MS-900 Practice Test 31 — 15 Questions

Question 1

A compliance officer needs to set up a policy that automatically monitors and detects activities related to accessing sensitive data from outside the corporate network. When a user from a foreign country accesses a confidential file, the policy should trigger an alert and require additional authentication. Which combination of Microsoft 365 solutions achieves this?

Accepted Answer

Microsoft Purview Data Loss Prevention and Conditional Access. Microsoft Purview Data Loss Prevention (DLP) monitors and detects sensitive data access from outside the corporate network, while Conditional Access enforces additional authentication (e.g., MFA) when such access is detected. Together, they meet the requirement for automatic alerting and step-up authentication based on location and data sensitivity.

Answer

Microsoft Purview Audit (Standard) and Microsoft Entra ID Identity Protection

Answer

Microsoft Purview Insider Risk Management and Microsoft Cloud App Security

Answer

Microsoft Purview eDiscovery and Privileged Identity Management

Question 2

A healthcare provider must ensure that patient health information (PHI) is not accidentally shared outside the organization. They want to automatically detect if an email contains PHI (such as diagnosis codes) and block it from being sent externally. Additionally, the sender should receive a notification explaining the block. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive information—such as patient health information (PHI) with diagnosis codes—in emails and automatically block external transmission while sending a notification to the sender. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) and rules to enforce actions like blocking and policy tips.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Audit

Question 3

A non-profit organization with 250 employees is considering Microsoft 365. They want the most cost-effective plan that includes business-class email, web and mobile versions of Office apps, and 1 TB of cloud storage per user. Which subscription should they choose?

Accepted Answer

Microsoft 365 Business Basic. Microsoft 365 Business Basic is the most cost-effective plan that includes business-class email (Exchange Online), web and mobile versions of Office apps, and 1 TB of OneDrive cloud storage per user. It meets all stated requirements without the higher cost of desktop app licenses or advanced security features found in other plans.

Answer

Microsoft 365 Business Premium

Answer

Microsoft 365 E1

Answer

Microsoft 365 Apps for Business

Question 4

A help desk lead is documenting the correct Microsoft 365 approach to keep a workload on-premises while using Microsoft cloud collaboration services. Cloud concept or benefit best matches this requirement?

Accepted Answer

Hybrid cloud. A hybrid cloud model is the correct approach because it allows an organization to keep a specific workload on-premises while leveraging Microsoft cloud collaboration services (such as Exchange Online, SharePoint Online, or Teams). This is achieved through integration technologies like Azure AD Connect for identity synchronization and Exchange Hybrid Configuration Wizard for mail routing, enabling a seamless coexistence between on-premises and cloud environments.

Answer

Sensitivity labels

Answer

Microsoft Planner

Answer

Data Loss Prevention (DLP)

Question 5

A company is expanding globally and needs to meet data residency and compliance requirements in multiple regions. Which three Microsoft 365 compliance and privacy features should they consider? (Choose three.)

Accepted Answer

Customer Lockbox. Data Loss Prevention (DLP) policies help organizations identify, monitor, and protect sensitive data across Microsoft 365 services, ensuring compliance with regional data residency requirements by preventing unauthorized sharing or leakage. Compliance Manager provides a centralized dashboard to assess compliance posture against regulations like GDPR, ISO 27001, and local data residency laws, offering actionable recommendations. Customer Lockbox ensures that Microsoft support engineers cannot access customer data without explicit approval, addressing privacy and data sovereignty concerns in multi-region deployments.

Answer

Exchange Online archival mailboxes

Answer

Microsoft 365 Copilot

Answer

Azure Active Directory (Azure AD) Connect

Question 6

A healthcare organization stores patient records in SharePoint Online. They need to ensure that the data is encrypted at rest and in transit. Which statement is true regarding Microsoft 365 encryption?

Accepted Answer

Microsoft provides default encryption for data at rest and in transit.. Microsoft 365 provides default encryption for data at rest and in transit across all workloads, including SharePoint Online, Exchange Online, and OneDrive for Business. For data at rest, Microsoft uses BitLocker Drive Encryption and service-side encryption with per-file keys, while data in transit is secured using TLS 1.2+ and IPSec. This means the healthcare organization's patient records in SharePoint Online are automatically encrypted without any manual configuration.

Answer

Customers must enable encryption at rest manually for each workload.

Answer

Encryption only applies to Exchange Online, not SharePoint or OneDrive.

