MS-900 Practice Test 44 — 15 Questions

Question 1

A user accidentally shared a file containing credit card numbers with a partner organization. You need to prevent similar incidents and detect when such data is shared externally. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft 365 Data Loss Prevention (DLP) policy. Microsoft 365 Data Loss Prevention (DLP) policies are specifically designed to identify sensitive information such as credit card numbers using sensitive information types and to prevent or detect when that data is shared externally. DLP can block sharing, generate alerts, and provide policy tips to users, directly addressing both prevention and detection requirements.

Answer

Azure Information Protection (AIP)

Answer

Microsoft Purview eDiscovery

Answer

Information Rights Management (IRM)

Question 2

A compliance officer needs to automatically label and encrypt documents that contain personally identifiable information (PII) when they are saved in SharePoint. The labeling should happen without manual user intervention. Which Microsoft Purview feature should they configure?

Accepted Answer

Sensitivity labels (auto-labeling policy). Sensitivity labels with auto-labeling policies in Microsoft Purview can automatically detect and classify documents containing PII when they are saved in SharePoint, and apply encryption based on the label configuration. This meets the requirement of automatic, user-intervention-free labeling and encryption by scanning content for sensitive data types (e.g., Social Security numbers) and applying the label at rest.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention labels

Answer

Communication Compliance

Question 3

A company with 200 employees needs to deploy Microsoft 365 Apps for Enterprise. They want to pay monthly and have no annual commitment. Which licensing program should they use?

Accepted Answer

Microsoft 365 Business Premium. Microsoft 365 Business Premium is the correct choice because it includes Microsoft 365 Apps for Enterprise (e.g., Word, Excel, PowerPoint) and is available as a monthly subscription with no annual commitment for organizations with up to 300 users. This aligns with the company's requirement of 200 employees and the desire for flexible, month-to-month billing.

Answer

Microsoft 365 Enterprise Agreement

Answer

Microsoft 365 Business Basic

Answer

Microsoft 365 E3

Question 4

Your organization, Contoso Ltd., uses Microsoft 365 E5 licenses and has 10,000 users. The company is planning to deploy Microsoft Copilot for Microsoft 365 to all users. The IT department has identified the following requirements: 1. Users must be able to use Copilot across Microsoft Teams, Word, Excel, PowerPoint, and Outlook. 2. Copilot must be able to access user data from Exchange Online, SharePoint Online, and Microsoft Graph. 3. The deployment must comply with the company's data residency policy, which requires that all data processed by Copilot remains within the European Union (EU). 4. The company wants to use a phased rollout, starting with a pilot group of 500 users. Which configuration should the IT administrator implement to meet these requirements?

Accepted Answer

Assign Microsoft Copilot for Microsoft 365 licenses to the pilot group, and in the Microsoft 365 admin center, configure the data storage location to 'EU'.. The Microsoft 365 admin center provides a tenant-level setting to configure the data storage location for Microsoft Copilot for Microsoft 365, ensuring all processed data remains within the EU. Assigning licenses to the pilot group enables the phased rollout, while the data residency setting satisfies the compliance requirement without needing a separate tenant or manual user configuration.

Answer

Assign Microsoft Copilot for Microsoft 365 licenses to the pilot group, and in Microsoft Purview, create a data residency policy that restricts data to the EU.

Answer

Enable Microsoft Copilot for Microsoft 365 in the Microsoft 365 admin center for all users, then ask each user to customize their Copilot permissions in Graph.

Answer

Create a separate Microsoft 365 tenant in the EU region, move pilot users to that tenant, and assign Copilot licenses there.

Question 5

An organization with 50,000 users is planning to deploy Microsoft 365 E5. They want to use Microsoft Entra ID P2 features for identity protection and access reviews. However, they notice that Entra ID P2 is included in E5 but not in E3. They also need to ensure compliance with regulatory requirements for data residency. Which additional licensing or configuration is required?

Accepted Answer

Add Microsoft 365 Multi-Geo licenses for users who need data residency in other regions. Microsoft 365 Multi-Geo is the feature that allows an organization to store data at rest in specific geographic locations to meet data residency requirements. Since the organization has 50,000 users and needs data residency in other regions, they must add Multi-Geo licenses for those users. Entra ID P2 is already included in E5, so no separate purchase is needed. Configuring Azure Information Protection policies does not address data residency.

Answer

Purchase Microsoft Purview Information Protection add-on

Answer

Enable data residency by configuring Azure Information Protection policies

Answer

Purchase Microsoft Entra ID P2 licenses separately for all users

Question 6

A user wants to create a dashboard that visualizes sales data from multiple sources in real time. Which Microsoft 365 app should they use?

Accepted Answer

Power BI. Power BI is Microsoft's business analytics service that enables users to create interactive dashboards and reports from multiple data sources, with real-time data refresh capabilities. It is designed for data visualization and business intelligence, making it the appropriate tool for this requirement.

Answer

Excel

Answer

Microsoft Lists

Answer

Microsoft Forms

Question 7

A charitable organization with 50 employees wants to use Microsoft 365 for email and collaboration but has a very limited budget. What should they do first to obtain licenses at a reduced cost?

Accepted Answer

Apply for Microsoft 365 Nonprofit eligibility. Microsoft offers substantial nonprofit discounts (often free or heavily reduced Microsoft 365 Business Basic/E3 grants) to eligible charitable organizations through the Microsoft Nonprofit program. Before purchasing any licenses, the organization must first apply and be validated as an eligible nonprofit via Microsoft's partner (typically TechSoup). Only after eligibility is confirmed can they obtain the reduced-cost or donated licenses.

Answer

Purchase Microsoft 365 Business Basic licenses

Answer

Use the free web versions of Office apps

Answer

Purchase Microsoft 365 E3 licenses

Question 8

Your organization uses Microsoft Purview to manage data governance. A data owner needs to classify sensitive data across SharePoint, OneDrive, and Exchange automatically based on content patterns. Which Microsoft Purview feature should they use?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling in Microsoft Purview are designed to automatically classify and label content based on sensitive information types (SITs) or trainable classifiers. They apply across SharePoint, OneDrive, and Exchange, matching content patterns to detect sensitive data. This is the correct feature for automatic classification based on content patterns.

Answer

eDiscovery (Premium)

Answer

Data Loss Prevention (DLP) policies

Answer

Audit (Standard)

Question 9

An organization uses Microsoft Defender XDR and wants to investigate a potential ransomware attack. Which portal should the security team use to see the full attack timeline?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the unified investigation surface for Microsoft Defender XDR, where incidents, alerts, and the full attack timeline are correlated across endpoints, identities, email, and cloud apps. It provides the incident graph and timeline view needed to trace a ransomware attack end-to-end. Microsoft Sentinel is a SIEM/SOAR platform, not the native Defender XDR investigation portal.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel

Answer

Azure portal

Question 10

A compliance-aware administrator is selecting the right Microsoft 365 capability to brainstorm using a shared digital canvas during Teams meetings. Microsoft 365 app or service is the best fit?

Accepted Answer

Microsoft Whiteboard. Microsoft Whiteboard is the best fit because it provides a shared digital canvas that allows meeting participants to brainstorm, draw, and collaborate in real time during Teams meetings. It integrates directly with Teams, supports ink and sticky notes, and persists content across sessions, making it ideal for interactive brainstorming.

Answer

Microsoft Planner

Answer

Microsoft Purview Audit

Answer

Microsoft Forms

Question 11

A legal firm needs to automatically encrypt and apply access restrictions to all documents that contain case numbers considered highly confidential. The protection must remain enforced even if the document is emailed to external parties or saved to a personal device. Which Microsoft Purview solution should be configured?

Accepted Answer

Sensitivity Labels with encryption. Sensitivity Labels with encryption are the correct solution because they allow the legal firm to classify documents containing confidential case numbers and enforce persistent protection (encryption and access restrictions) that travels with the document, even when emailed externally or saved to a personal device. This is achieved by applying Azure Rights Management (Azure RMS) encryption directly to the file, ensuring the protection is embedded in the document itself, not just at the network or service boundary.

Answer

Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Answer

Customer Lockbox

Question 12

WideWorldImporters (WWI) is a retail company with 2,000 employees using Microsoft 365 Business Premium. They have a mix of Windows 10 and Windows 11 devices managed by Microsoft Intune. WWI wants to deploy a new line-of-business (LOB) app to all devices. The app is a Win32 app packaged as an .intunewin file. The IT administrator needs to ensure the app is installed automatically on all devices within 24 hours. Which deployment method should the administrator use?

Accepted Answer

Add the app as a required deployment for all devices. A required deployment in Intune forces the app to be installed automatically on all targeted devices without user interaction. This is the correct choice for ensuring the Win32 app is installed on all devices within 24 hours, as Intune will push the installation and retry as needed. Available deployments require users to install the app themselves, which does not guarantee automatic installation.

Answer

Use Azure AD Application Proxy to publish the app

Answer

Add the app as an available deployment for all users

Answer

Publish the app to Microsoft Store for Business and sync with Intune

Question 13

Which THREE of the following are capabilities of Microsoft Entra ID that support identity security? (Choose three.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is correct because it provides just-in-time privileged access with approval workflows, time-bound role activation, and access reviews, directly reducing standing admin rights in Microsoft Entra ID. Conditional Access is correct because it enforces signal-based access policies (user, device, location, risk) to grant, block, or require MFA/compliant device before access to resources. Identity Protection is correct because it detects and remediates identity risks using signals like leaked credentials, anonymous IP addresses, and atypical sign-in behavior, feeding risk detections into Conditional Access. Microsoft Defender XDR is not an Entra ID identity-security capability; it is a broader extended detection and response suite spanning endpoints, email, identities, and cloud apps. Microsoft Intune is a device and application management service (MDM/MAM) rather than a native Entra ID identity-security capability, even though it integrates with Conditional Access for device compliance.

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 14

A training department wants to create interactive learning paths and track employee progress. Which Microsoft 365 service should they use?

Accepted Answer

Microsoft Viva Learning. Microsoft Viva Learning is the correct service because it provides a centralized hub within Microsoft Teams where organizations can create, assign, and track interactive learning paths and employee progress. It integrates with learning management systems (LMS) and content providers to surface training content, while also offering progress tracking and completion analytics for administrators.

Answer

Microsoft Viva Topics

Answer

Microsoft Stream

Answer

SharePoint Online

Question 15

A user receives an error message when trying to activate Microsoft 365 Apps for enterprise. The administrator checks the license assignment and confirms the user has a Microsoft 365 E3 license. What is the most likely cause of the activation failure?

Accepted Answer

The user is signed in with a personal Microsoft account instead of a work or school account. Microsoft 365 Apps for enterprise activation requires signing in with a work or school account that has the appropriate license. If the user is signed in with a personal Microsoft account, activation will fail even if the license is assigned. The most likely cause is that the user is using the wrong account type.

Answer

The Microsoft 365 trial period has expired

Answer

The license is not yet assigned to the user

Answer

The device does not meet the minimum system requirements for Office