MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 12 — 15 Questions

Question 1

A multinational company uses Microsoft 365 E5 and needs to meet data residency requirements in the EU and Asia. They plan to use Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from leaving approved geographic boundaries. Which action should they take to enforce this policy?

Accepted Answer

Create a DLP policy that detects sensitive data and blocks sharing outside approved regions.. Option B is correct because DLP policies can be scoped to specific locations using conditions like 'Content contains sensitive info type' and 'Location'. Option A is incorrect because Conditional Access controls access, not data movement. Option C is incorrect because Sensitivity labels alone do not block transfer. Option D is incorrect because Customer Lockbox is for access control, not data location enforcement.

Answer

Apply sensitivity labels to all data and configure auto-labeling.

Answer

Enable Microsoft Purview Customer Lockbox to restrict data access.

Answer

Configure Conditional Access policies to block access from unauthorized regions.

Question 2

Your organization is implementing Microsoft Entra ID (formerly Azure AD) for identity management. Users report that they are prompted for multifactor authentication (MFA) every time they sign in, even from trusted devices. What should you configure to reduce MFA prompts while maintaining security?

Accepted Answer

Modify the Conditional Access policy to set session control 'Sign-in frequency' to a longer period.. Option C is correct because Conditional Access policies allow setting session persistence to remember MFA on trusted devices. Option A is incorrect because MFA frequency is not set in Password reset. Option B is incorrect because Named locations are for IP-based trust, not device trust. Option D is incorrect because Privileged Identity Management (PIM) is for just-in-time admin access.

Answer

Define trusted IP ranges in Named locations.

Answer

Configure self-service password reset (SSPR) to require MFA less often.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to grant MFA exemption.

Question 3

Your company uses Microsoft Defender for Office 365 and wants to prevent users from clicking malicious links in email. A user reports that a known phishing link was not blocked. Which step should you take to investigate?

Accepted Answer

Search in Threat Explorer for the URL and review the verdict.. Option B is correct because Threat Explorer allows searching for specific URLs and email messages to analyze threats. Option A is incorrect because Attack simulation training is for creating phishing simulations, not investigating past emails. Option C is incorrect because Safe Links policies are configured in the portal. Option D is incorrect because the Security posture score is for overall maturity, not specific incidents.

Answer

Check the Microsoft Secure Score for recommendations.

Answer

Review the Safe Links policy to ensure it is enabled.

Answer

Run an attack simulation to test the link.

Question 4

A healthcare organization is using Microsoft 365 and needs to ensure that patient data (protected health information) is not accidentally shared externally. They want to classify all documents containing medical terms and apply automatic encryption when shared outside the organization. Which two Microsoft Purview features should they combine? (Select TWO)

Accepted Answer

Sensitivity labels with auto-labeling based on trainable classifiers. Options A and C are correct: Sensitivity labels classify data, and auto-labeling with trainable classifiers can detect medical terms. DLP policies then enforce encryption on external sharing. Option B is incorrect because Communication Compliance is for inappropriate messages. Option D is incorrect because Insider Risk Management addresses internal risky behavior. Option E is incorrect because sensitivity labels alone do not enforce encryption; that requires DLP or label protection actions.

Answer

Insider Risk Management policies

Answer

Communication Compliance policies

Answer

Microsoft Entra ID Conditional Access policies

Question 5

Your organization is migrating from on-premises Exchange to Exchange Online. You need to ensure that email communications comply with regulatory requirements for retention. Which Microsoft 365 feature should you use to define retention periods for emails?

Accepted Answer

Microsoft Purview retention policies. Option A is correct because retention policies in Microsoft Purview apply to Exchange Online. Option B is incorrect because eDiscovery is for search and hold. Option C is incorrect because Journaling is a legacy feature, not the primary retention tool. Option D is incorrect because Litigation Hold is for preservation, not defined retention periods.

Answer

Microsoft Purview eDiscovery cases

Answer

Exchange Online journaling

Answer

Exchange Online litigation hold

Question 6

Which TWO actions should you take to protect against ransomware attacks in Microsoft 365?

Accepted Answer

Enable anti-malware policies in Microsoft Defender for Office 365.. Options B and D are correct: Anti-malware policies block known malware, and restricted permissions in SharePoint prevent unauthorized encryption. Option A is incorrect because attack simulation is for training, not prevention. Option C is incorrect because DLP policies prevent data loss, not ransomware. Option E is incorrect because auto-labeling is for classification, not protection.

Answer

Deploy attack simulation training to educate users.

Answer

Apply sensitivity labels with auto-labeling.

Answer

Configure Data Loss Prevention (DLP) policies.

Question 7

Which THREE conditions must be met for a Microsoft 365 tenant to use Customer Lockbox?

Accepted Answer

An authorized admin must submit a support request to Microsoft.. Options A, C, and E are correct: Customer Lockbox requires an E5 license, the admin must initiate a support request, and it applies only when Microsoft engineers need access. Option B is incorrect because Customer Lockbox is not available in E3. Option D is incorrect because it is for Microsoft engineer access, not internal admin access.

Answer

The tenant must be on a Microsoft 365 E3 plan.

Answer

Internal administrators must request access to user mailboxes.

Question 8

A law firm uses Microsoft 365 and wants to ensure that only authorized users can access client files stored in SharePoint Online. They also need to track when these files are accessed. Which combination of features should they use?

Accepted Answer

Sensitivity labels with encryption and Microsoft Purview auditing.. Option B is correct: Sensitivity labels with encryption restrict access, and auditing tracks access. Option A is incorrect because DLP policies prevent data loss but do not restrict access or track it. Option C is incorrect because Conditional Access controls sign-in but not file-level access. Option D is incorrect because eDiscovery is for search and hold, not access restriction.

Answer

Conditional Access policies and Privileged Identity Management (PIM).

Answer

eDiscovery cases and Content search.

Answer

Data Loss Prevention (DLP) policies and Microsoft Defender for Cloud Apps.

Question 9

Your organization has a Microsoft 365 E5 subscription and wants to use Microsoft Purview to identify and protect sensitive data. Which feature should you use to automatically discover sensitive data across Exchange Online, SharePoint Online, and OneDrive?

Accepted Answer

Content explorer. Option B is correct: Content explorer shows where sensitive data is stored. Option A is incorrect because Activity explorer shows user activity. Option C is incorrect because Data Loss Prevention policies prevent sharing. Option D is incorrect because Sensitivity labels classify data.

Answer

Data Loss Prevention (DLP) policies

Answer

Sensitivity labels

Answer

Activity explorer

Question 10

Your company uses Microsoft 365 and wants to ensure that when employees access Microsoft 365 from unmanaged devices, they can only view data but not download or print it. Which technology should you use?

Accepted Answer

Microsoft Entra Conditional Access with session controls. Option C is correct: Conditional Access with session controls can block download/print. Option A is incorrect because DLP policies block sharing but not download from browser. Option B is incorrect because Intune compliance policies require device enrollment. Option D is incorrect because Sensitivity labels with encryption do not block printing.

Answer

Microsoft Intune compliance policies

Answer

Sensitivity labels with encryption

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Question 11

Refer to the exhibit. The exhibit shows a Conditional Access policy. Which requirement does this policy enforce?

Accepted Answer

Users must provide MFA and use a compliant device.. Option B is correct because the policy requires both MFA and compliant device (AND operator). Option A is incorrect because it requires both, not either. Option C is incorrect because it enforces both controls. Option D is incorrect because it includes all locations except Trusted IPs, but Trusted IPs are excluded, so the policy does not apply to them; it does not block access.

Answer

Users from trusted IPs are blocked.

Answer

Users must provide MFA only.

Answer

Users must provide MFA or use a compliant device.

Question 12

Refer to the exhibit. The exhibit shows an auto-labeling policy configuration. What will happen when a document labeled 'EU PII' is shared externally via SharePoint?

Accepted Answer

The document will be encrypted before sharing.. Option C is correct: The policy encrypts the document when shared externally. Option A is incorrect because blockAccess is false. Option B is incorrect because encrypt is true, so it is encrypted. Option D is incorrect because the policy applies to external sharing, not internal.

Answer

The document will be automatically labeled as confidential.

Answer

The document will be shared without encryption.

Answer

The document will be blocked from sharing.

Question 13

Refer to the exhibit. The exhibit shows an anti-phishing policy in Microsoft Defender for Office 365. Which users receive the highest level of protection?

Accepted Answer

The CEO and CFO specifically.. Option B is correct: Targeted user protection explicitly lists the CEO and CFO, who get additional protection. Option A is incorrect because all users get the policy but targeted users get extra protection. Option C is incorrect because the policy is enabled for all users. Option D is incorrect because the policy applies to all users, not just targeted.

Answer

All users in the organization.

Answer

Only users in the quarantine list.

Answer

Users with phishing threshold level 2.

Question 14

Which THREE statements about the Microsoft Service Trust Portal are true?

Accepted Answer

It includes the Compliance Manager tool.. Options A, B, and D are correct: The Service Trust Portal provides audit reports, compliance guides, and is accessible to authenticated users. Option C is incorrect because it does not provide real-time data location; data residency is shown in other tools. Option E is incorrect because it does not allow downloading Microsoft software; only compliance documents.

Answer

It allows real-time tracking of data location.

Answer

It provides downloads of Microsoft software patches.

Question 15

Your organization wants to ensure that users can only access Microsoft 365 resources from compliant devices. Which security feature should you implement?

Accepted Answer

Microsoft Entra Conditional Access. Conditional Access in Microsoft Entra ID allows you to enforce policies that require devices to be compliant (e.g., managed by Intune) before granting access. Option B is correct. Options A, C, and D are not primarily for device compliance enforcement.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune