MS-900 Practice Exam 64 — 20 Questions

Question 1

A mid-sized company, Fabrikam, uses Microsoft 365 Business Premium. The company has 500 users and wants to implement a solution to protect against phishing attacks that target user credentials. The solution must: 1. Automatically detect and block malicious links in emails and Teams messages. 2. Provide real-time protection when users click on links in emails. 3. Allow users to report suspicious emails to the security team. 4. Integrate with Microsoft Entra ID to enforce conditional access policies based on user risk. Which combination of Microsoft 365 services should Fabrikam deploy?

Accepted Answer

Deploy Microsoft Defender for Office 365 and enable Microsoft Defender XDR.. Microsoft Defender for Office 365 (formerly Office 365 ATP) provides Safe Links and Safe Attachments to automatically detect and block malicious links in email and Teams messages, and offers real-time protection when users click links. Microsoft Defender XDR (Extended Detection and Response) correlates signals across Defender for Office 365, Defender for Endpoint, and Microsoft Entra ID to enforce conditional access policies based on user risk, fulfilling all four requirements.

Answer

Deploy Microsoft Intune and enforce conditional access policies that require compliant devices.

Answer

Deploy Microsoft Sentinel and configure analytics rules for phishing.

Answer

Deploy Microsoft Purview Data Loss Prevention and set up an email policy.

Question 2

Your organization, Contoso Ltd., uses Microsoft 365 E5 licenses and has 10,000 users. The company is planning to deploy Microsoft Copilot for Microsoft 365 to all users. The IT department has identified the following requirements: 1. Users must be able to use Copilot across Microsoft Teams, Word, Excel, PowerPoint, and Outlook. 2. Copilot must be able to access user data from Exchange Online, SharePoint Online, and Microsoft Graph. 3. The deployment must comply with the company's data residency policy, which requires that all data processed by Copilot remains within the European Union (EU). 4. The company wants to use a phased rollout, starting with a pilot group of 500 users. Which configuration should the IT administrator implement to meet these requirements?

Accepted Answer

Assign Microsoft Copilot for Microsoft 365 licenses to the pilot group, and in the Microsoft 365 admin center, configure the data storage location to 'EU'.. Option C is correct because the Microsoft 365 admin center provides a tenant-level setting to configure the data storage location for Microsoft Copilot for Microsoft 365, ensuring all processed data remains within the EU. Assigning licenses to the pilot group enables the phased rollout, while the data residency setting satisfies the compliance requirement without needing a separate tenant or manual user configuration.

Answer

Assign Microsoft Copilot for Microsoft 365 licenses to the pilot group, and in Microsoft Purview, create a data residency policy that restricts data to the EU.

Answer

Enable Microsoft Copilot for Microsoft 365 in the Microsoft 365 admin center for all users, then ask each user to customize their Copilot permissions in Graph.

Answer

Create a separate Microsoft 365 tenant in the EU region, move pilot users to that tenant, and assign Copilot licenses there.

Question 3

Your organization has 500 users and uses Microsoft 365 Business Basic. The sales team frequently works remotely and needs to access their work files on mobile devices. They also need to conduct video meetings with customers. The IT department has been asked to recommend additional Microsoft 365 services to meet these needs without upgrading the existing plan if possible. Which action should the IT department take?

Accepted Answer

Use the existing OneDrive and SharePoint mobile apps for file access and use Microsoft Teams for video meetings.. Option D is correct because Microsoft 365 Business Basic already includes OneDrive and SharePoint for mobile file access via their respective apps, and Microsoft Teams for video meetings. These services meet the sales team's requirements without any additional licensing or plan upgrade, as Teams supports video conferencing and OneDrive/SharePoint provide secure remote file access on mobile devices.

Answer

Subscribe to a Microsoft Teams Rooms license for each user.

Answer

Upgrade all users to Microsoft 365 Business Standard to get desktop Office and additional features.

Answer

Deploy a third-party VPN solution to secure remote access to files.

Question 4

A non-profit organization uses Microsoft 365 Business Basic. They have 50 staff members who need to collaborate on documents in real time. The executive director wants to set up a centralized repository for all organizational policies that can be accessed by staff both online and offline on their mobile devices. Which solution should the organization use?

Accepted Answer

Create a SharePoint Online document library with versioning and enable offline sync.. SharePoint Online document libraries support versioning, granular permissions, and offline sync via the OneDrive sync client or mobile app, making them ideal for a centralized, always-accessible policy repository. This meets the requirements for real-time collaboration and offline access on mobile devices.

Answer

Store documents in Exchange Online mailboxes as attachments.

Answer

Create a Microsoft Teams team with a channel for policies and use the Files tab.

Answer

Use OneDrive for Business shared folders for each policy document.

Question 5

A healthcare organization uses Microsoft 365 E5 and must comply with HIPAA. They need to ensure that all emails containing protected health information (PHI) are encrypted both in transit and at rest. They also need to prevent users from accidentally sending PHI to external recipients. What should they implement?

Accepted Answer

Implement Microsoft Purview Message Encryption and create DLP policies to detect and block PHI sent externally.. Microsoft Purview Message Encryption (MPME) provides the necessary encryption for PHI in transit and at rest by using Azure Rights Management (RMS) to protect emails. Data Loss Prevention (DLP) policies in Microsoft Purview can be configured to detect patterns like social security numbers or medical record numbers and automatically block or warn users before sending such emails externally, preventing accidental PHI exposure.

Answer

Use Microsoft Entra ID Conditional Access to require MFA for all email access.

Answer

Configure Microsoft Defender for Office 365 Safe Attachments and Safe Links policies.

Answer

Deploy Microsoft Purview Compliance Manager to assess compliance with HIPAA.

Question 6

A financial services company uses Microsoft 365 E5 and wants to implement a data loss prevention (DLP) policy that blocks users from sharing credit card numbers via email and Teams messages. The compliance team also wants to generate reports on policy violations. They are considering using Microsoft Purview. Which approach should they take to meet these requirements with minimum administrative overhead?

Accepted Answer

Create a unified DLP policy in the Microsoft Purview compliance portal that covers Exchange and Teams.. Option A is correct because Microsoft Purview DLP policies can be created in the Microsoft Purview compliance portal to monitor and block sensitive data in Exchange Online and Teams. Option B is wrong because creating individual policies per service is more overhead. Option C is wrong because Microsoft Defender for Cloud Apps is for cloud app security, not primary DLP for email and Teams. Option D is wrong because Microsoft Sentinel is a SIEM and not designed for DLP policy enforcement.

Answer

Create separate DLP policies in Exchange admin center and Teams admin center.

Answer

Use Microsoft Sentinel to create analytics rules that detect sharing of credit card numbers.

Answer

Use Microsoft Defender for Cloud Apps to create session policies for email and Teams.

Question 7

Fabrikam Inc. is a legal firm with 500 users. They are deploying Microsoft 365 Business Premium. Requirements: (1) All sensitive emails must be automatically encrypted when sent to external recipients; (2) Users must be able to securely share files with external clients without requiring them to sign in; (3) The IT department must enforce multi-factor authentication (MFA) for all users but allow exceptions for a small group of executives; (4) All user actions in Exchange Online must be audited. Which services or features should Fabrikam use?

Accepted Answer

Microsoft Purview Message Encryption, SharePoint Online, Microsoft Entra Conditional Access, Exchange mailbox auditing. Option B is correct because Microsoft Purview Message Encryption automatically encrypts sensitive emails sent to external recipients, SharePoint Online allows file sharing with external users without requiring them to sign in (via anonymous guest links), Microsoft Entra Conditional Access can enforce MFA with policy exclusions for executive groups, and Exchange mailbox auditing captures all user actions in Exchange Online. These four services directly map to the four requirements.

Answer

Microsoft Purview Double Key Encryption, Microsoft Teams, Microsoft Entra Conditional Access, Microsoft 365 audit log

Answer

Microsoft Purview Message Encryption, OneDrive, Microsoft Entra ID Protection, Microsoft 365 audit log

Answer

Azure Information Protection, SharePoint Online, Microsoft Entra ID Protection, Exchange mailbox auditing

Question 8

A global organization with 20,000 users is running Microsoft 365 E5 licenses. Due to budget cuts, the CIO wants to reduce licensing costs by 20% while ensuring that all users still have access to Exchange Online, SharePoint, Teams, and OneDrive. The organization also needs to maintain compliance with industry regulations that require eDiscovery and retention policies. The security team is willing to give up advanced threat protection features like Microsoft Defender for Office 365 P2 and Microsoft Purview Data Loss Prevention. Which licensing strategy should the organization adopt?

Accepted Answer

Downgrade all users to Microsoft 365 E3. Microsoft 365 E3 includes Exchange Online, SharePoint, Teams, and OneDrive, and provides eDiscovery and retention policies via Microsoft Purview compliance features. Downgrading from E5 to E3 reduces licensing costs by approximately 20-30% per user while retaining the required core productivity and compliance capabilities, and removes advanced threat protection (Defender for Office 365 P2, DLP) that the security team is willing to give up.

Answer

Switch to Microsoft 365 F3 for all users

Answer

Keep E5 but remove all add-on licenses

Answer

Switch to Microsoft 365 Business Premium for all users

Question 9

A small business with 25 employees is starting to use Microsoft 365. The owner purchased Microsoft 365 Business Basic licenses for everyone. After a month, employees report that they need the desktop versions of Word, Excel, and PowerPoint. The owner wants to upgrade the licenses but does not want to pay for features they don't need, such as advanced security. They also want to ensure that all users can continue using email, Teams, and SharePoint. Which licensing change should the owner make?

Accepted Answer

Upgrade to Microsoft 365 Business Premium. Option A is correct because Microsoft 365 Business Premium includes desktop Office apps plus all the services they already have. Option B is wrong because E3 is more expensive and designed for larger organizations. Option C is wrong because F3 does not include desktop Office apps. Option D is wrong because Exchange Online Plan 1 does not include desktop apps.

Answer

Upgrade to Microsoft 365 E3

Answer

Upgrade to Microsoft 365 F3

Answer

Purchase Exchange Online Plan 1 add-on

Question 10

Contoso Ltd. is a global consulting firm with 5,000 employees. They use Microsoft 365 E5 and have recently deployed Microsoft Copilot for Microsoft 365 to enhance productivity. The IT team wants to ensure that users' interactions with Copilot are compliant with the company's data retention policies. They need to retain all Copilot interactions for 7 years for legal reasons. Which Microsoft Purview solution should the IT team implement?

Accepted Answer

Create retention policies for Copilot interactions. Option C is correct because retention policies in Microsoft Purview can be applied to Copilot interactions stored in Exchange Online and SharePoint Online. Option A is wrong because sensitivity labels classify data but do not enforce retention. Option B is wrong because DLP prevents data loss but does not retain data. Option D is wrong because eDiscovery is for searching content, not setting retention.

Answer

Apply sensitivity labels to Copilot data

Answer

Set up eDiscovery cases for Copilot data

Answer

Configure Data Loss Prevention (DLP) policies

Question 11

Litware Inc. is a law firm that uses Microsoft 365 E5. They have a requirement to preserve all communications between attorneys and clients as legal hold for ongoing litigation. The legal team needs to identify and preserve all relevant emails and documents from specific users. The preservation should be indefinite until the hold is released. The IT team has enabled Litigation Hold for the mailboxes of the involved users. However, the legal team also needs to preserve documents in SharePoint Online and OneDrive for Business. What should you do to preserve the documents?

Accepted Answer

Create an eDiscovery case and place a hold on the relevant SharePoint sites and OneDrive accounts.. Option C is correct. A eDiscovery hold can be placed on specific sites and mailboxes for a specific case. Option A (Litigation Hold) only applies to mailboxes, not SharePoint/OneDrive. Option B (retention policy) is for time-based retention, not indefinite hold. Option D (label) does not preserve content permanently.

Answer

Create a retention policy in Microsoft Purview to retain all documents in the involved sites for 10 years.

Answer

Enable Litigation Hold for the users' OneDrive for Business accounts.

Answer

Apply a retention label to all documents in the involved sites.

Question 12

South Ridge School District uses Microsoft 365 Education A5. They have 10,000 students and 1,000 staff. The district wants to ensure that student data is protected and that only authorized staff can access student records. They also need to comply with FERPA (Family Educational Rights and Privacy Act). The IT team has created security groups for teachers, administrators, and support staff. They want to restrict access to a specific SharePoint site containing student records to only the teachers group. Additionally, they want to prevent teachers from sharing the site with external users. What should you configure?

Accepted Answer

In the SharePoint site settings, set the site permissions to 'Only members of the Teachers group can access' and set external sharing to 'Only people in your organization'.. Option A is correct. Sharing controls in SharePoint site settings can be used to limit access to specific groups and disable external sharing. Option B (private channel) is for Teams, not SharePoint. Option C (sensitivity label) can restrict access but is not site-specific. Option D (site collection admin) does not restrict sharing.

Answer

Apply a sensitivity label to the site that restricts access to the teachers group.

Answer

Add the teachers group as site collection administrators.

Answer

Create a private channel in Microsoft Teams for teachers only.

Question 13

Adatum Corporation is a small business with 50 employees. They use Microsoft 365 Business Basic and SharePoint Online for document management. Employees frequently share files with external partners via email attachments. The CEO wants to reduce the risk of data leaks and ensure that shared files are protected even after they are sent. Which Microsoft 365 solution should Adatum implement?

Accepted Answer

Microsoft Purview Message Encryption. Option A is correct because Microsoft Purview Message Encryption allows encrypting emails and attachments, and can restrict actions like forwarding. Option B is wrong because SharePoint external sharing controls access to SharePoint, not email attachments. Option C is wrong because DLP policies prevent sharing but do not protect after sending. Option D is wrong because sensitivity labels can be applied manually but do not automatically protect attachments in transit.

Answer

SharePoint external sharing settings

Answer

Data Loss Prevention (DLP) policies

Answer

Sensitivity labels

Question 14

You are the compliance officer for Fabrikam, a medium-sized company with 500 users on Microsoft 365 Business Premium. Fabrikam must comply with the California Consumer Privacy Act (CCPA). The legal team has identified that they need to be able to respond to consumer requests to delete personal data within 45 days. They also need to ensure that personal data is not retained longer than necessary. You have been asked to configure Microsoft Purview to meet these requirements. Specifically, you need to search for and delete personal data when a deletion request is received, and set up a data retention policy to automatically delete personal data after 2 years. What should you do?

Accepted Answer

Use Content Search to find personal data, then use eDiscovery to delete it for deletion requests. Create a retention policy with a retention period of 2 years for all SharePoint sites and OneDrive accounts.. Option B is correct because to delete personal data for a specific user, you need to use Content Search to find the data and then eDiscovery to delete it. A retention policy can be set to automatically delete data after 2 years. Option A is incorrect because a retention label is for manual application, not automatic deletion. Option C is incorrect because DLP does not delete data. Option D is incorrect because auto-labeling does not delete data.

Answer

Implement auto-labeling to label personal data and configure a retention label to delete after 2 years.

Answer

Create a retention label that deletes data after 2 years and apply it manually to all documents containing personal data.

Answer

Configure a DLP policy to block sharing of personal data and set a retention policy for 2 years.

Question 15

Your company, Contoso Ltd., has a Microsoft 365 E5 subscription with 500 users. The IT department recently discovered that some employees are sharing sensitive customer data via email with external parties. You need to implement a solution that automatically detects and prevents the sharing of credit card numbers and social security numbers in emails. The solution should notify the sender when a potential violation occurs and allow them to override the block by providing a business justification. The compliance team must be able to review these overrides. What should you configure?

Accepted Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy in the Microsoft Purview compliance portal.. Option B is correct. A Microsoft Purview Data Loss Prevention (DLP) policy can be configured to detect sensitive info types like credit card numbers and SSNs, with actions to block and notify the sender with an override option. Option A (Exchange mail flow rules) is less flexible and doesn't provide the override with justification. Option C (sensitivity labels) is for classification, not blocking. Option D (Microsoft Defender for Office 365) focuses on threats, not data protection.

Answer

Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links.

Answer

Create a sensitivity label with auto-labeling for emails containing sensitive data.

Answer

Create an Exchange mail flow rule to block emails containing sensitive data and send a non-delivery report.

Question 16

Contoso Ltd. is a multinational corporation with 10,000 employees. They have recently adopted Microsoft 365 E5 and want to implement a comprehensive security and compliance strategy. Their requirements include: 1) All sensitive emails must be encrypted in transit and at rest. 2) Access to SharePoint sites containing financial data must be restricted to employees from the finance department only, and only from compliant devices. 3) They need to detect and remediate insider threats involving data exfiltration via email and cloud storage. 4) They must comply with GDPR and be able to respond to DSARs within 30 days. 5) They want to use Microsoft 365 Copilot but ensure that Copilot only accesses data that users already have permission to see. Which combination of Microsoft 365 solutions should Contoso implement?

Accepted Answer

Use Microsoft Purview Message Encryption, Conditional Access with device compliance, Microsoft Purview Insider Risk Management, eDiscovery (Premium), and Copilot's default permissions.. Option D is the best answer because it covers all requirements: Microsoft Purview Message Encryption (email encryption), Conditional Access with device compliance (restrict access), Insider Risk Management (insider threats), eDiscovery (DSARs), and Copilot's built-in permissions (least privilege). Option A lacks device compliance and proper insider threat detection. Option B uses Intune app protection instead of Conditional Access, which is less specific for SharePoint access. Option C uses retention policies for DSARs, which is incorrect.

Answer

Enable Microsoft Purview Message Encryption, Conditional Access with device compliance, Microsoft Purview Insider Risk Management, Microsoft Purview eDiscovery (Premium), and Copilot with default permissions.

Answer

Deploy Azure Information Protection for email, Microsoft Entra ID Privileged Identity Management, Microsoft Sentinel, retention policies, and Copilot settings.

Answer

Implement Microsoft Purview Message Encryption, Microsoft Intune device compliance, Microsoft Defender for Cloud Apps, retention policies, and Copilot configuration.

Question 17

Wide World Importers is a financial services company that must comply with GDPR. They use Microsoft 365 E5 and have enabled audit logging. The Data Protection Officer (DPO) needs to be able to search and export all audit records related to a specific user's activities for the past 90 days. The DPO is not a global admin and should only have permissions to view and export audit logs. You need to provide the DPO with the appropriate access. What should you do?

Accepted Answer

Add the DPO to the 'Audit Logs' role in the Microsoft Purview compliance portal.. Option B is correct. The 'Audit Logs' role in the Microsoft Purview compliance portal allows read and export access to audit logs. Option A (global admin) gives too many permissions. Option C (Security Reader) in Microsoft Entra ID does not include Purview audit log access. Option D (Compliance Administrator) is a broader role that includes many other permissions.

Answer

Add the DPO to the Global Administrator role.

Answer

Assign the Security Reader role in Microsoft Entra ID.