Answer

Encryption is optional and can be turned off if a customer chooses.

Question 7

A marketing team needs to temporarily increase their cloud storage capacity from 5 TB to 10 TB for a product launch. They can perform this change themselves through a web portal without contacting the cloud provider. Which cloud characteristic does this scenario demonstrate?

Accepted Answer

On-demand self-service. This scenario demonstrates on-demand self-service because the marketing team can provision and manage their own cloud storage capacity increase from 5 TB to 10 TB through a web portal without any human interaction with the cloud provider. This is a core NIST-defined characteristic where users can unilaterally provision computing resources as needed automatically, requiring no service provider intervention.

Answer

Rapid elasticity

Answer

Measured service

Answer

Resource pooling

Question 8

A help desk lead is documenting the correct Microsoft 365 approach to review upcoming Microsoft 365 changes and recommended admin actions. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Message center. The Message center in the Microsoft 365 admin center is the dedicated hub for reviewing upcoming changes, new features, and recommended admin actions. It provides official communications from Microsoft about service updates, deprecations, and required administrative steps, making it the correct resource for a help desk lead documenting change management.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Whiteboard

Question 9

During a Microsoft 365 planning workshop, understand which security tasks Microsoft handles and which remain with the customer. Cloud concept or benefit best matches this requirement?

Accepted Answer

Shared responsibility model. The shared responsibility model defines which security tasks are managed by Microsoft (e.g., physical security, hypervisor patching) and which remain with the customer (e.g., user access, data classification). This directly matches the requirement to understand task ownership during a planning workshop. Options like Microsoft Planner, DLP, and sensitivity labels are specific features, not the overarching cloud concept that clarifies responsibility boundaries.

Answer

Microsoft Planner

Answer

Data Loss Prevention (DLP)

Answer

Sensitivity labels

Question 10

A department head asks which Microsoft 365 option should be used to provide a cloud identity platform for Microsoft 365 and approved SaaS applications. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) is the correct choice because it is the cloud-based identity and access management service that provides authentication, single sign-on (SSO), and conditional access for Microsoft 365 and thousands of pre-integrated SaaS applications. It acts as the identity platform, managing user identities and controlling access to resources, which directly aligns with the department head's requirement for a cloud identity platform.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 11

During requirements gathering, an IT manager says the organization must view service health and create support requests without broad user management. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Service Support Administrator. The Service Support Administrator role in Microsoft 365 is specifically designed to allow users to view service health and create support requests without granting broader user management permissions. This aligns directly with the IT manager's requirement for limited administrative access focused on support functions, making it the most relevant concept among the options.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Whiteboard

Question 12

A company's CFO is pleased that they only pay for the compute and storage resources consumed each month, with no upfront hardware costs. This billing model is a direct result of which cloud computing characteristic?

Accepted Answer

Measured service. The CFO's observation that the company only pays for consumed compute and storage resources with no upfront hardware costs directly reflects the 'measured service' characteristic of cloud computing. Measured service means cloud providers meter resource usage (e.g., CPU hours, GB-months of storage) and bill based on actual consumption, typically using a pay-as-you-go model. This eliminates the need for capital expenditure on hardware, as costs are operational and tied to usage metrics.

Answer

On-demand self-service

Answer

Broad network access

Answer

Resource pooling

Question 13

During requirements gathering, an IT manager says the organization must review employee messages for harassment or regulatory policy violations. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Communication Compliance. Communication Compliance in Microsoft 365 is the correct capability because it is specifically designed to detect, capture, and act on inappropriate messages—such as harassment or regulatory policy violations—across email, Microsoft Teams, and third-party communications. It uses configurable policies with built-in classifiers for harassment, threats, and regulatory compliance, enabling automated review and remediation. This directly addresses the IT manager's requirement to monitor employee messages for policy violations.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 14

A compliance administrator needs to assess compliance posture against standards and improvement actions. Which Microsoft 365 capability is the best fit? The design must avoid adding custom operational scripts.

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct choice because it provides a built-in, no-code solution for assessing compliance posture against standards (e.g., ISO 27001, NIST) and generates actionable improvement actions. It eliminates the need for custom operational scripts by offering pre-configured assessments and automated tracking of controls.

Answer

OneDrive sync client

Answer

Microsoft Teams live events

Answer

Microsoft Bookings

Question 15

Match each Microsoft 365 license type to its typical audience.