MS-900 Practice Test 39 — 15 Questions

Question 1

A compliance officer needs to automatically detect when an employee attempts to send an email containing a social security number (SSN) to an external recipient. The solution should block the email from being sent and notify the employee with a policy tip. Which Microsoft Purview solution should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive information (such as social security numbers) in emails and other data in transit. When a DLP policy is configured with a rule that matches the SSN condition and an action to block the message, it automatically prevents the email from being sent and displays a policy tip to the user, notifying them of the violation. This aligns directly with the requirement to both block the email and provide real-time user notification.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 2

While preparing a Microsoft 365 adoption plan, a consultant is asked to add and remove capacity quickly when demand changes. Cloud concept or benefit best matches this requirement?

Accepted Answer

Rapid elasticity. Rapid elasticity is a core cloud computing concept defined by NIST (SP 800-145) that allows resources to be provisioned and released elastically, often automatically, to scale rapidly outward and inward commensurate with demand. In Microsoft 365, this means the consultant can quickly add or remove user licenses, storage, or service capacity via the admin center or PowerShell without manual hardware provisioning, directly matching the requirement to adjust capacity on demand.

Answer

Microsoft Planner

Answer

Data Loss Prevention (DLP)

Answer

Sensitivity labels

Question 3

A healthcare organization must keep sensitive patient data on-premises due to regulatory compliance, but wants to use cloud services for other applications like customer relationship management and collaboration. Which cloud deployment model best meets this requirement?

Accepted Answer

Hybrid cloud. The hybrid cloud model is correct because it allows the healthcare organization to keep sensitive patient data on-premises (private cloud) for regulatory compliance (e.g., HIPAA), while leveraging public cloud services for customer relationship management and collaboration tools like Microsoft Dynamics 365 and Microsoft 365. This deployment model provides a unified environment where workloads can be distributed across on-premises and cloud infrastructure, ensuring data sovereignty and compliance without sacrificing scalability or cost efficiency.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 4

A company uses Microsoft SharePoint Online for intranet and wants to display important company announcements on the home page. Which SharePoint feature should they use?

Accepted Answer

News posts. News posts are the correct feature because they are specifically designed to display timely, engaging announcements on a SharePoint intranet home page. They support rich formatting, images, and web parts that surface news content prominently, making them ideal for company-wide communications. Unlike other options, News posts are optimized for visibility and user engagement on the home page.

Answer

Pages

Answer

Document libraries

Answer

Lists

Question 5

A department head asks which Microsoft 365 option should be used to search, review, and export content for a legal investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery is the correct choice because it is the dedicated Microsoft 365 compliance solution for searching, reviewing, and exporting content in legal investigations. It provides advanced search capabilities across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams, and supports legal hold, review sets, and export workflows to meet eDiscovery requirements.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 6

A financial services company uses a public cloud provider for its development and testing environments, but keeps its production data and applications on-premises due to strict regulatory requirements. Which cloud deployment model is the company using?

Accepted Answer

Hybrid cloud. The company uses a hybrid cloud model because it combines on-premises infrastructure (private cloud) for production workloads with a public cloud provider for development and testing. This allows the organization to meet strict regulatory requirements for data residency and security while leveraging the scalability and cost benefits of the public cloud for non-sensitive workloads.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 7

A legal firm needs to send a confidential document to a client via email. The firm requires that the client cannot forward or print the email and that the email expires after seven days. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (A) is the correct solution because it allows the legal firm to apply usage restrictions such as preventing forwarding and printing, and to set an expiration period of seven days on the email. This is achieved through Azure Rights Management (Azure RMS) templates that enforce these controls directly on the encrypted message, ensuring the client cannot bypass the restrictions.

Answer

Data Loss Prevention (DLP) policies

Answer

Sensitivity labels

Answer

eDiscovery (Premium)

Question 8

A service owner is comparing Microsoft 365 capabilities and needs to prevent communication and collaboration between two business groups. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Information Barriers. Information Barriers (IB) in Microsoft 365 are specifically designed to prevent communication and collaboration between defined user groups, such as two business groups that must not interact. IB policies use segment-based rules to block chat, email, and file sharing across groups, enforced at the Exchange Online, Teams, and SharePoint levels. This directly meets the service owner's requirement to isolate groups, unlike the other options which are general-purpose tools without such isolation capabilities.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 9

A security administrator needs to ensure that all guest users who access Microsoft Teams are required to accept a terms of use agreement before accessing any company resources. Which Microsoft 365 identity protection feature should they configure?

Accepted Answer

Terms of Use in Microsoft Entra ID. Microsoft Entra ID Terms of Use is the specific feature designed to present a terms-of-use agreement to users before they can access resources. When combined with a Conditional Access policy that targets guest users and requires acceptance of the terms, it ensures that guests must accept the agreement before accessing Microsoft Teams or any other company resource.

Answer

Conditional Access policy with session control

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management

Question 10

Your company has 10,000 users across multiple regions and uses Microsoft 365 E5. You need to ensure that all users have access to Microsoft Copilot for Microsoft 365 to boost productivity. However, due to licensing costs, management wants to minimize expenses by only assigning Copilot licenses to users who will actively use it. They also want to track usage to make informed renewal decisions. What should you do?

Accepted Answer

Assign Copilot licenses to a pilot group and use Microsoft 365 usage reports to identify active users before expanding.. It aligns with the management's goal of minimizing costs by first assigning Copilot licenses to a pilot group, then using Microsoft 365 usage reports (which track Copilot-specific metrics like active users, sessions, and feature adoption) to identify active users before expanding license assignment. This approach ensures only engaged users receive licenses, optimizing spend while providing data for renewal decisions.

Answer

Disable Copilot by default and allow users to request it via a helpdesk ticket.

Answer

Assign Copilot licenses to all users via group-based licensing in Microsoft Entra ID.

Answer

Use Power Automate to automatically assign Copilot licenses to users who send more than 50 emails per day.

Question 11

Refer to the exhibit. The JSON shows a device compliance policy assignment in Microsoft Intune. Based on the exhibit, what is the current compliance status of the devices in the target group?

Accepted Answer

Not compliant, because the encryption setting is not compliant. The exhibit shows a device compliance policy in Microsoft Intune with two settings: 'require device encryption' set to 'Required' and 'minimum password length' set to '6'. The compliance status for the target group is 'Not compliant, because the encryption setting is not compliant'. This is because the JSON indicates that the encryption requirement is not being met by the devices in the group, likely due to BitLocker or device encryption not being enabled. The password setting alone does not override the encryption non-compliance, as all required settings must be satisfied for a device to be marked compliant.

Answer

Not compliant, only because the password setting is missing

Answer

Compliant, because both settings are compliant

Answer

Compliant, because the password setting is compliant

Question 12

You have the above Microsoft Purview DLP policy JSON. What will this policy do?

Accepted Answer

Block external sharing of documents labeled Confidential. The JSON policy defines a DLP rule that blocks external sharing of documents labeled 'Confidential'. The 'Actions' section includes 'BlockExternalSharing', which prevents users from sharing these documents with external recipients via SharePoint, OneDrive, or Teams. The 'Condition' specifies that the policy applies only to content with the 'Confidential' sensitivity label, ensuring internal sharing remains unaffected.

Answer

Block internal sharing of documents labeled Confidential

Answer

Alert when Confidential documents are shared externally

Answer

Apply encryption to documents labeled Confidential when shared externally

Question 13

A help desk lead is documenting the correct Microsoft 365 approach to increase from 100 to 2,000 users without buying new mail servers. Cloud concept or benefit best matches this requirement?

Accepted Answer

Scalability. Scalability is the correct answer because it refers to the ability of a cloud service like Microsoft 365 to dynamically allocate resources to accommodate growth from 100 to 2,000 users without requiring the purchase or provisioning of additional on-premises mail servers. Microsoft 365's multi-tenant architecture and elastic infrastructure automatically handle user load increases, making scalability the cloud concept that directly matches this requirement.

Answer

Data Loss Prevention (DLP)

Answer

Sensitivity labels

Answer

Microsoft Planner

Question 14

Which THREE capabilities are provided by Microsoft Purview Information Protection? (Choose three.)

Accepted Answer

Auto-classify content based on sensitive data types. Microsoft Purview Information Protection provides auto-classification of content by detecting sensitive data types (e.g., credit card or national ID patterns) through trainable classifiers and sensitive information types, which justifies option A. It also lets organizations apply sensitivity labels to documents and emails across Microsoft 365 apps, making option B correct. Those same sensitivity labels can enforce encryption and access restrictions (e.g., via Azure Rights Management), so option C is correct. Option D is not a core Information Protection capability; blocking email sharing of sensitive data is handled by Data Loss Prevention (DLP) policies, a related but distinct workload. Option E is also incorrect here because retention policies for mailboxes belong to Microsoft Purview Data Lifecycle Management, not Information Protection.

Answer

Block sharing of sensitive data via email

Answer

Define retention policies for mailboxes

Question 15

Your organization wants to ensure that users can only access Microsoft 365 resources from compliant devices. Which security feature should you implement?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the policy engine that evaluates signals such as device compliance state, user risk, location, and application, and then enforces access decisions like requiring a compliant device or MFA. To restrict Microsoft 365 access to compliant devices, you create a Conditional Access policy that requires the device to be marked compliant (a signal Intune provides). Conditional Access is the enforcement point; Intune supplies the compliance signal.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune