MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 12 — 15 Questions

Question 1

Your organization is deploying Microsoft 365 Copilot. The compliance team is concerned that Copilot might expose sensitive data in its responses. What should you configure to prevent Copilot from using sensitive content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sensitivity labels with 'Copilot' condition. To prevent Copilot from using sensitive content, you should configure sensitivity labels and enable the 'Copilot' condition. This restricts Copilot from accessing content labeled with those sensitivity labels. Option A (Retention policies) is incorrect because retention policies are for preserving data, not restricting Copilot access. Option C (Data Loss Prevention policies) is incorrect because DLP policies prevent sharing of sensitive data but do not directly restrict Copilot from using the content. Option D (Unified audit log) is incorrect because audit logging records activities but does not prevent Copilot from accessing sensitive data.

Answer

Retention policies

Answer

Data Loss Prevention policies

Answer

Unified audit log

Question 2

You are reviewing the device compliance configuration shown in the exhibit. Devices that do not meet the compliance policy are targeted by a Conditional Access policy whose grant control is set to block. What is the most likely outcome of this configuration?

Accepted Answer

Access for non-compliant devices will be blocked. When an Intune compliance policy marks a device noncompliant and a Conditional Access policy blocks access for noncompliant devices, users on those devices are blocked from signing in to Microsoft 365 cloud apps. Option B is wrong because automatic remediation requires configuring remediation actions, not a block grant. Option C is wrong because the assignment shown targets all users, not tagged devices. Option D describes report-only mode, which is not what a block grant control does.

Answer

Non-compliant devices will automatically be remediated

Answer

The policy will only apply to devices with specific tags

Answer

Non-compliant devices will be audited and logged

Question 3

Which TWO are key capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Cloud Discovery to identify shadow IT. Microsoft Defender for Cloud Apps provides Cloud Discovery (Option D) to identify shadow IT and assess the cloud apps in use, and session control (Option E) to monitor and control app access in real-time. Option A (email encryption) is a capability of Microsoft Purview Message Encryption. Option B (device compliance policy enforcement) is a feature of Microsoft Intune. Option C (on-device malware scanning) is associated with Microsoft Defender for Endpoint.

Answer

Email encryption and secure messaging

Answer

Device compliance policy enforcement

Answer

On-device malware scanning

Question 4

A company is deploying Microsoft 365 and needs to ensure that external sharing of sensitive documents is blocked. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are the appropriate Microsoft Purview feature to block external sharing of sensitive documents, as they can detect and prevent the sharing of sensitive content such as credit card numbers, social security numbers, or custom sensitive information. Sensitivity labels classify and protect content but do not block sharing by themselves. Information Barriers restrict communication between specific groups but are not designed to block sharing of sensitive documents. Retention policies manage data lifecycle, not sharing controls.

Answer

Sensitivity labels

Answer

Information Barriers

Answer

Retention policies

Question 5

An organization uses Microsoft 365 Copilot and wants to ensure that AI-generated content is automatically labeled with a sensitivity label. What should they configure?

Accepted Answer

Microsoft Purview auto-labeling policies. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on conditions, including Copilot-generated content. Options A, B, and C are incorrect because they do not handle automatic labeling of Copilot output.

Answer

Microsoft Defender for Cloud Apps session policies

Answer

Microsoft Intune app protection policies

Answer

Conditional Access policies in Microsoft Entra ID

Question 6

A company needs to audit user activities in Microsoft 365 for compliance. Which tool should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) provides comprehensive auditing of user and admin activities across Microsoft 365, making it the correct choice for compliance auditing. Option C is correct. Microsoft Defender XDR (A) is for security threat detection and response, not auditing. Microsoft Sentinel (B) is a SIEM for security analytics, not native audit logging. Microsoft Intune (D) is for device management and does not provide user activity auditing.

Answer

Microsoft Defender XDR

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 7

A user reports that they cannot access a SharePoint site that contains sensitive data. The administrator confirms the user is licensed and the site permissions are correct. What should the administrator check next?

Accepted Answer

Conditional Access policies in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID can block access based on conditions like device compliance or location. Option D is correct. The other options are less likely given the scenario.

