MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 10 — 15 Questions

Question 1

Match each Microsoft 365 compliance term to its definition.

Question 2

Match each Microsoft 365 pricing model to its description.

Question 3

Your organization is deploying Microsoft 365 and needs to ensure that data stored in SharePoint Online and OneDrive for Business is protected against accidental deletion by end users. The compliance team requires that deleted files be recoverable for at least 90 days. What should you implement?

Accepted Answer

Create a Microsoft Purview retention policy with a retention period of 90 days.. Option C is correct because the Microsoft Purview retention policy with a retention action of 'Keep items for 90 days' preserves deleted items for the specified period. Option A is wrong because versioning only keeps previous versions, not deleted items. Option B is wrong because recycle bin default retention is 93 days but can be changed, but a retention policy provides a guaranteed 90-day retention. Option D is wrong because DLP policies do not retain deleted items.

Answer

Enable versioning on all document libraries.

Answer

Increase the SharePoint Online recycle bin retention to 90 days.

Answer

Configure a Microsoft Purview Data Loss Prevention (DLP) policy for SharePoint.

Question 4

Refer to the exhibit. You are reviewing a Microsoft Purview Information Protection policy created by a colleague. The policy is intended to prevent users from sharing files labeled 'Highly Confidential' with external parties. However, users are still able to share these files externally. Which of the following is the most likely reason?

Accepted Answer

The sensitivity label is not published to the users.. Option A is correct because the policy uses sensitivityLabels condition, but the correct property should be 'sensitivityLabelIds' (or equivalent) and the label must be published. Option B is wrong because the condition is based on sensitivity labels, not file extensions. Option C is wrong because the action blockSharing is correctly specified. Option D is wrong because the policy is not missing an action; the action is present.

Answer

The policy is missing the 'blockAccess' action.

Answer

The action should be set to 'blockAccess' only.

Answer

The condition should check for file extension instead of sensitivity label.

Question 5

A company wants to ensure that all Microsoft 365 users authenticate using multi-factor authentication (MFA). Which Microsoft 365 security feature should they configure?

Accepted Answer

Microsoft Entra ID Conditional Access. Option B is correct because Microsoft Entra ID Conditional Access policies can enforce MFA for all users. Option A is wrong because Microsoft Defender XDR is for threat detection and response. Option C is wrong because Microsoft Intune is for device management. Option D is wrong because Microsoft Purview is for compliance and information protection.

Answer

Microsoft Intune compliance policies

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender XDR

Question 6

Your organization uses Microsoft 365 E5 and wants to automatically classify emails containing credit card numbers as 'Sensitive' and apply encryption when sent externally. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Option D is correct because Microsoft Purview Data Loss Prevention (DLP) can detect sensitive data like credit card numbers and automatically apply actions such as encryption. Option A is wrong because Sensitivity labels are manually applied or auto-classified, but DLP handles the automatic protection. Option B is wrong because Retention policies are for retention, not classification. Option C is wrong because Information Protection policies include sensitivity labels, but the automatic encryption action is typically configured via DLP.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 7

A multinational company must comply with the General Data Protection Regulation (GDPR). They need to be able to search for and delete personal data of a user upon request (right to erasure). Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Option C is correct because Microsoft Purview eDiscovery (Premium) allows searching for content across Microsoft 365 and can be used to facilitate data deletion. Option A is wrong because Audit (Standard) only logs activities. Option B is wrong because Communication Compliance monitors communications. Option D is wrong because Insider Risk Management identifies risky activities.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management

Question 8

Your organization uses Microsoft 365 Business Premium. You need to protect users from phishing attacks by blocking malicious links in real-time when they click them in emails. Which feature provides this capability?

Accepted Answer

Microsoft Defender for Office 365 Safe Links. Option A is correct because Microsoft Defender for Office 365 Safe Links provides time-of-click protection against malicious URLs. Option B is wrong because Safe Attachments scans attachments. Option C is wrong because Anti-spam policies filter spam. Option D is wrong because Microsoft Defender XDR is a broader security suite.

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Exchange Online Protection (EOP) anti-spam policy

Answer

Microsoft Defender XDR

Question 9

Refer to the exhibit. A Microsoft 365 administrator runs the PowerShell script against Microsoft Entra ID. The script outputs several enabled Conditional Access policies. However, users report they are not prompted for MFA even though there is an enabled policy that should require MFA for all users. What is the most likely reason?

Accepted Answer

The policy is set to 'report-only' mode.. Option D is correct because the script checks if the policy state is enabled, but does not check if the policy is in 'report-only' mode. A policy can be enabled but set to report-only, which does not enforce MFA. Option A is wrong because the script checks all enabled policies. Option B is wrong because the script is used for policy listing, not enforcement. Option C is wrong because the script does not modify policies.

Answer

The script is not executed with administrative privileges.

Answer

The script does not run against all policies.

Answer

The script disables the MFA policy inadvertently.

Question 10

An organization needs to ensure that all Microsoft 365 data is encrypted at rest and in transit. Which of the following is a built-in encryption mechanism in Microsoft 365?

Accepted Answer

BitLocker Drive Encryption. Option D is correct because Microsoft 365 uses BitLocker Drive Encryption for data at rest in datacenters. Option A is wrong because third-party key management is not built-in. Option B is wrong because Azure Information Protection is a separate solution. Option C is wrong because Office 365 Message Encryption is for email, not all data.

Answer

Customer-managed keys (CMK) using Azure Key Vault

Answer

Office 365 Message Encryption

Answer

Azure Information Protection

Question 11

Your company uses Microsoft 365 E5 and has enabled Microsoft Purview Audit (Premium). The security team needs to investigate a potential data breach by searching for all activities related to a specific user in the last 90 days. Which tool should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Option B is correct because Microsoft Purview eDiscovery (Premium) allows searching across content locations for specific users and time frames. Option A is wrong because Audit (Premium) provides audit logs but not a consolidated search across all data. Option C is wrong because Content Search is a more basic tool. Option D is wrong because Compliance Manager is for assessing compliance posture.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Content Search

Answer

Microsoft Purview Audit (Premium) log search

Question 12

Which TWO of the following are features of Microsoft Purview that help organizations meet compliance requirements for data lifecycle management? (Choose two.)

Accepted Answer

Retention policies. Option A is correct: Retention policies manage data lifecycle. Option D is correct: Records management helps manage records retention. Option B is wrong because DLP is for data loss prevention, not lifecycle. Option C is wrong because eDiscovery is for search and export. Option E is wrong because Insider Risk Management is for risk detection.

Answer

eDiscovery (Premium)

Answer

Insider Risk Management

Answer

Data Loss Prevention (DLP) policies

Question 13

Which THREE of the following are capabilities of Microsoft Entra ID that support identity security? (Choose three.)

Accepted Answer

Privileged Identity Management (PIM). Option A is correct: Conditional Access enforces access policies. Option C is correct: Identity Protection detects risks. Option D is correct: Privileged Identity Management (PIM) manages privileged roles. Option B is wrong because Microsoft Defender XDR is a separate security product. Option E is wrong because Microsoft Intune is for device management.

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 14

Which TWO of the following are examples of Microsoft's commitments to data privacy as outlined in the Microsoft Privacy Statement and related agreements? (Choose two.)

Accepted Answer

Customers can access and export their data.. Option A is correct: Microsoft does not use customer data for advertising. Option C is correct: Microsoft provides data portability. Option B is wrong because Microsoft does share data with third parties for marketing. Option D is wrong because Microsoft does not use customer data for AI training without consent. Option E is wrong because Microsoft does not allow third-party access without customer consent.

Answer

Microsoft uses customer data to train AI models by default.

Answer

Microsoft may share customer data with third parties for marketing purposes.

Answer

Microsoft allows third parties to access customer data without consent.

Question 15

Which THREE of the following are security features included in Microsoft 365 Business Premium? (Choose three.)

Accepted Answer

Microsoft Entra ID Plan 1. Option A is correct: Microsoft Defender for Business is included. Option B is correct: Microsoft Entra ID Plan 1 is included. Option D is correct: Microsoft Purview DLP is included. Option C is wrong because Microsoft Sentinel is not included in Business Premium. Option E is wrong because Microsoft Defender for Cloud Apps (Cloud App Security) is not included as a full feature; some capabilities are included but not the full product.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps