MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 11 — 15 Questions

Question 1

Which TWO of the following are requirements for implementing Microsoft Purview Customer Key? (Choose two.)

Accepted Answer

An Azure subscription with Azure Key Vault. Option B is correct: Customer Key requires a Microsoft 365 E5 license. Option D is correct: Customer Key uses Azure Key Vault to store keys. Option A is wrong because Customer Key does not require an on-premises HSM; it uses Azure Key Vault. Option C is wrong because Customer Key does not require Entra ID P2; E5 license suffices. Option E is wrong because Customer Key does not require Microsoft Defender for Cloud Apps.

Answer

Microsoft Entra ID Premium P2 licenses

Answer

Microsoft Defender for Cloud Apps

Answer

An on-premises Hardware Security Module (HSM)

Question 2

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel to investigate a user's deleted files. The query returns no results even though the user has deleted files. Which of the following is the most likely reason?

Accepted Answer

The Microsoft 365 connector is not configured in Sentinel.. Option C is correct because Sentinel queries the workspace's own AuditLogs table, which may not contain Microsoft 365 audit logs unless the Microsoft 365 connector is configured. Option A is wrong because the query does not filter by Result. Option B is wrong because the query uses correct syntax. Option D is wrong because the query is not incorrectly formatted.

Answer

The query filters by Result column which doesn't exist.

Answer

The query should use 'where Operation == "FileDeleted"' but the operation is 'DeleteFile'.

Answer

The UserId field should be replaced with UserPrincipalName.

Question 3

Your organization is deploying Microsoft 365 for a healthcare company that must comply with HIPAA. Which Microsoft 365 compliance feature should you use to prevent sensitive patient data from being shared externally via email?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies are designed to detect and prevent sharing of sensitive data such as health information. Options A and B are not directly about preventing data leakage, and Option D is about encryption but not policy-based prevention.

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 4

Your company wants to ensure that only managed and compliant devices can access Microsoft 365 resources. Which Microsoft 365 security feature enforces conditional access based on device compliance?

Accepted Answer

Microsoft Intune with Conditional Access in Microsoft Entra ID. Microsoft Intune manages device compliance policies, and when integrated with Conditional Access in Microsoft Entra ID, it enforces access based on compliance. Option C is the correct pairing. Options A, B, and D are not the primary tools for device compliance enforcement.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 5

A user reports receiving a phishing email that bypassed Exchange Online Protection (EOP). You need to investigate the threat and automate a response across email, endpoints, and identities. Which Microsoft 365 security solution should you use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (formerly Microsoft 365 Defender) provides unified detection and automated response across email, endpoints, and identities. Option C is correct. Option A (Defender for Office 365) focuses only on email, Option B (Defender for Endpoint) only on endpoints, and Option D (Sentinel) is a SIEM that could be used but is not the primary automated response tool for this scenario.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 6

Your organization uses Microsoft Purview to manage data governance. A data owner needs to classify sensitive data across SharePoint, OneDrive, and Exchange automatically based on content patterns. Which Microsoft Purview feature should they use?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling policies can automatically classify data based on patterns. Option B is correct. Option A (DLP) prevents sharing but does not classify. Option C (eDiscovery) is for search and legal hold. Option D (Audit) is for logging.

Answer

eDiscovery (Premium)

Answer

Data Loss Prevention (DLP) policies

Answer

Audit (Standard)

Question 7

A multinational corporation needs to restrict access to Microsoft 365 services based on user location and device state. They have offices in countries with strict data sovereignty laws. Which combination of Microsoft Entra ID features should they use to enforce these policies?

Accepted Answer

Conditional Access with location policies and device compliance. Conditional Access policies can be configured to block or allow access based on location and device state. Option D is correct because it combines both location and device compliance. Option A misses device state, Option B misses location, Option C is not a specific feature, and Option E is for identity protection, not control.

Answer

Microsoft Entra ID Governance

Answer

Identity Protection and Privileged Identity Management

Answer

Conditional Access with device compliance policies only

Answer

Conditional Access with location policies only

Question 8

Your company wants to run a phishing simulation to test employee awareness. Which Microsoft 365 tool can you use to create and launch a simulated phishing campaign?

Accepted Answer

Microsoft Defender for Office 365 Attack Simulation Training. Microsoft Defender for Office 365 includes Attack Simulation Training, which allows you to create and launch simulated phishing attacks. Option A is correct. Option B (Defender for Cloud Apps) is a CASB, Option C (Microsoft Intune) is for device management, and Option D (Microsoft Purview) is for compliance.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Purview Compliance Manager

Question 9

Your organization is required to retain all communications related to a legal case for 5 years. Emails and Teams messages must be preserved immutably. Which Microsoft 365 feature should you use?

Accepted Answer

Litigation Hold. Litigation Hold preserves all mailbox content immutably. Option A is correct. Option B (Retention tags) can delete or archive but not preserve immutably. Option C (DLP) is for prevention. Option D (eDiscovery) is for search, not preservation.

Answer

Data Loss Prevention (DLP) policies

Answer

Retention policies and tags

Answer

eDiscovery (Standard)

Question 10

An organization uses Microsoft 365 Copilot for Microsoft 365. The security team wants to ensure that Copilot responses are based only on data that users already have permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. The principle of least privilege ensures users only access data they need. In Copilot, responses are grounded in the user's existing permissions. Option C is correct. Option A (Zero Trust) is broader, Option B (Defense in depth) is layered security, and Option D (Privileged Access) is for elevated roles.

Answer

Defense in depth

Answer

Privileged Identity Management

Answer

Zero Trust

Question 11

Your company is deploying Microsoft Purview to manage data subject requests (DSRs) under GDPR. Users need to submit requests to access or delete their personal data. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Data Subject Requests. Microsoft Purview eDiscovery (Standard) is used for content searches and exports, but for managing DSRs, the Data Subject Requests solution is part of Microsoft Purview Compliance Manager or specifically the Privacy Management module. However, note that as of 2025, Microsoft Purview includes a dedicated DSR management tool. Option D is the correct answer. Option A (DLP) is for prevention, Option B (Audit) is for logging, and Option C (Records Management) is for retention.

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview Data Loss Prevention (DLP)

Question 12

Which TWO of the following are features of Microsoft Purview Information Protection?

Accepted Answer

Sensitivity labels. Information Protection includes sensitivity labels and encryption. AIP scanner is for on-premises, DLP is separate, and eDiscovery is also separate.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery (Premium)

Answer

Azure Information Protection (AIP) scanner

Question 13

Which THREE of the following are included in Microsoft 365 E5 compliance features?

Accepted Answer

Microsoft Purview Audit (Premium). E5 includes Advanced Audit, eDiscovery Premium, and Microsoft Purview Communication Compliance. DLP is in E3, and Records Management is in E3.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Records Management

Question 14

Which TWO of the following are required to implement Microsoft Entra ID Conditional Access?

Accepted Answer

Microsoft Entra ID P1 or P2 licenses. Conditional Access requires Azure AD P1 or P2 licenses and roles that allow policy management. MFA and Intune are not required for all policies.

Answer

Microsoft 365 E5 license

Answer

Multifactor Authentication enabled for all users

Answer

Microsoft Intune subscription

Question 15

Your organization is deploying Microsoft 365 Copilot for sales teams. The compliance team requires that Copilot interactions with customer data in Dynamics 365 Sales be subject to retention policies. Which Microsoft Purview feature should you configure to manage this data?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Option A is correct because Microsoft Purview Data Lifecycle Management enforces retention policies for Copilot interactions. Option B is incorrect because eDiscovery is for search and export. Option C is incorrect because Communication Compliance is for monitoring inappropriate messages. Option D is incorrect because Sensitivity labels are for classification.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communication Compliance