MS-900 Practice Exam 51 — 20 Questions

Question 1

In a Software as a Service (SaaS) model, which of the following responsibilities is typically handled by the cloud provider?

Accepted Answer

Patching the underlying operating system and application. In a SaaS model, the cloud provider is responsible for managing the underlying infrastructure, including patching the operating system and the application itself. This is a core tenet of the shared responsibility model, where the provider handles the security and maintenance of the software stack, while the customer is responsible for data and user access. For example, in Microsoft 365, Microsoft automatically applies security updates to Exchange Online and SharePoint without customer intervention.

Answer

Managing user passwords and accounts

Answer

Configuring application settings for the organization

Answer

Backing up customer data

Question 2

An organization uses Microsoft 365 E5 and wants to automatically classify and protect sensitive documents stored in SharePoint Online based on content patterns (e.g., credit card numbers). They need to apply encryption and restrict access when such content is detected. Which Microsoft 365 service should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) is the correct service because it provides content-based classification and protection for sensitive data. It uses trainable classifiers and sensitive information types (e.g., credit card numbers) to automatically apply encryption and restrict access via sensitivity labels in SharePoint Online.

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 3

A large enterprise needs to enforce that all documents containing financial data are automatically classified and encrypted when shared externally. Which combination of Microsoft 365 services should be used?

Accepted Answer

Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. Microsoft Purview Information Protection provides the classification and labeling capabilities to automatically identify documents containing financial data, while Microsoft Defender for Cloud Apps enables policy-based encryption and protection controls when those documents are shared externally. Together, they enforce data loss prevention (DLP) by applying sensitivity labels that trigger encryption upon external sharing, meeting the enterprise requirement.

Answer

Microsoft Forms and Microsoft Stream

Answer

Microsoft Sentinel and Microsoft Defender XDR

Answer

Microsoft Intune and Microsoft Entra ID

Question 4

A company wants to prevent employees from forwarding sensitive emails outside the organization. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (part of Purview Information Protection) lets organizations encrypt and apply usage restrictions to email, including preventing forwarding, printing, or copying of sensitive messages. It uses Azure Rights Management to enforce protection that travels with the message, so even if a recipient tries to forward it outside the organization, the protection persists. This directly addresses the requirement to prevent forwarding sensitive emails outside the organization.

Answer

Microsoft Intune Mobile Application Management

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Defender for Office 365 Anti-Phishing

Question 5

You are the IT administrator for a non-profit organization that uses Microsoft 365 Business Basic. The organization has 50 volunteers who use their own personal devices to access email and SharePoint Online. The board of directors wants to ensure that if a volunteer's device is lost or stolen, the organization's data on that device can be removed remotely. They also want to ensure that volunteers use multi-factor authentication (MFA) to access corporate resources. What should you do?

Accepted Answer

Enroll devices in Microsoft Intune and configure a selective wipe policy. Set up a Conditional Access policy in Microsoft Entra ID to require MFA.. Microsoft Intune allows you to enroll devices and perform a selective wipe to remove only corporate data from personal devices. Conditional Access in Microsoft Entra ID can enforce MFA for accessing corporate resources. Option A is incorrect because Microsoft Defender for Cloud Apps provides cloud app security (e.g., session controls) but does not perform device wipe or manage device enrollment. Option B is incorrect because Microsoft Purview is for data governance, compliance, and labeling, not for device management or selective wipe. Option C is incorrect because Data Loss Prevention (DLP) policies control data sharing but cannot block access from unmanaged devices; that would require Conditional Access policies with device compliance.

Answer

Deploy Microsoft Defender for Cloud Apps and configure session controls.

Answer

Use Microsoft Purview to label all corporate data and configure a policy to revoke access.

Answer

Implement a Data Loss Prevention (DLP) policy that blocks access from unmanaged devices.

Question 6

A multinational company uses Microsoft 365 and wants to ensure that data stored in SharePoint Online is only accessible from specific geographic regions. The company has offices in the US, EU, and Asia. You need to implement a solution that restricts access based on the user's physical location. Which feature should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID can restrict access based on the user's physical location by using named locations or IP ranges. This allows the company to enforce that SharePoint Online data is only accessible from specific geographic regions.

Answer

Data Residency in Microsoft Purview

Answer

Geofencing in Microsoft Intune

Answer

Location-Based Policies in SharePoint Admin Center

Question 7

A tenant administrator is advising a department that wants to deploy application code without maintaining the operating system or runtime platform. Cloud concept or benefit best matches this requirement?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) provides a platform for developing, running, and managing applications without the complexity of building and maintaining the underlying infrastructure. The department wants to deploy application code without managing the OS or runtime, which is exactly what PaaS offers. IaaS provides raw compute, storage, and network but requires OS management; SaaS provides fully functional applications; private cloud is a deployment model, not a service model.

Answer

Private cloud

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Question 8

A multinational corporation needs to design a cloud strategy that allows them to keep sensitive financial data on-premises while using public cloud for customer-facing apps. Which deployment model should they adopt?

Accepted Answer

Hybrid cloud. A hybrid cloud combines on-premises infrastructure with public cloud services, connected so workloads and data can span both environments. Keeping sensitive financial data on-premises for compliance while running customer-facing apps in the public cloud is the textbook hybrid scenario, since it preserves data residency and control where required while gaining public cloud elasticity elsewhere.

Answer

Private cloud

Answer

Public cloud

Answer

Multi-cloud

Question 9

An administrator needs to ensure that only compliant devices can access Exchange Online. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID evaluate signals such as user, device compliance state, location, and app, and can grant or block access based on those conditions. To restrict Exchange Online access to compliant devices only, the admin creates a policy targeting Exchange Online that requires the device to be marked compliant (via Intune) or hybrid Microsoft Entra ID joined. This is the specific Entra ID feature designed for signal-based, conditional access enforcement.

Answer

Privileged Identity Management

Answer

Multi-Factor Authentication

Answer

Identity Protection

Question 10

An administrator is reviewing a request from users who need to reset user passwords without assigning Global Administrator. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Password Administrator. The Password Administrator role in Microsoft Entra ID (formerly Azure AD) allows users to reset passwords for non-administrator users and manage service requests without granting the highly privileged Global Administrator role. This directly addresses the user request while adhering to the principle of least privilege, making it the most relevant concept for this scenario.

Answer

Microsoft Whiteboard

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 11

A security administrator needs to automatically restrict access to documents labeled as 'Highly Confidential' when accessed from devices that are not joined to the domain. The restriction should block editing and printing, and apply encryption. Which combination of Microsoft 365 solutions should the administrator use?

Accepted Answer

Microsoft Purview Information Protection + Microsoft Entra ID Conditional Access. Microsoft Purview Information Protection (MIP) allows you to create sensitivity labels that apply encryption, restrict editing, and block printing on documents. Microsoft Entra ID Conditional Access can then enforce that these labels are automatically applied based on device compliance (e.g., devices not joined to the domain). Together, they provide the automated, policy-driven restriction described.

Answer

Microsoft Purview Data Loss Prevention + Microsoft Entra ID Identity Protection

Answer

Microsoft Defender for Office 365 + Microsoft 365 Business Premium

Answer

Microsoft Purview Audit + Microsoft Entra ID Privileged Identity Management

Question 12

Your organization has 500 users and needs to comply with data residency requirements in the EU. You plan to purchase Microsoft 365 E3 subscriptions. Which licensing option should you choose to ensure data is stored only in EU datacenters?

Accepted Answer

Microsoft 365 E3 with Data Residency add-on. Microsoft 365 E3 with the Data Residency add-on ensures that customer data at rest is stored only in EU datacenters, meeting EU data residency requirements. The base Microsoft 365 E3 subscription does not guarantee EU-only storage; the add-on provides the necessary data location commitment and compliance controls.

Answer

Microsoft 365 Business Basic

Answer

Office 365 E3

Answer

Microsoft 365 E5

Question 13

You are designing a solution for a global company that needs to store documents in a central location with granular permission control. Which service should you recommend?

Accepted Answer

SharePoint. SharePoint is the correct choice because it is designed as a centralized document management and collaboration platform that supports granular permission control at the site, library, folder, and item levels. Unlike other services, SharePoint allows administrators to define unique permissions using SharePoint groups or Microsoft Entra ID security groups, enabling precise access management for a global company's document storage needs.

Answer

Microsoft Teams

Answer

OneDrive for Business

Answer

Exchange Online

Question 14

A help desk lead is documenting the correct Microsoft 365 approach to review upcoming Microsoft 365 changes and recommended admin actions. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Message center. The Message center in the Microsoft 365 admin center is the dedicated hub for reviewing upcoming changes, new features, and recommended admin actions. It provides official communications from Microsoft about service updates, deprecations, and required administrative steps, making it the correct resource for a help desk lead documenting change management.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Whiteboard

Question 15

Your organization is deploying Microsoft 365 Copilot for sales teams. The compliance team requires that Copilot interactions with customer data in Dynamics 365 Sales be subject to retention policies. Which Microsoft Purview feature should you configure to manage this data?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management enforces retention policies for Copilot interactions. Option B is incorrect because eDiscovery is for search and export. Option C is incorrect because Communication Compliance is for monitoring inappropriate messages. Option D is incorrect because Sensitivity labels are for classification.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communication Compliance

Question 16

Your company is deploying Microsoft 365 Copilot and wants to ensure that sensitive data in emails and documents is not inadvertently exposed via Copilot responses. Which Microsoft 365 capability should you implement?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct choice because it is specifically designed to identify, monitor, and automatically protect sensitive data (e.g., credit card numbers, PII, or custom patterns) across Microsoft 365 services, including emails and documents. When integrated with Microsoft 365 Copilot, DLP policies can prevent Copilot from including sensitive information in its responses by enforcing real-time content checks and blocking or warning users before exposure occurs.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Customer Lockbox

Question 17

Which TWO are key capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Cloud Discovery to identify shadow IT. Option D (Cloud Discovery to identify shadow IT) is correct because Defender for Cloud Apps uses Cloud Discovery to analyze traffic logs from firewalls and proxies (or via the Defender for Endpoint integration) to detect unsanctioned SaaS apps, giving organizations visibility into shadow IT. Option E (Session control to monitor and control app access in real-time) is correct because Conditional Access App Control uses a reverse proxy to enforce real-time session policies, such as blocking downloads or uploads, on cloud apps. Option A is incorrect because email encryption and secure messaging are capabilities of Microsoft Purview (Exchange Online/Message Encryption), not Defender for Cloud Apps. Option B is incorrect because device compliance policy enforcement is handled by Microsoft Intune and Conditional Access, not Defender for Cloud Apps. Option C is incorrect because on-device malware scanning is provided by Microsoft Defender for Endpoint, not Defender for Cloud Apps.

Answer

Email encryption and secure messaging

Answer

Device compliance policy enforcement

Answer

On-device malware scanning

Question 18

Refer to the exhibit. You are configuring a Microsoft Purview Data Loss Prevention (DLP) policy in the Microsoft 365 compliance portal. The policy is intended to block access to files containing credit card numbers when accessed from outside the organization. However, users report that the policy is not blocking access. What is the most likely reason?

Accepted Answer

The policy mode is set to 'advanced' which is not a valid mode; it should be 'enforce' or 'test'.. The policy mode 'advanced' is not a valid mode in Microsoft Purview DLP. The valid modes are 'enforce' (to actively block actions) and 'test' (to simulate policy effects without blocking). Setting the mode to an invalid value like 'advanced' would prevent the policy from enforcing any restrictions, explaining why access is not being blocked.

Answer

The policy is not assigned to any locations.

Answer

The confidence level is set to 'high' which is too restrictive.

Answer

The sensitive information type is incorrect.

Question 19

A company uses Microsoft 365 and wants to automatically classify documents containing credit card numbers as 'Highly Confidential' and apply encryption when shared externally. Which solution should they use?

Accepted Answer

Microsoft Purview Information Protection with auto-labeling. Microsoft Purview Information Protection with auto-labeling is the correct solution because it uses trainable classifiers or exact data match (EDM) to detect sensitive data types like credit card numbers, automatically apply a 'Highly Confidential' sensitivity label, and enforce encryption when the document is shared externally. This capability is built into Microsoft 365 compliance center and integrates with sensitivity labels to protect data at rest and in transit.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 20

A multinational corporation uses Microsoft 365 E5. They need to enforce that all documents marked as 'Confidential' are encrypted and cannot be printed or forwarded. Which Microsoft Purview Information Protection capability should they configure?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption are the correct choice because they allow you to classify and protect documents at the file level, applying encryption that restricts actions such as printing and forwarding. This is a core capability of Microsoft Purview Information Protection, enabling persistent protection that travels with the document regardless of where it is stored or shared.

Answer

Data Loss Prevention (DLP) policies

Answer

Retention policies

Answer

Azure Information Protection (AIP) client