label with auto-labeling for 'Highly Confidential' documents.. It uses Conditional Access policies to require compliant devices for access (addressing unmanaged devices), requires MFA specifically for external users (not all users, aligning with the requirement), and uses a sensitivity label with auto-labeling to automatically encrypt 'Highly Confidential' documents when shared via email. This leverages built-in Microsoft 365 capabilities without additional licenses.

Answer

Configure SharePoint to block access from unmanaged devices, enable MFA for all users, and use Microsoft Purview Data Loss Prevention (DLP) to encrypt sensitive emails.

Answer

Use Intune app protection policies to restrict data access, enable MFA for SharePoint, and use Microsoft Purview auto-labeling for encryption.

Answer

Create a conditional access policy to require MFA for all users, use Intune compliance policies to mark devices as compliant, and create a sensitivity label to encrypt documents.

Question 5

An organization with 5,000 users has Microsoft 365 E3 licenses. They want to add Microsoft Defender for Office 365 (Plan 1) and Microsoft Purview Data Loss Prevention (DLP). Which THREE actions can achieve this?

Accepted Answer

Purchase Microsoft Purview DLP as an add-on. Microsoft 365 E3 licenses include Exchange Online Protection but not Defender for Office 365 (Plan 1) or Purview DLP. Both features can be added as standalone add-on subscriptions (Options A and D). Alternatively, upgrading all users to Microsoft 365 E5 bundles both features natively, making Option B correct. This approach avoids per-user add-on costs and simplifies license management.

Answer

Downgrade to Microsoft 365 E1 and add the features

Answer

Switch to Microsoft 365 Business Premium

Question 6

Your organization uses Microsoft 365 E5 and experiences a security incident where a user's account is compromised. You need to immediately prevent the attacker from accessing Microsoft 365 services while preserving the user's data for investigation. Which action should you take?

Accepted Answer

Block sign-in for the user in Microsoft Entra ID. Blocking sign-in for the user in Microsoft Entra ID immediately prevents the attacker from authenticating to any Microsoft 365 service, while the user's data remains intact in Exchange Online, SharePoint, and OneDrive for forensic analysis. This action does not delete or alter any data, preserving the full investigation trail.

Answer

Delete the user account from Microsoft Entra ID

Answer

Revoke the user's sessions using Microsoft Entra ID

Answer

Reset the user's password

Question 7

A cloud provider bills a customer monthly based on the precise number of gigabytes of storage used and the number of virtual machine hours consumed. Which essential cloud computing characteristic does this billing model demonstrate?

Accepted Answer

Measured service. The billing model charges based on exact gigabytes of storage used and virtual machine hours consumed, which directly aligns with the 'measured service' characteristic. This means the cloud provider meters resource usage (e.g., storage IOPS, compute hours) and bills only for what is consumed, enabling pay-as-you-go pricing. Measured service relies on telemetry and monitoring systems (e.g., Azure Monitor, AWS CloudWatch) to track usage and generate invoices.

Answer

Resource pooling

Answer

On-demand self-service

Answer

Broad network access

Question 8

A global enterprise uses Microsoft 365 E5 and has users in Europe, Asia, and North America. They need to ensure that user data in Exchange Online and SharePoint Online remains within the European Union for EU users. They also want to apply a retention policy to keep all data for at least 7 years. Which combination of Microsoft 365 features should an administrator use?

Accepted Answer

Enforce data residency using Multi-Geo capabilities in Exchange Online and SharePoint Online, and apply a retention policy via Microsoft Purview Data Lifecycle Management.. Multi-Geo capabilities in Exchange Online and SharePoint Online allow the administrator to pin user data at the tenant level to a specific geographic location (e.g., the EU), ensuring data residency. A retention policy configured via Microsoft Purview Data Lifecycle Management can then be applied to retain all data for a minimum of 7 years, meeting both compliance requirements.

Answer

Use Microsoft Purview Compliance Manager to configure data residency and retention settings.

Answer

Use Data Location for Exchange Online and a SharePoint multi-geo tenant, then create a retention policy in Purview for 7 years.

Answer

Configure Microsoft Entra ID Conditional Access policies to restrict data access based on location.

Question 9

A company is deploying Microsoft Teams Rooms for its meeting rooms. They need to ensure that room calendars are automatically updated when a meeting is booked via Outlook. Which Microsoft 365 service enables this integration?

Accepted Answer

Exchange Online. Exchange Online is the correct answer because it provides the mailbox and calendar infrastructure that Microsoft Teams Rooms relies on. When a meeting is booked via Outlook, the Exchange Online calendar processes the booking and automatically updates the room's calendar, enabling the Teams Rooms device to display the meeting details. This integration uses the Exchange Web Services (EWS) or REST APIs to synchronize calendar events between Outlook and the room resource mailbox.

Answer

Microsoft Intune

Answer

Microsoft Teams

Answer

SharePoint Online

Question 10

During requirements gathering, an IT manager says the organization must discover where sensitive information is stored across Microsoft 365. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Data classification / Content explorer. Data classification and Content explorer in Microsoft 365 Purview allow organizations to discover, classify, and monitor sensitive information across Exchange, SharePoint, OneDrive, and Teams. This capability uses trainable classifiers and sensitive information types to identify data like credit card numbers or PII, providing a unified view in Content explorer for compliance administrators. It directly meets the requirement to discover where sensitive information is stored.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 11

While preparing a Microsoft 365 adoption plan, a consultant is asked to let users report suspicious phishing messages from Outlook for investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Office 365 user submissions. Microsoft Defender for Office 365 user submissions (Option A) is the correct capability because it allows users to report suspicious phishing messages directly from Outlook, which are then routed to the Microsoft 365 Defender portal for investigation and analysis. This feature integrates with the built-in Report Message or Report Phishing add-ins, enabling security teams to review and act on user-reported threats within the unified security operations framework.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 12

An organization uses Microsoft 365 and wants to implement a retention policy for all Exchange Online mailboxes that automatically deletes emails older than 7 years, except for emails from the legal department which must be kept for 10 years. What should the administrator configure?

Accepted Answer

Create two retention policies: one for all mailboxes with 7-year retention, and another for the legal department with 10-year retention using adaptive scopes.. Microsoft 365 retention policies can be scoped using adaptive scopes to apply different retention settings to different groups of users. By creating two policies—one with a 7-year deletion rule for all mailboxes and another with a 10-year deletion rule for the legal department—the administrator meets the requirement without conflicting settings. Adaptive scopes allow dynamic membership based on attributes like department, ensuring the legal department's emails are kept longer while others are deleted after 7 years.

Answer

Create a single retention policy with 7-year retention and apply preservation lock.

Answer

Configure retention tags in Exchange Online for each mailbox.

Answer

Place the legal department mailboxes on litigation hold and set a 7-year retention for others.

Question 13

A company wants to provide employees with a personal cloud storage solution that syncs files across devices and allows sharing with external partners. Which Microsoft 365 service should they use?

Accepted Answer

OneDrive for Business. OneDrive for Business provides personal cloud storage that syncs files across devices via the OneDrive sync client and enables secure sharing with external partners through granular permission controls. This directly meets the requirement for individual file storage, cross-device synchronization, and external sharing.

Answer

Exchange Online

Answer

Microsoft Teams

Answer

SharePoint Online

Question 14

An administrator is reviewing a request from users who need to detect risky users and suspicious sign-ins. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection is the correct choice because it is specifically designed to detect risky users and suspicious sign-ins by analyzing signals such as leaked credentials, anonymous IP addresses, and atypical travel patterns. It uses risk-based conditional access policies to automatically block or require multi-factor authentication for high-risk sign-ins, directly addressing the administrator's requirement.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 15

An administrator needs to restrict access to Microsoft 365 admin centers based on user location. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to enforce policies that grant or block access to Microsoft 365 admin centers based on conditions such as user location (IP address ranges or countries). By configuring a Conditional Access policy with a location condition, you can restrict access to sensitive admin portals like the Microsoft 365 admin center or Exchange admin center to trusted networks only.

Answer

Identity Protection

Answer

Entra ID Governance

Answer

Privileged Identity Management (PIM)