MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 10 — 15 Questions

Question 1

Which THREE of the following are valid data subject rights under GDPR? (Choose three.)

Accepted Answer

Right to data portability. GDPR grants individuals rights such as the right to erasure, data portability, and access. Options A, B, and C are correct. Option D (Right to perpetual storage) is not a GDPR right.

Answer

Right to perpetual storage

Answer

Right to monetization of data

Question 2

Which TWO of the following are capabilities of Microsoft Priva? (Choose two.)

Accepted Answer

Automate subject rights requests. Microsoft Priva helps organizations manage privacy risks by assessing data transfer risks and automating subject rights requests. Options A and C are correct.

Answer

Configure retention labels

Answer

Monitor network traffic

Answer

Detect malware in email attachments

Question 3

Which THREE of the following are key pillars of the Microsoft Trusted Cloud? (Choose three.)

Accepted Answer

Security. Microsoft's Trusted Cloud is built on three key pillars: security, privacy, and compliance. Therefore, options C (Security), D (Privacy), and E (Compliance) are correct. Options A (Cost optimization) and B (Performance) are not pillars of the Trusted Cloud.

Answer

Cost optimization

Answer

Performance

Question 4

A company is deploying Microsoft 365 Copilot and wants to ensure that only users with the appropriate sensitivity labels can access Copilot-generated content. What should the administrator configure to enforce this requirement?

Accepted Answer

Enable auto-labeling for sensitivity labels in Microsoft Purview Information Protection. Auto-labeling for sensitivity labels in Microsoft Purview Information Protection can automatically apply sensitivity labels based on content classification, and Copilot-generated content will respect these labels, ensuring only authorized users can access it. Option A is wrong because retention labels manage data retention, not access control. Option B is wrong because Conditional Access policies control access to apps and resources but do not automatically label content. Option C is wrong because DLP policies prevent data sharing but do not enforce sensitivity labeling on content.

Answer

Create a retention label policy in Microsoft Purview

Answer

Create a Conditional Access policy in Microsoft Entra ID

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview

Question 5

A user reports receiving a phishing email in their Outlook inbox. The organization uses Microsoft Defender for Office 365. Which feature should the user use to report the email to the security team?

Accepted Answer

Use the Report Message add-in in Outlook. The Report Message add-in in Outlook allows users to easily report phishing emails to Microsoft and the organization’s security team for analysis. Option B is incorrect because blocking the sender only prevents future emails from that address but does not report the incident. Option C is incorrect because the Microsoft 365 Defender portal is typically used by administrators, not end users, to submit emails. Option D is incorrect because Safe Links is a protection feature that scans URLs, not a reporting mechanism.

Answer

Block the sender in Outlook

Answer

Submit the email to the Microsoft 365 Defender portal

Answer

Enable Safe Links in Outlook

Question 6

An administrator configures the SharePoint Online sharing policy as shown in the exhibit. What is the result of this configuration?

Accepted Answer

External users and guests from fabrikam.com can access content after accepting an invitation.. The policy allows external users and guests from fabrikam.com to access content after they accept the sharing invitation. The allowed domain list permits fabrikam.com, and the requirement for invitation acceptance is implied by the non-'Anyone' sharing setting. Option A is wrong because external users must accept an invitation; they are not allowed to access content without accepting. Option B is wrong because external users and guests from fabrikam.com can access, but they must accept an invitation; they are not added manually in this context. Option D is wrong because external sharing is not blocked for all domains except fabrikam.com; rather, sharing is allowed only from fabrikam.com.

Answer

External users from any domain can access content without accepting an invitation.

Answer

Only guests from any domain can access, but external users must be added manually.

Answer

External sharing is blocked for all domains except fabrikam.com.

Question 7

A company uses Microsoft Purview Communication Compliance to detect inappropriate messages. Which action can an administrator take after reviewing a flagged message?

Accepted Answer

Resolve the case with a notification to the sender. Microsoft Purview Communication Compliance provides actions such as 'Resolve with notification' to notify the sender after reviewing a flagged message. Option A is incorrect because retention policies are configured separately and not directly applied from Communication Compliance. Option B is incorrect because while Communication Compliance can feed into DLP policies, it does not create a DLP policy automatically from a single flagged message. Option D is incorrect because message recall is an Exchange Online feature, not a direct action within Communication Compliance.

Answer

Apply a retention policy to the message

Answer

Create a DLP policy based on the message

Answer

Recall the message from the recipient

Question 8

An organization wants to ensure that only compliant devices can access Microsoft 365 resources. They use Microsoft Intune for device management. Which policy should they configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID. Conditional Access in Microsoft Entra ID uses compliance status from Intune to allow or block access. Option A is wrong because compliance policies define what compliance means, but the access control is done by Conditional Access. Option C is wrong because configuration policies configure settings, not access. Option D is wrong because device enrollment is the process of joining devices to management.

Answer

Enable device enrollment in Intune

Answer

Create a compliance policy in Intune

Answer

Create a device configuration policy in Intune

Question 9

An administrator is assigned the Global Reader role in Microsoft Entra ID as shown in the exhibit. What can this administrator do?

Accepted Answer

View all user and group properties in the directory. The Global Reader role in Microsoft Entra ID is a read-only role that allows viewing all directory settings, including user and group properties, but does not grant any write permissions. This enables the administrator to view but not modify user or group attributes, making option A correct.

Answer

Reset user passwords

Answer

Assign administrative roles to other users

Answer

Create new users in the directory

Question 10

A company needs to meet GDPR compliance requirements for data subject requests. Which Microsoft Purview tool should they use to manage these requests?

Accepted Answer

Data Lifecycle Management [wrong]. Microsoft Purview Data Lifecycle Management includes functionality to manage data subject requests (DSRs) under GDPR, such as finding and acting on personal data. Option A is wrong because eDiscovery (Premium) is used for legal discovery, not for managing DSRs. Option B is wrong because Compliance Manager assesses compliance posture and provides recommendations but does not directly execute DSRs. Option C is wrong because Audit (Premium) logs activities but does not provide DSR management capabilities.

Answer

eDiscovery (Premium) [wrong]

Answer

Compliance Manager [CORRECT]

Answer

Audit (Premium) [wrong]

Question 11

An organization uses Microsoft Defender XDR and wants to investigate a potential ransomware attack. Which portal should the security team use to see the full attack timeline?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal provides a unified incident view with the full attack timeline, making it the correct portal for investigating a potential ransomware attack. Option A is incorrect because the Microsoft Purview compliance portal is focused on compliance and data governance, not attack timelines. Option B is incorrect because Microsoft Sentinel is a SIEM tool that can ingest data from various sources but is not the primary portal for Microsoft 365 Defender's incident timeline. Option C is incorrect because the Azure portal is used for managing Azure resources and does not provide the attack timeline for Microsoft 365 Defender.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel

Answer

Azure portal

Question 12

A user needs to sign in to Microsoft 365 from an untrusted device. The company requires multifactor authentication (MFA) for all external access. Which Microsoft Entra ID feature enforces this requirement?

Accepted Answer

Conditional Access. Conditional Access policies can require MFA based on conditions such as device trust. Option A (Microsoft Entra ID Protection) is wrong because it detects risks but does not directly enforce MFA. Option B (Security defaults) is wrong because they provide a baseline security but are not customizable for specific conditions like untrusted devices. Option C (Microsoft Entra ID Password Protection) is wrong because it prevents weak passwords but does not enforce MFA.

Answer

Microsoft Entra ID Protection

Answer

Security defaults

Answer

Microsoft Entra ID Password Protection

Question 13

Which TWO components are part of Microsoft's Service Trust Portal?

Accepted Answer

Audit reports and compliance guides. Options A and C are correct. The Service Trust Portal provides compliance reports, audit reports, and trust documents. Options B, D, and E are not part of the Service Trust Portal; they are separate portals.

Answer

Azure portal

Answer

Microsoft Purview compliance portal

Answer

Microsoft 365 Defender portal

Question 14

Which THREE actions can be performed using Microsoft Purview Data Loss Prevention (DLP) policies?

Accepted Answer

Display a policy tip to the user when sensitive data is detected. Options A, B, and E are correct. DLP policies can display policy tips (A), restrict access to sensitive documents (B), and block sharing of sensitive information via email (E). Option C is incorrect because applying sensitivity labels is not a DLP action; it is performed by Microsoft Purview Information Protection auto-labeling policies. Option D is incorrect because auditing all access to SharePoint sites is managed by Microsoft Purview Audit, not DLP.

Answer

Apply sensitivity labels automatically

Answer

Audit all access to SharePoint sites

Question 15

Which TWO are true about Microsoft's data residency commitments in the Microsoft 365 Trust Center?

Accepted Answer

Customers can choose where their data is stored at rest. Options A and E are correct. Microsoft offers data residency options in the Microsoft 365 Trust Center, allowing customers to choose the geographic region where their data is stored at rest (A). This confirms that Microsoft provides data residency options for customer data (E). Option B is incorrect because while data is primarily stored in the selected region, it may be replicated or processed in other regions for disaster recovery or performance purposes. Option C is incorrect because customer data is encrypted both at rest and in transit, not only in transit. Option D is incorrect because customer data can be stored in a broader geographic region (e.g., North America) rather than strictly the customer's country.

Answer

Data never leaves the selected geographic region

Answer

All customer data is encrypted in transit only

Answer

Customer data is always stored in the customer's country only