MS-900 Practice Test 41 — 15 Questions

Question 1

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel to investigate a user's deleted files. The query returns no results even though the user has deleted files. Which of the following is the most likely reason?

Accepted Answer

The Microsoft 365 connector is not configured in Sentinel.. Option C is correct because Sentinel queries the workspace's own AuditLogs table, which may not contain Microsoft 365 audit logs unless the Microsoft 365 connector is configured. Option A is wrong because the query does not filter by Result. Option B is wrong because the query uses correct syntax. Option D is wrong because the query is not incorrectly formatted.

Answer

The query filters by Result column which doesn't exist.

Answer

The query should use 'where Operation == "FileDeleted"' but the operation is 'DeleteFile'.

Answer

The UserId field should be replaced with UserPrincipalName.

Question 2

A multinational corporation needs to restrict access to Microsoft 365 services based on user location and device state. They have offices in countries with strict data sovereignty laws. Which combination of Microsoft Entra ID features should they use to enforce these policies?

Accepted Answer

Conditional Access with location policies and device compliance. Conditional Access policies can be configured to block or allow access based on location and device state. Option D is correct because it combines both location and device compliance. Option A misses device state, Option B misses location, Option C is not a specific feature, and Option E is for identity protection, not control.

Answer

Microsoft Entra ID Governance

Answer

Identity Protection and Privileged Identity Management

Answer

Conditional Access with device compliance policies only

Answer

Conditional Access with location policies only

Question 3

You have the above Microsoft Purview DLP policy JSON. What will this policy do?

Accepted Answer

Block external sharing of documents labeled Confidential. The policy blocks access when a document with sensitivity label 'Confidential' is shared externally. Option B is correct. It does not block internal sharing, apply encryption, or trigger alert.

Answer

Block internal sharing of documents labeled Confidential

Answer

Alert when Confidential documents are shared externally

Answer

Apply encryption to documents labeled Confidential when shared externally

Question 4

A company is adopting Microsoft 365 and wants to ensure they can investigate security incidents across email, endpoints, and identities in a unified console. Which Microsoft 365 workload should they use?

Accepted Answer

Microsoft Defender XDR. Option B is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides a unified incident investigation experience across domains. Option A is incorrect because Microsoft Sentinel is a SIEM that aggregates logs but is not the unified console in Microsoft 365. Option C is incorrect because Microsoft Purview is for compliance and governance, not security investigation. Option D is incorrect because Microsoft Intune is for device management.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Purview Compliance Portal

Question 5

Your company wants to ensure that only managed and compliant devices can access Microsoft 365 resources. Which Microsoft 365 security feature enforces conditional access based on device compliance?

Accepted Answer

Microsoft Intune with Conditional Access in Microsoft Entra ID. Microsoft Intune manages device compliance policies, and when integrated with Conditional Access in Microsoft Entra ID, it enforces access based on compliance. Option C is the correct pairing. Options A, B, and D are not the primary tools for device compliance enforcement.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 6

An organization needs to ensure that all Microsoft 365 data is encrypted at rest and in transit. Which of the following is a built-in encryption mechanism in Microsoft 365?

Accepted Answer

BitLocker Drive Encryption. Option D is correct because Microsoft 365 uses BitLocker Drive Encryption for data at rest in datacenters. Option A is wrong because third-party key management is not built-in. Option B is wrong because Azure Information Protection is a separate solution. Option C is wrong because Office 365 Message Encryption is for email, not all data.

Answer

Customer-managed keys (CMK) using Azure Key Vault

Answer

Office 365 Message Encryption

Answer

Azure Information Protection

Question 7

Which THREE of the following are security features included in Microsoft 365 Business Premium? (Choose three.)

