MS-900 Practice Test 4 — 25 Questions

Question 1

A compliance officer needs to identify users who are at risk of leaking sensitive data based on their activities such as copying files to USB drives or emailing content outside the organization. The solution must also allow reviewing the activities in a case-based workflow. Which Microsoft Purview solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is specifically designed to detect, investigate, and act on risky user activities that could lead to data leaks, such as copying files to USB drives or emailing sensitive content externally. It provides a case-based workflow for reviewing and managing these activities, aligning directly with the compliance officer's requirements.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview Communication Compliance

Question 2

A company has 10 users who need only Exchange Online mailboxes and Microsoft Teams. They do not need desktop versions of Office apps. What is the most cost-effective Microsoft 365 plan for this requirement?

Accepted Answer

Microsoft 365 Business Basic. Microsoft 365 Business Basic provides Exchange Online mailboxes and Microsoft Teams, along with web and mobile versions of Office apps, without including desktop Office installations. This makes it the most cost-effective plan for the 10 users who need only email and Teams, as it offers the required services at the lowest per-user price among the options.

Answer

Microsoft 365 Apps for Business

Answer

Microsoft 365 Business Standard

Answer

Office 365 E1

Question 3

A company is deploying a cloud solution where they have the ability to quickly scale up resources during peak demand and scale down during off-peak hours, paying only for what they use. They also need the provider to automatically manage the underlying platform, including patching the operating system. Which combination of cloud characteristics and service model best describes this scenario?

Accepted Answer

Elasticity and PaaS. The scenario describes elasticity (the ability to scale resources up and down automatically based on demand) and Platform as a Service (PaaS), where the provider manages the underlying platform, including OS patching. Elasticity is a key cloud characteristic that enables dynamic scaling, and PaaS abstracts infrastructure management, aligning perfectly with the requirement for automatic platform maintenance.

Answer

Scalability and IaaS

Answer

Rapid elasticity and SaaS

Answer

Measured service and PaaS

Question 4

A company uses a cloud provider that charges them based solely on the exact number of gigabytes of storage used and the number of virtual machine hours consumed. They can increase or decrease usage at any time without any upfront commitment. Which essential characteristic of cloud computing does this billing model demonstrate?

Accepted Answer

Measured service. The billing model charges based on exact gigabytes of storage used and virtual machine hours consumed, which directly aligns with the 'measured service' characteristic of cloud computing. Measured service means cloud providers meter and bill customers precisely for the resources they consume, often using a pay-as-you-go model. This allows the company to pay only for what they use without upfront commitments, as described in the scenario.

Answer

Rapid elasticity

Answer

Resource pooling

Answer

On-demand self-service

Question 5

A company wants to run a critical application that requires dedicated hardware to comply with regulatory isolation requirements. However, they want to avoid the upfront cost of building their own data center. Which cloud deployment model meets these needs?

Accepted Answer

Private cloud. A private cloud is the correct deployment model because it provides dedicated hardware and infrastructure for a single organization, ensuring regulatory isolation without requiring the company to build and maintain its own on-premises data center. In Azure, a private cloud can be implemented via Azure Stack Hub or Azure VMware Solution, which run in the customer's own environment or a dedicated hosted environment, meeting compliance needs while avoiding upfront capital expenditure.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 6

A compliance officer needs to automatically retain all SharePoint documents that contain a specific project code for exactly 5 years. The retention must be applied automatically when the document is uploaded, without any user interaction. Which Microsoft Purview feature should they configure?

Accepted Answer

Retention labels with an auto-apply policy. Retention labels with an auto-apply policy are the correct choice because they allow you to automatically assign a retention label to SharePoint documents based on specific conditions, such as the presence of a project code, and enforce a fixed retention period (e.g., 5 years) without any user interaction. This feature is designed for automated, policy-driven retention based on content properties or sensitive information types.

Answer

Data Loss Prevention (DLP) policy

Answer

Sensitivity labels

Answer

eDiscovery (Premium)

Question 7

A financial services firm uses a public cloud provider for its customer-facing web application, but stores sensitive client data on its own on-premises servers. A secure VPN connection is used to transfer anonymized data from the public cloud to the on-premises environment for processing. Which cloud deployment model does this describe?