Answer

Assign the Compliance Administrator role in Microsoft Entra ID.

Question 18

You are the security administrator for Contoso, a global consulting firm with 10,000 employees. Contoso uses Microsoft 365 E5 and Microsoft Entra ID P2. The company has a strict policy that all sensitive client data must be encrypted at rest and in transit. Additionally, the legal team requires that any document labeled as 'Highly Confidential' must be automatically encrypted and cannot be printed or forwarded. You have created a sensitivity label called 'Highly Confidential' with encryption and a protection setting that restricts actions like printing. However, you notice that users are still able to print documents that have the label applied. After investigation, you find that the label is correctly configured but users are manually applying the label. What should you do to ensure the label is consistently applied and printing is blocked?

Accepted Answer

Create an auto-labeling policy that automatically applies the 'Highly Confidential' label to documents that contain certain sensitive information types, and ensure the label's protection settings block printing.. Option C is correct because auto-labeling policies can automatically apply the sensitivity label based on conditions, ensuring consistent application. Additionally, the label's protection settings should block printing. Option A is incorrect because creating a DLP policy that blocks printing may not respect the sensitivity label's settings. Option B is incorrect because the label already has protection settings, but the issue is manual application. Option D is incorrect because Conditional Access does not control document actions like printing.

Answer

Create a Data Loss Prevention (DLP) policy that blocks printing of documents with the 'Highly Confidential' label.

Answer

Configure a Conditional Access policy that blocks printing for users accessing documents from unmanaged devices.

Answer

Modify the sensitivity label's encryption settings to require user authentication before printing.

Question 19

You are the IT administrator for a non-profit organization that uses Microsoft 365 Business Basic. The organization has 50 volunteers who use their own personal devices to access email and SharePoint Online. The board of directors wants to ensure that if a volunteer's device is lost or stolen, the organization's data on that device can be removed remotely. They also want to ensure that volunteers use multi-factor authentication (MFA) to access corporate resources. What should you do?

Accepted Answer

Enroll devices in Microsoft Intune and configure a selective wipe policy. Set up a Conditional Access policy in Microsoft Entra ID to require MFA.. Option D is correct because Microsoft Intune can be used to manage mobile devices and perform selective wipe to remove corporate data. Conditional Access in Microsoft Entra ID can enforce MFA. Option A is incorrect because DLP does not wipe devices. Option B is incorrect because Microsoft Defender for Cloud Apps is for cloud app security, not device wipe. Option C is incorrect because Microsoft Purview does not manage devices.

Answer

Deploy Microsoft Defender for Cloud Apps and configure session controls.

Answer

Use Microsoft Purview to label all corporate data and configure a policy to revoke access.

Answer

Implement a Data Loss Prevention (DLP) policy that blocks access from unmanaged devices.

Question 20

Northwind Traders is a legal firm that uses Microsoft 365 E5. They have strict regulatory requirements to retain all email communications for 7 years. Additionally, they need to ensure that employees cannot permanently delete emails before the retention period ends. The IT team has implemented a retention policy in Microsoft Purview to retain all Exchange Online mailboxes for 7 years after creation. However, users are still able to delete emails and permanently delete them from the Recoverable Items folder. You need to ensure that emails are preserved even if users try to delete them. What should you do?

Accepted Answer

Enable Litigation Hold for all mailboxes.. Option A is correct. Litigation Hold preserves all mailbox content indefinitely, preventing any permanent deletion. Retention policies alone do not prevent deletion; they only retain deleted items for the specified period. Option B (MRM policy) is for managing mailbox storage, not preservation. Option C (in-place hold) is similar but requires targeting specific mailboxes. Option D (eDiscovery hold) is for legal cases, not broad retention.

Answer

Place an In-Place Hold on all mailboxes.

Answer

Configure an eDiscovery hold for all mailboxes.

Answer

Create a new retention tag in the default MRM policy to prevent deletion.