Accepted Answer

Microsoft Entra ID Plan 1. Option A is correct: Microsoft Defender for Business is included. Option B is correct: Microsoft Entra ID Plan 1 is included. Option D is correct: Microsoft Purview DLP is included. Option C is wrong because Microsoft Sentinel is not included in Business Premium. Option E is wrong because Microsoft Defender for Cloud Apps (Cloud App Security) is not included as a full feature; some capabilities are included but not the full product.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 8

A user reports receiving a phishing email that bypassed Exchange Online Protection (EOP). You need to investigate the threat and automate a response across email, endpoints, and identities. Which Microsoft 365 security solution should you use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (formerly Microsoft 365 Defender) provides unified detection and automated response across email, endpoints, and identities. Option C is correct. Option A (Defender for Office 365) focuses only on email, Option B (Defender for Endpoint) only on endpoints, and Option D (Sentinel) is a SIEM that could be used but is not the primary automated response tool for this scenario.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 9

An organization uses Microsoft 365 Copilot for Microsoft 365. The security team wants to ensure that Copilot responses are based only on data that users already have permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. The principle of least privilege ensures users only access data they need. In Copilot, responses are grounded in the user's existing permissions. Option C is correct. Option A (Zero Trust) is broader, Option B (Defense in depth) is layered security, and Option D (Privileged Access) is for elevated roles.

Answer

Defense in depth

Answer

Privileged Identity Management

Answer

Zero Trust

Question 10

Your organization is deploying Microsoft 365 for a healthcare company that must comply with HIPAA. Which Microsoft 365 compliance feature should you use to prevent sensitive patient data from being shared externally via email?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies are designed to detect and prevent sharing of sensitive data such as health information. Options A and B are not directly about preventing data leakage, and Option D is about encryption but not policy-based prevention.

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 11

Your company wants to run a phishing simulation to test employee awareness. Which Microsoft 365 tool can you use to create and launch a simulated phishing campaign?

Accepted Answer

Microsoft Defender for Office 365 Attack Simulation Training. Microsoft Defender for Office 365 includes Attack Simulation Training, which allows you to create and launch simulated phishing attacks. Option A is correct. Option B (Defender for Cloud Apps) is a CASB, Option C (Microsoft Intune) is for device management, and Option D (Microsoft Purview) is for compliance.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Purview Compliance Manager

Question 12

You run the above PowerShell cmdlets against Microsoft Entra ID. What is the output?

Accepted Answer

List of Microsoft 365 group names the user is a member of. The cmdlets retrieve the user's group memberships and filter for groups, outputting display names. Option C is correct. It does not show roles, licenses, or devices.

Answer

List of roles assigned to the user

Answer

List of devices enrolled by the user

Answer

List of licenses assigned to the user

Question 13

Which TWO of the following are requirements for implementing Microsoft Purview Customer Key? (Choose two.)

Accepted Answer

An Azure subscription with Azure Key Vault. Option B is correct: Customer Key requires a Microsoft 365 E5 license. Option D is correct: Customer Key uses Azure Key Vault to store keys. Option A is wrong because Customer Key does not require an on-premises HSM; it uses Azure Key Vault. Option C is wrong because Customer Key does not require Entra ID P2; E5 license suffices. Option E is wrong because Customer Key does not require Microsoft Defender for Cloud Apps.

Answer

Microsoft Entra ID Premium P2 licenses

Answer

Microsoft Defender for Cloud Apps

Answer

An on-premises Hardware Security Module (HSM)

Question 14

Your organization uses Microsoft Purview to manage data governance. A data owner needs to classify sensitive data across SharePoint, OneDrive, and Exchange automatically based on content patterns. Which Microsoft Purview feature should they use?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling policies can automatically classify data based on patterns. Option B is correct. Option A (DLP) prevents sharing but does not classify. Option C (eDiscovery) is for search and legal hold. Option D (Audit) is for logging.

Answer

eDiscovery (Premium)

Answer

Data Loss Prevention (DLP) policies

Answer

Audit (Standard)

Question 15

Which TWO are features of Microsoft Entra ID? (Choose two.)

Accepted Answer

Identity and access management. Option A is correct because Microsoft Entra ID provides identity and access management. Option B is correct because it supports Multi-Factor Authentication. Option C is incorrect because DLP is a Purview feature. Option D is incorrect because device management is Intune. Option E is incorrect because sensitivity labels are Purview.

Answer

Mobile device management

Answer

Data Loss Prevention policies

Answer

Sensitivity labels

MS-900 Practice Test 41 — 15 Questions

Exhibit

MS-900 Practice Test 41 — 15 Questions

Exhibit