Accepted Answer

Hybrid cloud. This scenario describes a hybrid cloud because it combines a public cloud provider for the customer-facing web application with an on-premises private cloud for sensitive client data, connected via a secure VPN. The hybrid cloud model enables organizations to leverage the scalability and cost-efficiency of public cloud resources while maintaining strict control over sensitive data in a private environment. The use of a VPN to transfer anonymized data between the two environments is a key characteristic of hybrid cloud architecture, as it ensures secure communication across the boundary.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 8

A company wants to move its IT infrastructure to the cloud but must keep all customer data within a specific geographic region due to data residency laws. They also want to avoid paying for large upfront hardware costs. Which cloud characteristic best supports this need?

Accepted Answer

Geographic distribution (regional data centers). Geographic distribution refers to cloud providers operating multiple data centers across different regions, enabling customers to choose a specific region to store data and comply with data residency laws. This characteristic directly addresses the requirement to keep customer data within a specific geographic region while avoiding upfront hardware costs, as the cloud provider owns and manages the infrastructure.

Answer

Elasticity

Answer

High availability

Answer

Self-service

Question 9

A company subscribes to a cloud service where they can provision virtual machines, choose the operating system, install any software, and manage all applications. The cloud provider is responsible for the underlying physical hardware and network infrastructure. Which cloud service model is being used?

Accepted Answer

Infrastructure as a Service (IaaS). This scenario describes Infrastructure as a Service (IaaS) because the customer provisions virtual machines, chooses the operating system, installs software, and manages applications, while the cloud provider is responsible for the underlying physical hardware and network infrastructure. In IaaS, the provider delivers virtualized computing resources over the internet, and the customer retains control over the OS, storage, and deployed applications, which matches the description exactly.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

On-premises

Question 10

A business wants to use a cloud solution where they can scale computing resources up or down automatically based on demand and only pay for what they use. The cloud provider manages the underlying hardware. Which two cloud characteristics are being described? (Choose two.)

Accepted Answer

Elasticity. Elasticity is correct because it describes the ability to automatically scale computing resources up or down based on demand, which is a key characteristic of cloud computing. The scenario explicitly states that resources scale automatically, which aligns with elasticity rather than just the ability to scale (scalability). Measured service is correct because the business pays only for what they use, which is the pay-per-use billing model enabled by metering resource consumption.

Answer

Scalability

Answer

High availability

Question 11

A healthcare organization stores patient records in SharePoint Online. They need to ensure that the data is encrypted at rest and in transit. Which statement is true regarding Microsoft 365 encryption?

Accepted Answer

Microsoft provides default encryption for data at rest and in transit.. Microsoft 365 provides default encryption for data at rest and in transit across all workloads, including SharePoint Online, Exchange Online, and OneDrive for Business. For data at rest, Microsoft uses BitLocker Drive Encryption and service-side encryption with per-file keys, while data in transit is secured using TLS 1.2+ and IPSec. This means the healthcare organization's patient records in SharePoint Online are automatically encrypted without any manual configuration.

Answer

Customers must enable encryption at rest manually for each workload.

Answer

Encryption only applies to Exchange Online, not SharePoint or OneDrive.

Answer

Encryption is optional and can be turned off if a customer chooses.

Question 12

A company with 100 Microsoft 365 E3 users needs to add cloud access security broker capabilities to monitor and control user access to SaaS applications and shadow IT. They want the most cost-effective add-on. What should they purchase?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into shadow IT, controls over user access to SaaS applications, and data protection policies. It is the most cost-effective add-on for this specific requirement because it can be licensed standalone without requiring higher-tier Microsoft 365 or Entra ID plans, and it directly addresses the need to monitor and control SaaS app usage.

Answer

Microsoft Defender for Microsoft 365 Plan 2

Answer

Microsoft Entra ID Premium P2

Answer

Microsoft 365 E5 Compliance

Question 13

Your organization has 500 users with Microsoft 365 E3 licenses. You want to add security features such as Microsoft Defender for Office 365 (Plan 1) and Microsoft Purview Information Protection. Which licensing approach should you recommend?

Accepted Answer

Upgrade all users to Microsoft 365 E5. Microsoft 365 E5 includes both Defender for Office 365 (Plan 1) and Purview Information Protection (formerly Azure Information Protection P2) natively, whereas E3 requires separate add-ons. Upgrading all users to E5 is the simplest and most cost-effective licensing approach when both security features are needed for all 500 users, as it avoids the complexity and potential per-user cost of stacking multiple add-on SKUs.

Answer

Keep E3 and add Microsoft 365 E5 Compliance add-on

Answer

Keep E3 and add Microsoft 365 E5 Security add-on

Answer

Keep E3 and use the Security & Compliance Center for E3

Question 14

During a Microsoft 365 planning workshop, host custom applications on virtual machines while managing the operating system. Cloud concept or benefit best matches this requirement?

Accepted Answer

Infrastructure as a Service (IaaS). Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, including virtual machines where you can host custom applications and have full control over the operating system. This matches the requirement because IaaS gives you the flexibility to manage the OS, install custom software, and configure the environment without worrying about the underlying physical hardware.

Answer

Platform as a Service (PaaS)

Answer

Hybrid cloud

Answer

Software as a Service (SaaS)

Question 15

A company uses a cloud service where they pay only for the compute hours their virtual machines run. They can increase or decrease the number of VMs instantly based on demand. Which two cloud computing characteristics are demonstrated? (Choose two.)

Accepted Answer

Rapid elasticity. B is correct because rapid elasticity allows the company to instantly increase or decrease the number of virtual machines based on demand, scaling resources up or down automatically. C is correct because measured service ensures that the company pays only for the compute hours their VMs run, with usage metered and billed accordingly.

Answer

On-demand self-service

Answer

Resource pooling

Question 16

A company needs to ensure that their cloud data and applications remain available even if an entire Azure region experiences an outage. They also want to minimize latency by hosting resources in multiple geographic locations. Which cloud concept addresses these requirements?

Accepted Answer

Geo-redundancy. Geo-redundancy (Option B) is correct because it specifically addresses the requirement for data and application availability during an entire Azure region outage by replicating resources across multiple geographically separated regions, such as Azure paired regions (e.g., East US and West US). This also minimizes latency by allowing traffic to be routed to the nearest available region, leveraging Azure Traffic Manager or Azure Front Door for global load balancing.

Answer

Scalability

Answer

Measured service

Answer

Resource pooling

Question 17

A compliance officer needs to automatically classify documents stored in SharePoint Online that contain personally identifiable information (PII) such as social security numbers. The classification must apply a sensitivity label that encrypts the document and restricts access to only employees in the Legal department. The process should run without any user interaction. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Information Protection with auto-labeling. Microsoft Purview Information Protection with auto-labeling can automatically detect PII (e.g., social security numbers) in documents stored in SharePoint Online and apply a sensitivity label that encrypts the content and restricts access to the Legal department. This process runs without user interaction, meeting the compliance officer's requirement for automatic classification and protection.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Insider Risk Management

Question 18

A small business with 10 users needs the fully installed desktop versions of Office apps (Word, Excel, PowerPoint), business-class email, and 1 TB of cloud storage per user. They do not require advanced security or compliance features. Which Microsoft 365 plan is the most cost-effective choice?

Accepted Answer

Microsoft 365 Business Standard. Microsoft 365 Business Standard is the most cost-effective plan for this small business because it includes the fully installed desktop versions of Office apps (Word, Excel, PowerPoint), business-class email (Exchange Online), and 1 TB of OneDrive cloud storage per user. It meets all stated requirements without the higher cost of E3 or the lack of desktop apps in Business Basic or Office 365 E1.

Answer

Microsoft 365 Business Basic

Answer

Microsoft 365 E3

Answer

Office 365 E1

Question 19

A security administrator needs to automatically restrict access to documents that contain 'PII' (personally identifiable information) so that only employees in the 'Data Privacy' security group can view them. Additionally, editing and printing of these documents must be disabled. Which combination of Microsoft Purview features should be used?

Accepted Answer

Sensitivity labels with auto-labeling and encryption that restricts permissions to the 'Data Privacy' group. Sensitivity labels in Microsoft Purview can be configured with auto-labeling to automatically detect and classify documents containing PII, and then apply encryption that restricts access to only the 'Data Privacy' security group. Additionally, the label can enforce usage rights such as 'View Only' to disable editing and printing, meeting all requirements.

Answer

Data Loss Prevention (DLP) policy with a block action

Answer

Retention policy with a restrict action

Answer

Privileged Identity Management (PIM)

Question 20

A tenant administrator is advising a department that wants to grant temporary, approved privileged administrator access. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time privileged access, allowing the tenant administrator to grant temporary, approved administrator roles with time-bound activation and approval workflows. PIM is part of Microsoft Entra ID Governance and directly addresses the requirement for temporary privileged access with oversight.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner