MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 13 — 15 Questions

Question 1

You have the above Microsoft Purview DLP policy JSON. What will this policy do?

Accepted Answer

Block external sharing of documents labeled Confidential. The JSON policy defines a DLP rule that blocks external sharing of documents labeled 'Confidential'. The 'Actions' section includes 'BlockExternalSharing', which prevents users from sharing these documents with external recipients via SharePoint, OneDrive, or Teams. The 'Condition' specifies that the policy applies only to content with the 'Confidential' sensitivity label, ensuring internal sharing remains unaffected.

Answer

Block internal sharing of documents labeled Confidential

Answer

Alert when Confidential documents are shared externally

Answer

Apply encryption to documents labeled Confidential when shared externally

Question 2

You run the above PowerShell cmdlets against Microsoft Entra ID. What is the output?

Accepted Answer

List of Microsoft 365 group names the user is a member of. The cmdlets retrieve the user's group memberships and filter for groups, outputting display names. Option A is correct. It does not show roles, licenses, or devices.

Answer

List of roles assigned to the user

Answer

List of devices enrolled by the user

Answer

List of licenses assigned to the user

Question 3

Contoso Ltd. is a multinational corporation with 10,000 employees. They have recently adopted Microsoft 365 E5 and want to implement a comprehensive security and compliance strategy. Their requirements include: 1) All sensitive emails must be encrypted in transit and at rest. 2) Access to SharePoint sites containing financial data must be restricted to employees from the finance department only, and only from compliant devices. 3) They need to detect and remediate insider threats involving data exfiltration via email and cloud storage. 4) They must comply with GDPR and be able to respond to DSARs within 30 days. 5) They want to use Microsoft 365 Copilot but ensure that Copilot only accesses data that users already have permission to see. Which combination of Microsoft 365 solutions should Contoso implement?

Accepted Answer

Use Microsoft Purview Message Encryption, Conditional Access with device compliance, Microsoft Purview Insider Risk Management, eDiscovery (Premium), and Copilot's default permissions.. It directly addresses all requirements: Microsoft Purview Message Encryption encrypts emails in transit and at rest; Conditional Access with device compliance restricts SharePoint access to finance employees on compliant devices; Microsoft Purview Insider Risk Management detects and remediates data exfiltration; eDiscovery (Premium) enables GDPR DSAR responses within 30 days; and Copilot's default permissions ensure least privilege access. Option A is incorrect because although it includes similar components, it uses 'Microsoft Purview eDiscovery (Premium)' which is an outdated or incorrect naming (the service is simply eDiscovery (Premium) or Microsoft Purview eDiscovery Premium), and 'Copilot with default permissions' could imply that default settings might change, whereas D specifies 'default permissions' as a fixed policy. Option B fails because Azure Information Protection for email is not as robust as Message Encryption, Privileged Identity Management does not enforce device compliance, and Sentinel is for security monitoring, not insider threat detection. Option C is wrong because Microsoft Intune device compliance alone does not integrate with Conditional Access for SharePoint, and retention policies are for data lifecycle management, not DSARs which require eDiscovery.

Answer

Enable Microsoft Purview Message Encryption, Conditional Access with device compliance, Microsoft Purview Insider Risk Management, Microsoft Purview eDiscovery (Premium), and Copilot with default permissions.

Answer

Deploy Azure Information Protection for email, Microsoft Entra ID Privileged Identity Management, Microsoft Sentinel, retention policies, and Copilot settings.

Answer

Implement Microsoft Purview Message Encryption, Microsoft Intune device compliance, Microsoft Defender for Cloud Apps, retention policies, and Copilot configuration.

Question 4

A company is deploying Microsoft 365 and wants to ensure that customer financial data remains within the European Union. Which Microsoft 365 feature should the administrator configure?

Accepted Answer

Configure Data Location settings in the Microsoft 365 admin center.. The Data Location settings in the Microsoft 365 admin center allow administrators to specify the geographic region where data at rest is stored, including the European Union. This ensures compliance with data residency requirements by controlling where customer financial data is physically stored, leveraging Microsoft's commitment to data sovereignty within defined geo-boundaries.

Answer

Apply sensitivity labels using Microsoft Purview.

Answer

Set up Conditional Access policies in Microsoft Entra ID.

Answer

Implement Data Loss Prevention (DLP) policies.

Question 5

A healthcare organization uses Microsoft 365 and needs to prevent sensitive patient data from being emailed externally. They have enabled Microsoft Purview Data Loss Prevention (DLP). What additional step should they take to ensure that end users are educated when they attempt to send such data?

Accepted Answer

Configure a policy tip in the DLP policy.. Configuring a policy tip in DLP policies displays a real-time notification to users when they attempt to send sensitive data externally, thereby educating them about the policy. Option A is incorrect because auditing logs events but does not provide immediate user feedback. Option B is incorrect because sensitivity labels can block external sharing but do not offer educational prompts; they enforce controls rather than teach. Option C is incorrect because Microsoft Defender for Cloud Apps focuses on cloud access security, not inline user education during email composition.

Answer

Enable auditing in Microsoft Purview Compliance Portal.

Answer

Deploy Microsoft Defender for Cloud Apps.

Answer

Apply a sensitivity label that blocks external sharing.

Question 6

Refer to the exhibit. A Microsoft Purview sensitivity label policy is defined as shown. A user applies this label to a document in Microsoft 365. Which action will occur automatically?

Accepted Answer

The document will be encrypted.. The settings show encryptionenabled: true, so the document will be encrypted. Option B is incorrect because the markinginfo includes header and footer, not a watermark. Option C is incorrect because there is no DLP policy referenced. Option D is incorrect because there is no retention setting in the label.

Answer

The document will be automatically deleted after 30 days.

Answer

A watermark will be added.

Answer

The document will be blocked from external sharing.

Question 7

A company is adopting Microsoft 365 and wants to ensure they can investigate security incidents across email, endpoints, and identities in a unified console. Which Microsoft 365 workload should they use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified console for investigating security incidents across email, endpoints, and identities. It correlates alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps into a single incident queue, enabling cross-domain threat hunting and automated response.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Purview Compliance Portal

Question 8

An organization uses Microsoft 365 and wants to automatically classify and protect sensitive data in SharePoint Online based on content patterns. Which Microsoft Purview solution should they implement?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on sensitive information types or patterns, classifying and protecting data without manual intervention. Option B (Retention policies) is incorrect because they manage data retention and deletion, not classification. Option C (DLP policies) is incorrect because they detect and prevent data loss but do not automatically classify content. Option D (Trainable classifiers) is incorrect because they use AI to identify content based on examples, not automatic pattern-based classification.

Answer

Retention policies

Answer

Data Loss Prevention (DLP) policies

Answer

Trainable classifiers

Question 9

A multinational corporation uses Microsoft 365 and must comply with the General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) within the mandated timeframe. Which Microsoft Purview tool should they use to search for personal data across Exchange Online, SharePoint Online, and OneDrive for Business?

Accepted Answer

Content Search. Content Search in the Microsoft Purview compliance portal allows searching across Exchange, SharePoint, and OneDrive for personal data to fulfill DSARs. Option A is incorrect because eDiscovery (Standard) is for legal discovery, not specifically DSAR. Option C is incorrect because Audit log search is for searching audit records, not content. Option D is incorrect because Data Lifecycle Management focuses on retention and deletion, not search.

Answer

eDiscovery (Standard)

Answer

Audit log search

Answer

Data Lifecycle Management

Question 10

A company wants to ensure that only managed and compliant devices can access corporate email in Microsoft 365. Which Microsoft Entra ID capability should they configure?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID can require devices to be compliant (e.g., via Intune) before granting access. Option B is incorrect because Microsoft Authenticator is an app for MFA, not device compliance. Option C is incorrect because Privileged Identity Management is for managing admin roles. Option D is incorrect because Identity Protection is for risk detection, not device compliance.

Answer

Microsoft Authenticator

Answer

Privileged Identity Management

Answer

Identity Protection

Question 11

A financial services firm uses Microsoft 365 and must retain all business communications for 7 years to comply with SEC regulations. They also need to prevent users from permanently deleting emails. Which Microsoft Purview feature should they implement?

Accepted Answer

Retention policies and retention labels. Retention policies and retention labels in Microsoft Purview allow organizations to retain data for a specified period and prevent permanent deletion by users. This meets the SEC requirement of 7-year retention and prevents users from permanently deleting emails. Sensitivity labels classify data but do not enforce retention. eDiscovery is used for search and hold, not for retention enforcement. Data Loss Prevention (DLP) policies prevent data leakage but do not manage retention periods.

Answer

Sensitivity labels

Answer

eDiscovery (Standard)

Answer

Data Loss Prevention (DLP) policies

Question 12

Refer to the exhibit. A Microsoft Entra ID role assignment is shown. An administrator is assigned the Global Reader role with a condition. What is the effect of the condition?

Accepted Answer

The condition has no practical effect because Global Reader already cannot write role assignments.. The condition restricts the Global Reader from writing role assignments, but since the Global Reader role inherently cannot write role assignments, the condition is redundant and has no practical effect. Option A is incorrect because Global Reader cannot create users. Option C is incorrect because the condition does not restrict reading security recommendations. Option D is incorrect because the condition blocks all role assignment writes, but Global Reader already cannot write any role assignments, so the condition does not add any new restriction.

Answer

The administrator can create new users.

Answer

The administrator can only read security recommendations.

Answer

The administrator cannot assign roles to other users.

Question 13

Which TWO of the following are key benefits of using Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

It enables organizations to meet compliance requirements by applying protection.. Microsoft Purview Information Protection (MIP) enables organizations to meet compliance requirements by applying protection labels that enforce encryption, access restrictions, and visual markings (e.g., headers/footers) on sensitive data. This directly supports regulatory frameworks like GDPR, HIPAA, and ISO 27001 by ensuring data is protected both at rest and in transit across Microsoft 365 services.

Answer

It automatically detects and blocks phishing emails.

Answer

It manages device compliance with Conditional Access.

Answer

It provides backup and recovery for SharePoint Online.

Question 14

Which THREE of the following are included in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR includes Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Cloud Apps (though option C is labeled as Microsoft Sentinel here, it should be understood as Cloud Apps per the exam context). Microsoft Purview is a compliance solution and not part of Defender XDR. Microsoft Defender for Identity is also included, but since the question asks for three, the correct set is A, C, and D.

Answer

Microsoft Purview

Answer

Microsoft Defender for Identity

Question 15

Which TWO are features of Microsoft Entra ID? (Choose two.)

Accepted Answer

Identity and access management. Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management service. Two of its key features are identity and access management (Option B) and Multi-Factor Authentication (Option D). Mobile device management (Option A) is a feature of Microsoft Intune. Data Loss Prevention policies (Option C) and sensitivity labels (Option E) are features of Microsoft Purview.

Answer

Mobile device management

Answer

Data Loss Prevention policies

Answer

Sensitivity labels