MS-900 Practice Test 45 — 15 Questions

Question 1

Your organization wants to ensure that data sent to Microsoft 365 is encrypted in transit. Which protocol should you enforce for all client connections?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct protocol because Microsoft 365 enforces TLS 1.2 or later for all client-to-service connections to ensure data is encrypted in transit. TLS provides end-to-end encryption for HTTP-based traffic (including HTTPS) and is the standard protocol used by Microsoft 365 services like Exchange Online, SharePoint Online, and Teams. Enforcing TLS 1.2 ensures that older, less secure versions like TLS 1.0 and 1.1 are blocked, meeting the organization's encryption requirement.

Answer

IPsec

Answer

HTTPS

Answer

SSH

Question 2

An HR manager needs to collect employee feedback on a new policy. They want to create a short survey that anonymizes responses and provides automatic charts summarizing the results. Which Microsoft 365 app is best suited for this task?

Accepted Answer

Microsoft Forms. Microsoft Forms is the correct choice because it is specifically designed for creating surveys and quizzes with built-in anonymous response settings and automatic chart generation. The HR manager can enable 'Record name' to be off for anonymity, and Forms automatically visualizes results with pie charts, bar graphs, and summary data without manual setup.

Answer

Microsoft Lists

Answer

Microsoft Sway

Answer

Microsoft Excel

Question 3

Your company has 50 users on Microsoft 365 Business Premium. You need to provide phone system and audio conferencing capabilities. What should you do?

Accepted Answer

Add the Phone System and Audio Conferencing add-ons to the existing Business Premium licenses. Microsoft 365 Business Premium includes the rights to add Phone System and Audio Conferencing as add-ons. Option D is correct because you simply purchase the Phone System and Audio Conferencing add-on licenses for each user who needs those capabilities, without changing the base subscription. This is the most cost-effective and straightforward path to enable PSTN calling and dial-in conferencing for Business Premium users.

Answer

Purchase Microsoft 365 Business Voice

Answer

Purchase a Microsoft 365 Calling Plan subscription for each user

Answer

Upgrade all users to Microsoft 365 E5

Question 4

A marketing manager needs to provision a new virtual machine to run a temporary campaign analysis. They log into the cloud provider's web portal, select a VM size, configure settings, and start the VM within minutes—all without any human interaction with the provider's IT staff. Which essential characteristic of cloud computing does this scenario best illustrate?

Accepted Answer

On-demand self-service. The scenario describes a user provisioning a virtual machine independently through a web portal without any human interaction with the provider's IT staff. This directly maps to the NIST-defined essential characteristic of on-demand self-service, where a consumer can unilaterally provision computing capabilities as needed automatically without requiring human interaction with each service provider.

Answer

Resource pooling

Answer

Rapid elasticity

Answer

Measured service

Question 5

A user wants to access company email and documents from any device, anywhere. Which cloud model is Microsoft 365?

Accepted Answer

Software as a Service (SaaS). Microsoft 365 is a SaaS offering because Microsoft hosts and manages the applications (Exchange Online, SharePoint Online, Teams, Office apps) and the underlying infrastructure, and customers access them over the internet via subscription. Users consume the software without managing servers, patching, or platform configuration. This matches the SaaS model where the provider delivers a complete, ready-to-use application.

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Desktop as a Service (DaaS)

Question 6

A user needs to sign in to Microsoft 365 from an untrusted device. The company requires multifactor authentication (MFA) for all external access. Which Microsoft Entra ID feature enforces this requirement?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the feature that enforces access controls based on conditions such as user, device, location, and application. It can require MFA for access from untrusted devices or external locations. By creating a Conditional Access policy that targets all users and requires MFA when the device is not compliant or not trusted, the company can enforce MFA for external access.

Answer

Microsoft Entra ID Protection

Answer

Security defaults

Answer

Microsoft Entra ID Password Protection

Question 7

Which three of the following are characteristics of cloud computing as defined by the National Institute of Standards and Technology (NIST)? (Choose three.)

Accepted Answer

On-demand self-service. NIST SP 800-145 defines cloud computing by five essential characteristics. On-demand self-service allows a consumer to provision computing capabilities automatically without requiring human interaction with each service provider. Broad network access means capabilities are available over the network and accessed through standard mechanisms (e.g., mobile phones, tablets, laptops, and workstations). Resource pooling enables the provider's computing resources to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand.

Answer

Dedicated hardware per tenant

Answer

Fixed pricing models

Answer

Limited scalability

Question 8

A company wants to ensure that sensitive documents in Microsoft SharePoint Online are automatically classified and protected when they contain credit card numbers. Which Microsoft 365 service should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (D) enables organizations to automatically classify and protect sensitive documents based on data classification rules. By configuring a sensitive information type for credit card numbers, SharePoint Online can apply sensitivity labels or retention labels to documents containing that pattern, ensuring they are encrypted or restricted as defined by policy.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Insider Risk Management

Question 9

A compliance officer needs to ensure that all user activities related to sensitive data in Microsoft 365 are recorded and available for forensic investigation. They require detailed logs of who accessed specific files in SharePoint Online, including attempts to access files that were blocked by DLP policies. Which solution should they enable?

Accepted Answer

Microsoft 365 Audit Log. Microsoft 365 Audit Log (Unified Audit Log) is the correct solution because it captures detailed records of user activities, including file access in SharePoint Online and blocked DLP policy actions. These logs are retained for forensic investigation and can be searched via the Microsoft 365 Purview compliance portal or accessed programmatically.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Activity Explorer

Answer

Microsoft 365 Defender

Question 10

Match each Microsoft 365 pricing model to its description.

Accepted Answer

Per-user subscription: Each user has a unique license to access services from any device.. Microsoft 365 offers different pricing models: per-user (each user licensed), per-device (each device licensed), and consumption-based (pay per use). Common confusions include swapping per-user and per-device, or confusing consumption with subscriptions.

Answer

Per-user subscription: Licensing is tied to a specific device rather than a user.

Answer

Per-device subscription: Each user must have their own license regardless of device.

Answer

Consumption-based pricing: A fixed monthly fee per user for unlimited usage.

Question 11

A healthcare organization must encrypt outbound email automatically when a message contains passport numbers. Which two Microsoft Purview capabilities are commonly combined? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct answer because it provides the policy engine that detects sensitive information, such as passport numbers, in outbound email. When a DLP rule matches, it can trigger automatic encryption of the message using Microsoft Purview Message Encryption, ensuring the email is protected before leaving the organization.

Answer

Microsoft Planner

Answer

Microsoft Viva Engage

Question 12

An administrator is assigned the Global Reader role in Microsoft Entra ID as shown in the exhibit. What can this administrator do?

Accepted Answer

View all user and group properties in the directory. The Global Reader role in Microsoft Entra ID is a read-only role that allows viewing all directory settings, including user and group properties, but does not grant any write permissions. This enables the administrator to view but not modify user or group attributes, making option A correct.

Answer

Reset user passwords

Answer

Assign administrative roles to other users

Answer

Create new users in the directory

Question 13

An organization needs to ensure that all Microsoft 365 data is encrypted at rest and in transit. Which of the following is a built-in encryption mechanism in Microsoft 365?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption is a built-in encryption mechanism in Microsoft 365 that encrypts data at rest on physical drives within Microsoft datacenters. It uses AES 256-bit encryption to protect data stored on disk volumes, ensuring that even if physical drives are removed, the data remains unreadable. Additionally, Microsoft 365 uses TLS 1.2+ for data in transit, but BitLocker specifically addresses the 'at rest' requirement as a native, default encryption layer.

Answer

Customer-managed keys (CMK) using Azure Key Vault

Answer

Office 365 Message Encryption

Answer

Azure Information Protection

Question 14

During a Microsoft 365 planning workshop, identify purchased Microsoft 365 licenses that are not assigned. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Available licenses. The question asks which concept is most relevant when identifying purchased but unassigned Microsoft 365 licenses. The 'Available licenses' count in the Microsoft 365 admin center directly shows the number of licenses purchased minus those assigned to users. This is a core licensing management concept, distinct from specific service apps like Forms, Stream, or Whiteboard.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Whiteboard

Question 15

Which THREE conditions must be met for a Microsoft 365 tenant to use Customer Lockbox?

Accepted Answer

An authorized admin must submit a support request to Microsoft.. Customer Lockbox requires an authorized admin to explicitly approve or deny a Microsoft engineer's access request. This ensures that no data access occurs without the customer's explicit consent, aligning with the principle of 'approval-based access control' for support scenarios.

Answer

The tenant must be on a Microsoft 365 E3 plan.

Answer

Internal administrators must request access to user mailboxes.