MS-900 Practice Test 47 — 15 Questions

Question 1

A sales team needs to collaborate on documents in real time, track changes, and co-author using familiar desktop tools. Which Microsoft 365 app should they use?

Accepted Answer

Microsoft Word. Microsoft Word is the correct choice because it is the desktop app that natively supports real-time co-authoring, change tracking, and simultaneous editing by multiple users. These features are built into Word for Microsoft 365, allowing teams to collaborate on documents using the familiar desktop interface without needing to switch to a web or mobile app.

Answer

Microsoft Teams

Answer

Microsoft OneNote

Answer

Microsoft Planner

Question 2

Your company has deployed Microsoft Defender XDR. A security analyst needs to investigate a suspicious email that was reported by a user. Which Microsoft 365 service should the analyst use to view the email's details and analyze threats?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct service because it provides a unified investigation and response experience across email, endpoints, identities, and cloud apps. The security analyst can use the Microsoft Defender portal (security.microsoft.com) to view the full email details, including headers, attachments, URLs, and threat analysis results from automated investigation and advanced hunting queries.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 3

A tenant administrator is advising a department that wants to co-author a Word document with colleagues in real time from a browser. Microsoft 365 app or service is the best fit?

Accepted Answer

Microsoft 365 web apps with OneDrive or SharePoint. Microsoft 365 web apps (Word, Excel, PowerPoint) combined with OneDrive or SharePoint enable real-time co-authoring from a browser. This allows multiple users to edit the same document simultaneously, with changes synced instantly via the cloud, which directly meets the department's requirement.

Answer

Microsoft Forms

Answer

Microsoft Purview Audit

Answer

Microsoft Planner

Question 4

Which TWO of the following are examples of security defaults in Microsoft Entra ID? (Choose two.)

Accepted Answer

Require multifactor authentication for all users. Security defaults in Microsoft Entra ID are a preconfigured set of baseline protections that Microsoft enables for tenants that have not purchased Entra ID P1/P2 licenses. Option A is correct because security defaults require all users to register for and use multifactor authentication (MFA) via the Microsoft Authenticator app when necessary, protecting against credential-stuffing and password-spray attacks. Option E is correct because security defaults block legacy authentication protocols (such as POP, IMAP, SMTP AUTH, and older Office clients) that cannot enforce MFA, thereby closing a common MFA-bypass vector. Option B is incorrect because allowing legacy authentication is the opposite of what security defaults do — they block it. Option C is incorrect because security defaults do not disable self-service password reset; SSPR is a separate feature configured independently. Option D is incorrect because enabling guest user access is not part of security defaults; guest access is governed by external collaboration settings, and security defaults actually restrict guest actions such as Azure portal access.

Answer

Allow legacy authentication protocols

Answer

Disable self-service password reset

Answer

Enable guest user access

Question 5

Which FOUR Microsoft 365 services are part of the Microsoft Defender XDR suite?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is the unified extended detection and response suite that natively correlates signals across four Defender workloads. Option A, Microsoft Defender for Endpoint, is correct because it is the endpoint detection and response (EDR) pillar that surfaces device alerts and integrates into the XDR incident queue. Option B, Microsoft Defender for Cloud Apps, is correct because it is the Cloud App Security (CASB) component that feeds SaaS and cloud-app telemetry into Defender XDR. Option D, Microsoft Defender for Office 365, is correct because it protects email, collaboration, and Office apps (phishing, malware, URL detonation) and shares incidents with the suite. Option E, Microsoft Defender for Identity, is correct because it monitors on-premises Active Directory signals (DC sensors) to detect identity-based attacks and is a native XDR pillar. Option C, Microsoft Sentinel, is not part of Defender XDR; it is a separate cloud-native SIEM/SOAR product that can ingest Defender XDR incidents but is licensed and managed independently.

Answer

Microsoft Sentinel

Question 6

An organization is using Microsoft 365 Business Premium. They want to add Microsoft 365 Copilot for 10 users to enhance productivity with AI features. How should the administrator procure the Copilot licenses?

Accepted Answer

Add Microsoft 365 Copilot as an add-on to the existing subscription. Microsoft 365 Copilot is available as an add-on to qualifying Microsoft 365 subscriptions, including Business Premium. This allows the administrator to license only the 10 users who need Copilot without changing the base subscription for all users. Option C correctly identifies this add-on licensing model.

Answer

Purchase standalone Microsoft 365 Copilot licenses

Answer

Upgrade all users to Microsoft 365 E5 to get Copilot included

Answer

Purchase a new Microsoft 365 E3 subscription and add Copilot

Question 7

A multinational corporation uses Microsoft 365 E5 and wants to implement a retention policy that automatically deletes emails in users' mailboxes after 7 years, except for emails from the legal department which must be retained indefinitely. Which approach should the admin use?

Accepted Answer

Create a default retention policy for 7 years and use auto-labeling for legal department emails. It uses a retention policy with a 7-year deletion period for all content, then overrides that for legal department emails via auto-labeling with a 'retain indefinitely' label. This ensures that only legal emails are preserved forever while all other emails are automatically purged after 7 years, meeting the compliance requirement without manual intervention.

Answer

Apply a litigation hold to all mailboxes and a retention policy to delete after 7 years

Answer

Configure Exchange Online archive policies to move emails after 7 years

Answer

Use Microsoft Purview eDiscovery to manually delete emails after 7 years

Question 8

A company has 500 users and is considering moving to Microsoft 365. They need to ensure that all users have access to Exchange Online, SharePoint Online, and Teams, and they want to use Microsoft Entra ID P1 for identity management. Which Microsoft 365 subscription should they choose?

Accepted Answer

Microsoft 365 E3. Microsoft 365 E3 includes Exchange Online, SharePoint Online, Teams, and Microsoft Entra ID P1, meeting all stated requirements. Unlike Business Premium, E3 has no user limit, making it suitable for 500 users.

Answer

Microsoft 365 E5

Answer

Microsoft 365 Business Basic

Answer

Microsoft 365 Business Premium

Question 9

Which TWO Microsoft 365 services can be used to create and manage custom forms for data collection and surveys?

Accepted Answer

Microsoft Forms. Microsoft Forms is purpose-built for creating custom forms, surveys, and quizzes with automatic data collection into Excel Online. It provides a simple interface for designing forms, distributing them, and analyzing responses in real time, making it the primary tool for this task in Microsoft 365.

Answer

Microsoft Lists

Answer

Excel Online

Answer

SharePoint Lists

Question 10

A company uses Microsoft 365 Business Premium. A user reports that when they try to access a file in SharePoint Online, they receive an error that the file is blocked by policy. The IT admin needs to identify which policy is blocking the file. Which tool should the admin use?

Accepted Answer

Microsoft Purview Data Loss Prevention policies. Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to detect and block the sharing or access of sensitive information, such as credit card numbers or personally identifiable information, in Microsoft 365 services like SharePoint Online. When a file is blocked with a 'blocked by policy' error, it is typically because a DLP rule has matched the file's content and applied an action to restrict access. The admin can use the Microsoft Purview compliance portal to review DLP policy matches and identify the exact rule that triggered the block.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Entra ID Conditional Access policies

Answer

Microsoft Defender for Cloud Apps session policies

Question 11

A global company needs to ensure that only employees in the 'HR' security group can access a specific set of HR documents stored in SharePoint. If a user outside the group attempts to view or copy the content, it must be blocked. The protection must persist even if someone downloads the files and shares them externally, or if the files are saved to a personal device. Which Microsoft Purview solution should be used?

Accepted Answer

Sensitivity labels with encryption and permission settings. Sensitivity labels with encryption and permission settings are the correct solution because they allow you to apply persistent protection that travels with the file, regardless of where it is stored or shared. By configuring a sensitivity label to restrict access to only members of the 'HR' security group and enabling encryption, the protection remains intact even if the file is downloaded, saved to a personal device, or shared externally. This meets the requirement for persistent access control that blocks unauthorized viewing or copying.

Answer

Data Loss Prevention (DLP) policy

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Defender for Cloud Apps session policy

Question 12

Your organization is migrating from on-premises Exchange to Exchange Online. You need to ensure that users can access their mailboxes using Outlook for Windows without re-entering credentials each time. Which Microsoft 365 service should you configure to enable single sign-on (SSO) and modern authentication?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the identity and access management service that provides single sign-on (SSO) and modern authentication (OAuth 2.0, OpenID Connect) for Exchange Online. When configured, Outlook for Windows can use the Microsoft Entra ID token to authenticate silently, eliminating the need for users to re-enter credentials each time they access their mailbox.

Answer

Microsoft Intune

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 13

A user wants to create a custom dashboard that displays key performance indicators from multiple data sources, such as Excel files and SharePoint lists. Which Microsoft 365 app should the user use?

Accepted Answer

Microsoft Power BI. Microsoft Power BI is the correct choice because it is a business analytics service designed to connect to multiple data sources—including Excel files and SharePoint lists—and create interactive, custom dashboards with key performance indicators (KPIs). Unlike the other options, Power BI provides built-in data modeling, visualization, and real-time refresh capabilities, making it the only app in this list that fulfills the requirement for a multi-source KPI dashboard.

Answer

Microsoft Excel

Answer

Microsoft Lists

Answer

Microsoft Forms

Question 14

A compliance-aware administrator is selecting the right Microsoft 365 capability to require MFA only for sign-ins from outside trusted locations. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Conditional Access. Conditional Access is the correct Microsoft 365 capability because it allows administrators to create policies that enforce MFA based on specific conditions, such as sign-in location. By configuring a Conditional Access policy with a 'location' condition that includes trusted IP ranges (defined via named locations), you can require MFA only when users sign in from outside those trusted locations. This directly addresses the requirement for location-aware MFA enforcement without affecting sign-ins from trusted networks.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 15

Refer to the exhibit. The JSON shows compliance scores from Microsoft Purview Compliance Manager. Which action should the organization prioritize to improve its HIPAA compliance score?

Accepted Answer

Enable multifactor authentication for all users.. The recommended action 'Enable MFA for all users' is marked as high impact and open. Implementing MFA would significantly improve the HIPAA score, as it addresses a common control. Option B is correct.

Answer

Deploy Microsoft Defender for Office 365.

Answer

Implement retention labels for medical records.

Answer

Conduct a data privacy impact assessment.