MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 — 20 Questions

Question 1

A company needs to ensure that all email and document content is preserved for legal purposes, even if users permanently delete items. This requirement demands that content be kept indefinitely until the legal hold is released. Which Microsoft 365 feature should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

eDiscovery. eDiscovery allows you to place an eDiscovery hold on all content locations, including Exchange mailboxes and SharePoint/OneDrive sites, preserving all items indefinitely until the hold is removed. Litigation hold is limited to mailboxes. Retention policies can also preserve content but are not specifically designed for legal hold with manual release.

Answer

Retention policy

Answer

Litigation hold

Answer

Data Loss Prevention (DLP)

Question 2

A healthcare organization must protect patient health information (PHI) from being accidentally shared externally via email. They need to automatically block emails containing medical record numbers from being sent outside the organization and also encrypt any email that does contain PHI when it is allowed. Which two Microsoft Purview solutions should they combine? (Choose two.)

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) detects sensitive data such as medical record numbers and can apply actions to block external transmission when needed. For cases where PHI is allowed to be sent, DLP can enforce encryption by integrating with Microsoft Purview Message Encryption, which secures the email for external recipients. Therefore, both DLP and Message Encryption are required: DLP for detection and policy enforcement, and Message Encryption for the actual encryption of allowed emails.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit (Standard)

Question 3

A compliance officer wants to ensure that all data in Microsoft 365 is encrypted using a key that the organization manages and stores in their own Azure Key Vault. Microsoft will not have access to the key. Which solution should they implement?

Accepted Answer

Double Key Encryption (DKE). Double Key Encryption (DKE) protects specific files using two keys: one in Azure Key Vault and one managed by Microsoft. It is not a tenant-wide encryption solution. For encrypting all Microsoft 365 data with a key that Microsoft cannot access, Microsoft 365 Customer Key is the appropriate feature, but it is not among the options.

Answer

Customer Lockbox

Answer

Information Rights Management (IRM)

Answer

Microsoft Purview Data Lifecycle Management

Question 4

A company wants to ensure that all administrative actions in Microsoft 365 are logged and that any changes to roles and permissions are reviewed on a monthly basis. Which Microsoft Purview solution should the compliance team use?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is the correct solution because it provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions. PIM also generates audit logs for role activations and changes, and supports periodic access reviews (e.g., monthly reviews of role assignments) through Microsoft Entra ID access reviews, directly meeting the requirement to review changes to roles and permissions on a monthly basis.

Answer

Audit (Standard)

Answer

Audit (Premium)

Answer

Privileged Access Management

Question 5

A multinational corporation must ensure that all Microsoft 365 admin actions—such as adding a new user or changing a role—are recorded and searchable for at least 90 days. They also need to create custom alert rules to notify the security team when critical events occur, like disabling multi-factor authentication. Which Microsoft Purview solution should they use to meet both requirements?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides 1-year default retention and includes high-value events such as disabling MFA, which are not recorded in Standard. While Standard retains logs for 90 days, it does not capture the critical event mentioned, so it fails the requirement. Custom alert policies are available in both Standard and Premium, but Premium is needed for alerts on high-value events.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft 365 Defender portal

Question 6

A security team needs to ensure that all Microsoft 365 administrative actions—such as creating user accounts or resetting passwords—are logged and searchable for at least 90 days. They also need to create custom alert rules for suspicious admin activity. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) logs and retains all administrative actions (e.g., creating users, resetting passwords) for 90 days by default, meeting the retention requirement. It also supports creating custom alert rules for suspicious admin activity via the Microsoft 365 Defender portal, which queries the audit log. This makes it the correct solution for both logging and alerting on admin actions.

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Defender for Cloud Apps

Question 7

A security team needs to monitor all administrative activities in Microsoft 365, including creating users, resetting passwords, and modifying policies. They require that logs be retained for at least 90 days and want to create custom alerts for suspicious admin actions (e.g., multiple password resets in a short time). Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides extended log retention of up to one year (or more with add-ons), which meets the 90-day requirement, and it supports custom alert policies via the Microsoft 365 Defender portal to detect suspicious admin activities like multiple password resets. Standard Audit only retains logs for 90 days but lacks the advanced alerting and investigation capabilities needed for custom alerts on admin actions.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID reporting

Question 8

A tenant administrator is advising a department that wants to investigate incidents across identities, email, endpoints, and cloud apps in one experience. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security operations platform that correlates alerts and incidents across identities (Microsoft Entra ID), email (Exchange Online), endpoints (Microsoft Defender for Endpoint), and cloud apps (Microsoft Defender for Cloud Apps). This single-pane-of-glass experience allows a tenant administrator to investigate incidents holistically without switching between separate consoles.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 9

A legal team needs to ensure that all documents related to an ongoing case are retained for exactly 7 years and then automatically deleted. During the retention period, no user should be able to permanently delete these documents. Which two Microsoft Purview features should be used together to meet this requirement? (Choose two.)

Accepted Answer

Retention policy. A retention policy is correct because it can be applied at the site or folder level to enforce a mandatory 7-year retention period for all documents in a location, such as a SharePoint site for the legal case. It prevents users from permanently deleting documents during the retention period by blocking deletion actions and preserving the content in a preservation hold library. A retention label is not required for this scenario because the retention policy already meets both the retention and automatic deletion requirements. Retention labels are used when different retention settings need to be applied to individual items, which is not the case here.

Answer

Retention label

Answer

Litigation hold

Answer

Data loss prevention (DLP) policy

Question 10

A company wants to ensure that sensitive documents stored in SharePoint Online are automatically classified and protected if they contain credit card numbers or social security numbers. Which Microsoft Purview feature should they implement?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to automatically detect, classify, and protect sensitive information such as credit card numbers and social security numbers. When a DLP policy is configured with sensitive information types (e.g., Credit Card Number, U.S. Social Security Number), it can scan documents in SharePoint Online and automatically apply protective actions like blocking access or triggering notifications. This makes DLP the correct feature for the described requirement.

Answer

Data Lifecycle Management (DLM)

Answer

Information Protection (Sensitivity labels)

Answer

Insider Risk Management

Question 11

A global company has a strict policy that any Microsoft 365 administrator who needs to access a user's mailbox for troubleshooting must first obtain explicit approval from the user. The company wants to implement a process that requires approval for such access and logs the activity. Which Microsoft Purview feature should they use?

Accepted Answer

Privileged Access Management (PAM). Privileged Access Management (PAM) in Microsoft Purview is specifically designed to provide just-in-time access to sensitive administrative roles and tasks, such as accessing a user's mailbox for troubleshooting. It enforces an approval workflow before the privileged operation is executed and logs all access attempts, meeting the company's requirement for explicit user approval and activity logging.

Answer

Customer Lockbox

Answer

Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 12

A legal firm must ensure that all documents containing a specific project code are automatically retained for 7 years after the project ends. After the 7-year period, the documents should be permanently deleted. The firm already uses sensitivity labels to classify documents. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Records Management. Microsoft Purview Records Management is the correct solution because it provides the ability to mark documents as records (or regulatory records) and apply retention labels that enforce a specific retention period—in this case, 7 years after the project ends—followed by automatic deletion. Records Management is designed for legal and compliance scenarios and includes disposition review and event-based retention, which align with the legal firm's requirement. While Data Lifecycle Management also supports event-based retention, it does not offer record declaration and disposition review, making Records Management the better choice for this compliance-driven requirement.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview Data Loss Prevention

Question 13

A legal department requires that when an employee deletes any email message in Exchange Online that is related to active litigation, the message must be automatically retained for an additional 5 years after deletion. The retention must be applied based on keywords found in the email content. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview retention labels with auto-labeling based on keywords. Microsoft Purview retention labels with auto-labeling based on keywords can automatically apply a retention label to emails that match specific keywords in their content. When the label is configured to retain items for 5 years after deletion, it ensures that emails related to active litigation are preserved even after the user deletes them. This meets the legal department's requirement for content-based, automatic retention.

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 14

A healthcare organization must ensure that all outgoing emails containing protected health information (PHI) are automatically encrypted. External recipients must be able to read the encrypted messages without installing any software or signing up for a service. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (C) is the correct solution because it enables automatic encryption of outgoing emails based on rules (e.g., detecting PHI) and allows external recipients to read encrypted messages via a secure web portal or inline rendering in supported email clients, without requiring any software installation or account sign-up. This directly meets the requirement for seamless, no-friction decryption by external parties.

Answer

Data Loss Prevention (DLP)

Answer

Sensitivity labels

Answer

Information protection policies

Question 15

An organization wants to retain mailbox content for legal investigation. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

eDiscovery and retention capabilities in Microsoft Purview. Option B is correct because Microsoft Purview provides the eDiscovery and retention capabilities used to preserve and search mailbox content for legal investigations, including holds such as Litigation Hold and eDiscovery Hold that keep items even if users delete them. Option C is correct because retention and eDiscovery policies should be validated with a limited pilot group before broad rollout, since misconfigured policies can affect mail flow, retention behavior, and legal exposure across the tenant. Option A is incorrect because legal retention does not require making documents public; it is about preserving content for authorized reviewers, not exposing it. Option D is incorrect because retention and eDiscovery complement, but do not replace, identity and access management controls such as Microsoft Entra ID and role-based access control.

Answer

It requires every document to be made public

Answer

It replaces the need for identity and access management

Question 16

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 (option A) is the correct capability for investigating emails tied to a phishing campaign, since it lets security teams view, filter, and pivot on email data such as sender, recipient, URL, and detection technology to identify and remediate threats. Option D is also correct because any new policy or protection configuration, including those used in phishing investigations and response, should be piloted with a limited group before broad rollout to validate behavior and avoid disrupting legitimate mail flow. Option B is incorrect because Threat Explorer is an email threat investigation and hunting tool and does not replace identity and access management, which is handled by services like Microsoft Entra ID. Option C is incorrect because investigating phishing emails never requires making documents public; that would be a severe security and compliance violation.

Answer

It replaces the need for identity and access management

Answer

It requires every document to be made public

Question 17

Your organization is deploying Microsoft 365 and needs to ensure that data stored in SharePoint Online and OneDrive for Business is protected against accidental deletion by end users. The compliance team requires that deleted files be recoverable for at least 90 days. What should you implement?

Accepted Answer

Create a Microsoft Purview retention policy with a retention period of 90 days.. A Microsoft Purview retention policy with a 90-day retention period ensures that content in SharePoint Online and OneDrive for Business is retained for at least 90 days, even if users delete it. Retention policies preserve data for the specified period and can be configured to retain only or retain-then-delete, directly satisfying the compliance requirement for recoverability.

Answer

Enable versioning on all document libraries.

Answer

Increase the SharePoint Online recycle bin retention to 90 days.

Answer

Configure a Microsoft Purview Data Loss Prevention (DLP) policy for SharePoint.

Question 18

Refer to the exhibit. You are reviewing a Microsoft Purview Information Protection policy created by a colleague. The policy is intended to prevent users from sharing files labeled 'Highly Confidential' with external parties. However, users are still able to share these files externally. Which of the following is the most likely reason?

Accepted Answer

The sensitivity label is not published to the users.. The most likely reason is that the sensitivity label is not published to the users. Even if a sensitivity label is configured with encryption and content marking, it must be published via a label policy to the intended users. If not published, users cannot apply the label, and thus the protection (e.g., blocking external sharing) does not take effect. The policy to block external sharing is typically part of the label's protection settings, but it only applies when the label is applied.

Answer

The policy is missing the 'blockAccess' action.

Answer

The action should be set to 'blockAccess' only.

Answer

The condition should check for file extension instead of sensitivity label.

Question 19

Refer to the exhibit. A Microsoft 365 administrator runs the PowerShell script against Microsoft Entra ID. The script outputs several enabled Conditional Access policies. However, users report they are not prompted for MFA even though there is an enabled policy that should require MFA for all users. What is the most likely reason?

Accepted Answer

The policy is set to 'report-only' mode.. The most likely reason users are not prompted for MFA despite an enabled Conditional Access policy requiring MFA is that the policy is set to 'report-only' mode. In report-only mode, the policy is evaluated and logged but not enforced, meaning users will not be prompted for MFA. This is a common configuration used for testing before enabling the policy in 'on' mode.

Answer

The script is not executed with administrative privileges.

Answer

The script does not run against all policies.

Answer

The script disables the MFA policy inadvertently.

Question 20

Which TWO of the following are requirements for implementing Microsoft Purview Customer Key? (Choose two.)

Accepted Answer

An Azure subscription with Azure Key Vault. Option B is correct because Customer Key requires an Azure subscription in which you create and manage the Azure Key Vault (or Managed HSM) that holds the two encryption keys used as the root of the data-at-rest encryption hierarchy for Microsoft 365 workloads. Option C is correct because implementing Customer Key requires an eligible Microsoft 365 license, specifically Microsoft 365 E5 (or the equivalent E5/G5 offerings that include the Customer Key feature). Option A is not required; Customer Key does not depend on Microsoft Entra ID Premium P2, which is tied to Identity Protection and PIM rather than key management. Option D is not required; Microsoft Defender for Cloud Apps is a CASB solution unrelated to establishing Customer Key. Option E is not required; Customer Key uses Azure Key Vault or Azure Managed HSM in Azure, not an on-premises HSM.

Answer

Microsoft Entra ID Premium P2 licenses

Answer

Microsoft Defender for Cloud Apps

Answer

An on-premises Hardware Security Module (HSM)