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Microsoft Purview retention policies

Answer

Microsoft Intune device compliance policies

Question 8

An organization must comply with GDPR and needs to respond to a data subject access request (DSAR) within 30 days. Which Microsoft Purview solution helps search for personal data across Microsoft 365?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) allows searching across content locations for specific data, including personal data. Option D is correct. DLP and Records Management do not search, and Audit logs only track activities.

Answer

Data Loss Prevention (DLP)

Answer

Records Management

Answer

Audit (Premium)

Question 9

A company wants to prevent employees from forwarding sensitive emails outside the organization. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption enables rights protection, including preventing forwarding of sensitive emails. Option D is correct. Microsoft Intune Mobile Application Management (A) manages apps on devices but does not control email forwarding. Microsoft Entra ID Conditional Access (B) controls access based on conditions but not message forwarding. Microsoft Defender for Office 365 Anti-Phishing (C) protects against phishing attacks, not forwarding prevention.

Answer

Microsoft Intune Mobile Application Management

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Defender for Office 365 Anti-Phishing

Question 10

An organization uses Microsoft 365 Copilot and wants to ensure that Copilot responses are based only on data the user has permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. The principle of least privilege ensures users only access data they need. Copilot respects existing permissions, so it enforces least privilege. Option D is correct. Options A (Defense in depth) is a layered security approach, B (Segregation of duties) divides responsibilities, and C (Zero Trust) assumes no implicit trust. None of these directly address permission-based data access like least privilege does.

Answer

Defense in depth

Answer

Segregation of duties

Answer

Zero Trust

Question 11

A company needs to enforce that all documents marked as 'Confidential' are encrypted and cannot be printed. Which combination of Microsoft Purview features should they use?

Accepted Answer

Sensitivity labels with encryption and rights management. Sensitivity labels with encryption and rights management allow you to apply encryption and usage restrictions such as 'Do Not Print' to documents marked as 'Confidential'. Option B is correct. Option A involves Conditional Access and Intune app protection, which do not directly enforce document-level restrictions like printing. Option C uses DLP policies and retention labels, which focus on data loss prevention and retention, not granular usage rights. Option D is about eDiscovery and audit, not about applying encryption or usage restrictions.

Answer

Microsoft Entra ID Conditional Access and Intune app protection

Answer

Data Loss Prevention (DLP) policies and retention labels

Answer

eDiscovery (Premium) and Audit (Premium)

Question 12

An administrator needs to ensure that only compliant devices can access Exchange Online. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access policies. Conditional Access policies can enforce device compliance. Option B is correct. Privileged Identity Management (Option A) is used for just-in-time role access, not device compliance.

Answer

Privileged Identity Management

Answer

Multi-Factor Authentication

Answer

Identity Protection

Question 13

Which TWO Microsoft 365 tools can help an organization detect and respond to insider data theft?

Accepted Answer

Microsoft Defender for Cloud Apps. The correct answers are D and E. Microsoft Defender for Cloud Apps (D) detects anomalous data exfiltration by monitoring user activities and alerting on suspicious behavior. Microsoft Purview Insider Risk Management (E) identifies insider threats by correlating signals from various sources to detect potential data theft. The other options are less relevant: Microsoft Intune is for device management, Microsoft Entra ID Identity Protection focuses on sign-in risks, and Microsoft Sentinel is a SIEM for broad security monitoring.

Answer

Microsoft Intune

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Sentinel

Question 14

Which THREE Microsoft Purview features are part of the eDiscovery workflow for legal investigations?

Accepted Answer

Content Search. eDiscovery workflow includes Content Search (identify data), Hold (preserve data), and Export (export data for review). Communication is part of eDiscovery Premium but not always required; Analytics is not a standard eDiscovery feature.

Answer

Communication

Answer

Analytics

Question 15

Which TWO Microsoft 365 compliance centers provide tools for managing compliance requirements?

Accepted Answer

Microsoft Purview compliance portal. Microsoft Purview compliance portal is the main compliance center; Microsoft 365 admin center includes compliance management features. Defender XDR is security, Intune is device management, Entra ID is identity.

Answer

Microsoft Entra admin center

Answer

Microsoft Defender XDR portal

Answer

Microsoft Intune admin center