MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 13 — 15 Questions

Question 1

A company is subject to GDPR and needs to respond to a data subject request to delete a user's personal data from Microsoft 365. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Records Management) includes capabilities to manage data subject requests under GDPR. Option C is correct. Options A, B, and D are not designed for DSR management.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 2

Your organization has a Microsoft 365 E5 subscription and wants to centrally manage security incidents across identities, endpoints, and cloud apps. Which Microsoft solution provides this capability?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (formerly Microsoft 365 Defender) correlates signals from across the Microsoft 365 ecosystem into a unified incident view. Option A is correct. Option B is SIEM, Option C is for identity, Option D is for endpoints only.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 3

Refer to the exhibit. You are reviewing a Conditional Access policy configuration. What is the effect of this policy on a user who signs in from a known device but with medium sign-in risk?

Accepted Answer

The user is prompted for multifactor authentication.. The policy requires MFA when the sign-in risk level is medium or higher. Since the condition is met (medium risk), the user will be prompted for MFA. Option B is correct.

Answer

The user is required to reset their password.

Answer

The user is blocked from signing in.

Answer

The user is allowed without any additional prompts because the device is known.

Question 4

Refer to the exhibit. An administrator configured a sensitivity label with auto-labeling for credit card numbers. What happens when a user creates a document containing a credit card number and saves it to SharePoint Online?

Accepted Answer

The label is automatically applied, and the document is encrypted.. The auto-labeling rule will automatically apply the label, which then encrypts the document and sets an expiration date. Option C is correct.

Answer

The label is applied only when the user manually selects it.

Answer

The document is blocked from being saved.

Answer

The label is applied, but encryption is not enforced because the user can override.

Question 5

Refer to the exhibit. The JSON shows compliance scores from Microsoft Purview Compliance Manager. Which action should the organization prioritize to improve its HIPAA compliance score?

Accepted Answer

Enable multifactor authentication for all users.. The recommended action 'Enable MFA for all users' is marked as high impact and open. Implementing MFA would significantly improve the HIPAA score, as it addresses a common control. Option B is correct.

Answer

Deploy Microsoft Defender for Office 365.

Answer

Implement retention labels for medical records.

Answer

Conduct a data privacy impact assessment.

Question 6

Your organization uses Microsoft 365 Copilot and wants to ensure that sensitive data is not exposed through AI-powered features. Which Microsoft Purview capability should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention policies for Copilot. Microsoft Purview Data Loss Prevention (DLP) can be extended to Copilot interactions to prevent sensitive data from being shared. Additionally, sensitivity labels can be used. Option A is correct because Purview DLP policies can apply to Copilot.

Answer

Microsoft Intune app protection policies

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra Conditional Access

Question 7

A healthcare organization must ensure that electronic protected health information (ePHI) in Microsoft 365 is encrypted both at rest and in transit. Which Microsoft 365 feature provides encryption for data in transit?

Accepted Answer

TLS/SSL encryption. Microsoft 365 uses TLS to encrypt data in transit between clients and Microsoft servers. Option A is correct. BitLocker encrypts at rest, Purview is for governance, and Rights Management is for access control.

Answer

Azure Information Protection

Answer

BitLocker Drive Encryption

Answer

Microsoft Purview Information Protection

Question 8

Your organization is adopting Microsoft 365 Copilot and wants to prevent the AI from using internal customer data in its training models. Which data protection option should be enabled?

Accepted Answer

Microsoft Commercial Data Protection. Microsoft Commercial Data Protection ensures that Copilot does not use customer data for training models. Option D is correct. Options A, B, and C do not address training data usage.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Audit

Answer

Conditional Access policies

Question 9

Which TWO of the following are key capabilities of Microsoft Purview Communication Compliance? (Choose two.)

Accepted Answer

Detect and respond to inappropriate messages. Communication Compliance helps detect policy violations in communications, such as inappropriate content and regulatory compliance. Options B and C are correct.

Answer

Enforce multifactor authentication

Answer

Configure retention labels

Answer

Block external email forwarding

Question 10

Which THREE of the following are included in Microsoft 365 E5 compliance features? (Choose three.)

Accepted Answer

Privileged Access Management. E5 includes advanced compliance features such as Communication Compliance, Customer Key, and Privileged Access Management. Options A, B, and D are correct. Option C is an E3 feature; option E is not specific to compliance.

Answer

Microsoft Intune

Answer

Basic audit log search

Question 11

Which TWO of the following are examples of security defaults in Microsoft Entra ID? (Choose two.)

Accepted Answer

Require multifactor authentication for all users. Security defaults enforce basic security policies, including requiring MFA for all users and blocking legacy authentication. Options A and C are correct.

Answer

Allow legacy authentication protocols

Answer

Disable self-service password reset

Answer

Enable guest user access

Question 12

Which THREE of the following are valid data subject rights under GDPR? (Choose three.)

Accepted Answer

Right to data portability. GDPR grants individuals rights such as the right to erasure, portability, and access. Options B, C, and D are correct.

Answer

Right to perpetual storage

Answer

Right to monetization of data

Question 13

Which TWO of the following are capabilities of Microsoft Priva? (Choose two.)

Accepted Answer

Automate subject rights requests. Microsoft Priva helps organizations manage privacy risks by assessing data transfer risks and automating subject rights requests. Options A and C are correct.

Answer

Configure retention labels

Answer

Monitor network traffic

Answer

Detect malware in email attachments

Question 14

Which THREE of the following are key pillars of the Microsoft Trusted Cloud? (Choose three.)

Accepted Answer

Security. Microsoft's Trusted Cloud is built on security, privacy, and compliance. Options A, C, and D are correct.

Answer

Cost optimization

Answer

Performance

Question 15

A company is deploying Microsoft 365 Copilot and wants to ensure that only users with the appropriate sensitivity labels can access Copilot-generated content. What should the administrator configure to enforce this requirement?

Accepted Answer

Enable auto-labeling for sensitivity labels in Microsoft Purview Information Protection. Option C is correct. Microsoft Purview Information Protection sensitivity labels can be automatically applied to content based on classification, and Copilot respects these labels. Option A is wrong because data loss prevention policies prevent sharing but do not automatically label content. Option B is wrong because retention labels manage retention, not access. Option D is wrong because Conditional Access controls access to apps, not labeling.

Answer

Create a retention label policy in Microsoft Purview

Answer

Create a Conditional Access policy in Microsoft Entra ID

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview