MS-900 Practice Test 40 — 15 Questions

Question 1

Refer to the exhibit. An administrator is configuring a new Azure subscription with this ARM template snippet for Microsoft Defender for Cloud. What will be the immediate result?

Accepted Answer

The subscription will be monitored for security issues and receive recommendations. Option C is correct. Enabling Microsoft Defender for Cloud on a subscription activates the basic (free) tier, which provides security assessments and recommendations. Option A is incorrect because there are multiple pricing tiers. Option B is incorrect because the free tier does not include the full suite of advanced protections. Option D is incorrect because manual configuration is not required for basic protection.

Answer

All virtual machines will be automatically onboarded to Microsoft Defender for Endpoint

Answer

The subscription will be protected by the highest security tier

Answer

No changes will occur until a security policy is manually created

Question 2

A company is migrating its on-premises workloads to Microsoft 365. The IT team wants to minimize latency for users in Europe while ensuring data residency requirements are met. Which cloud concept should the team consider?

Accepted Answer

Geography. Option B is correct because geography determines the data residency region. Option A is wrong because redundancy is about high availability, not latency or residency. Option C is wrong because multi-tenancy is a shared infrastructure model. Option D is wrong because hybrid deployment combines cloud and on-premises, not specifically addressing latency or residency.

Answer

Hybrid deployment

Answer

Redundancy

Answer

Multi-tenancy

Question 3

An organization uses Microsoft 365 E5 licenses. Users report that Microsoft 365 Apps for enterprise (e.g., Word, Excel) are slow to open. The IT team considers deploying a cloud-based solution to improve performance. Which cloud service model should they use?

Accepted Answer

Software as a Service (SaaS). Option D is correct because SaaS (Software as a Service) provides ready-to-use applications like Microsoft 365 Apps via the cloud, reducing local processing requirements. Option A is wrong because IaaS would require managing virtual machines and installing software. Option B is wrong because PaaS is for application development, not end-user apps. Option C is wrong because FaaS is for event-driven functions, not desktop applications.

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Question 4

Which TWO cloud deployment models allow an organization to run some workloads on-premises and some in the public cloud?

Accepted Answer

Community cloud. Options B and D are correct: hybrid cloud explicitly mixes on-premises and public cloud; community cloud is used by multiple organizations with shared concerns and can include on-premises resources. Option A (private cloud) is solely for one organization, typically on-premises or hosted. Option C (public cloud) is solely off-premises. Option E (multi-cloud) uses multiple public clouds but not necessarily on-premises.

Answer

Private cloud

Answer

Multi-cloud

Answer

Public cloud

Question 5

An administrator is assigned the Global Reader role in Microsoft Entra ID as shown in the exhibit. What can this administrator do?

Accepted Answer

View all user and group properties in the directory. Option A is correct. Global Reader has read-only access to all Azure AD configuration. Option B is wrong because Global Reader cannot create users. Option C is wrong because Global Reader cannot assign roles. Option D is wrong because the role does not include write permissions.

Answer

Reset user passwords

Answer

Assign administrative roles to other users

Answer

Create new users in the directory

Question 6

A company is deploying Microsoft 365 and wants to ensure that customer financial data remains within the European Union. Which Microsoft 365 feature should the administrator configure?

Accepted Answer

Configure Data Location settings in the Microsoft 365 admin center.. Option A is correct because Data Location (or data residency) is a Microsoft 365 feature that allows organizations to specify where their data is stored at rest, ensuring compliance with regional regulations like GDPR. Option B is incorrect because DLP prevents data loss but does not control storage location. Option C is incorrect because Conditional Access controls access, not storage. Option D is incorrect because sensitivity labels classify data but do not enforce storage location.

Answer

Apply sensitivity labels using Microsoft Purview.

Answer

Set up Conditional Access policies in Microsoft Entra ID.

Answer

Implement Data Loss Prevention (DLP) policies.

Question 7

Which TWO of the following are key benefits of using Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

It enables organizations to meet compliance requirements by applying protection.. Option A is correct because Information Protection helps classify and protect sensitive data. Option B is correct because it helps meet compliance requirements by applying protection. Option C is incorrect because it does not directly detect phishing. Option D is incorrect because Information Protection is not a backup solution. Option E is incorrect because it does not manage device compliance.

Answer

It automatically detects and blocks phishing emails.

Answer

It manages device compliance with Conditional Access.

Answer

It provides backup and recovery for SharePoint Online.

Question 8

You are responsible for securing identities in Microsoft 365. Which THREE actions should you take to improve the security posture of user accounts? (Choose three.)

Accepted Answer

Enable multifactor authentication (MFA) for all users. Options A, B, and E are correct. Enforcing MFA, enabling self-service password reset (SSPR), and using Conditional Access policies are key identity security measures. Requiring strong passwords (C) is basic but less effective than MFA. Disabling legacy authentication (D) is also a good practice, but the correct three are A, B, and E.

Answer

Require complex passwords with a minimum length of 16 characters

Answer

Disable legacy authentication protocols

Question 9

Your organization uses Microsoft 365 E5 and wants to automatically classify emails containing credit card numbers as 'Sensitive' and apply encryption when sent externally. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Option D is correct because Microsoft Purview Data Loss Prevention (DLP) can detect sensitive data like credit card numbers and automatically apply actions such as encryption. Option A is wrong because Sensitivity labels are manually applied or auto-classified, but DLP handles the automatic protection. Option B is wrong because Retention policies are for retention, not classification. Option C is wrong because Information Protection policies include sensitivity labels, but the automatic encryption action is typically configured via DLP.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 10

Your company uses Microsoft 365 E5 and has enabled Microsoft Purview Audit (Premium). The security team needs to investigate a potential data breach by searching for all activities related to a specific user in the last 90 days. Which tool should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Option B is correct because Microsoft Purview eDiscovery (Premium) allows searching across content locations for specific users and time frames. Option A is wrong because Audit (Premium) provides audit logs but not a consolidated search across all data. Option C is wrong because Content Search is a more basic tool. Option D is wrong because Compliance Manager is for assessing compliance posture.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Content Search

Answer

Microsoft Purview Audit (Premium) log search

Question 11

Which TWO of the following are features of Microsoft Purview Information Protection?

Accepted Answer

Sensitivity labels. Information Protection includes sensitivity labels and encryption. AIP scanner is for on-premises, DLP is separate, and eDiscovery is also separate.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery (Premium)

Answer

Azure Information Protection (AIP) scanner

Question 12

Your organization is implementing Microsoft Entra ID (formerly Azure AD) for identity management. Users report that they are prompted for multifactor authentication (MFA) every time they sign in, even from trusted devices. What should you configure to reduce MFA prompts while maintaining security?

Accepted Answer

Modify the Conditional Access policy to set session control 'Sign-in frequency' to a longer period.. Option C is correct because Conditional Access policies allow setting session persistence to remember MFA on trusted devices. Option A is incorrect because MFA frequency is not set in Password reset. Option B is incorrect because Named locations are for IP-based trust, not device trust. Option D is incorrect because Privileged Identity Management (PIM) is for just-in-time admin access.

Answer

Define trusted IP ranges in Named locations.

Answer

Configure self-service password reset (SSPR) to require MFA less often.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to grant MFA exemption.

Question 13

Which THREE conditions must be met for a Microsoft 365 tenant to use Customer Lockbox?

Accepted Answer

An authorized admin must submit a support request to Microsoft.. Options A, C, and E are correct: Customer Lockbox requires an E5 license, the admin must initiate a support request, and it applies only when Microsoft engineers need access. Option B is incorrect because Customer Lockbox is not available in E3. Option D is incorrect because it is for Microsoft engineer access, not internal admin access.

Answer

The tenant must be on a Microsoft 365 E3 plan.

Answer

Internal administrators must request access to user mailboxes.

Question 14

Refer to the exhibit. A Microsoft 365 administrator runs the PowerShell script against Microsoft Entra ID. The script outputs several enabled Conditional Access policies. However, users report they are not prompted for MFA even though there is an enabled policy that should require MFA for all users. What is the most likely reason?

Accepted Answer

The policy is set to 'report-only' mode.. Option D is correct because the script checks if the policy state is enabled, but does not check if the policy is in 'report-only' mode. A policy can be enabled but set to report-only, which does not enforce MFA. Option A is wrong because the script checks all enabled policies. Option B is wrong because the script is used for policy listing, not enforcement. Option C is wrong because the script does not modify policies.

Answer

The script is not executed with administrative privileges.

Answer

The script does not run against all policies.

Answer

The script disables the MFA policy inadvertently.

Question 15

Which TWO of the following are examples of Microsoft's commitments to data privacy as outlined in the Microsoft Privacy Statement and related agreements? (Choose two.)

Accepted Answer

Customers can access and export their data.. Option A is correct: Microsoft does not use customer data for advertising. Option C is correct: Microsoft provides data portability. Option B is wrong because Microsoft does share data with third parties for marketing. Option D is wrong because Microsoft does not use customer data for AI training without consent. Option E is wrong because Microsoft does not allow third-party access without customer consent.

Answer

Microsoft uses customer data to train AI models by default.

Answer

Microsoft may share customer data with third parties for marketing purposes.

Answer

Microsoft allows third parties to access customer data without consent.

MS-900 Practice Test 40 — 15 Questions

Exhibit

MS-900 Practice Test 40 — 15 Questions

Exhibit