MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 14 — 15 Questions

Question 1

A user reports receiving a phishing email in their Outlook inbox. The organization uses Microsoft Defender for Office 365. Which feature should the user use to report the email to the security team?

Accepted Answer

Use the Report Message add-in in Outlook. Option B is correct. The Report Message add-in allows users to report phishing emails directly to Microsoft and the organization. Option A is wrong because blocking the sender is a local action. Option C is wrong because Safe Links protects against malicious URLs, not reporting. Option D is wrong because the admin center is for administrators.

Answer

Block the sender in Outlook

Answer

Submit the email to the Microsoft 365 Defender portal

Answer

Enable Safe Links in Outlook

Question 2

An administrator configures the SharePoint Online sharing policy as shown in the exhibit. What is the result of this configuration?

Accepted Answer

External users and guests from fabrikam.com can access content after accepting an invitation.. Option D is correct. The policy allows sharing with external users and guests, but only from fabrikam.com, and requires them to accept the sharing invitation. Option A is wrong because the capability is ExternalUserAndGuestSharing, not just guest sharing. Option B is wrong because the allowed domain list permits fabrikam.com. Option C is wrong because the blocked domain list is empty.

Answer

External users from any domain can access content without accepting an invitation.

Answer

Only guests from any domain can access, but external users must be added manually.

Answer

External sharing is blocked for all domains except fabrikam.com.

Question 3

A company uses Microsoft Purview Communication Compliance to detect inappropriate messages. Which action can an administrator take after reviewing a flagged message?

Accepted Answer

Resolve the case with a notification to the sender. Option A is correct. Communication Compliance allows administrators to resolve cases with actions like 'Resolve with notification' or escalate. Option B is wrong because retention policies are separate. Option C is wrong because DLP policies are not automatically created from Communication Compliance. Option D is wrong because message recall is not a direct action in Communication Compliance.

Answer

Apply a retention policy to the message

Answer

Create a DLP policy based on the message

Answer

Recall the message from the recipient

Question 4

An organization wants to ensure that only compliant devices can access Microsoft 365 resources. They use Microsoft Intune for device management. Which policy should they configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID. Option B is correct. Conditional Access in Microsoft Entra ID uses compliance status from Intune to allow or block access. Option A is wrong because compliance policies define what compliance means, but the access control is done by Conditional Access. Option C is wrong because configuration policies configure settings, not access. Option D is wrong because device enrollment is the process of joining devices to management.

Answer

Enable device enrollment in Intune

Answer

Create a compliance policy in Intune

Answer

Create a device configuration policy in Intune

Question 5

An administrator is assigned the Global Reader role in Microsoft Entra ID as shown in the exhibit. What can this administrator do?

Accepted Answer

View all user and group properties in the directory. Option A is correct. Global Reader has read-only access to all Azure AD configuration. Option B is wrong because Global Reader cannot create users. Option C is wrong because Global Reader cannot assign roles. Option D is wrong because the role does not include write permissions.

Answer

Reset user passwords

Answer

Assign administrative roles to other users

Answer

Create new users in the directory

Question 6

A company needs to meet GDPR compliance requirements for data subject requests. Which Microsoft Purview tool should they use to manage these requests?

Accepted Answer

Compliance Manager. Option C is correct. Microsoft Purview Compliance Manager helps manage compliance activities, including GDPR requests. Option A is wrong because Data Lifecycle Management focuses on retention. Option B is wrong because Audit logs record activities. Option D is wrong because eDiscovery is for legal discovery.

Answer

eDiscovery (Premium)

Answer

Audit (Premium)

Answer

Data Lifecycle Management

Question 7

An organization uses Microsoft Defender XDR and wants to investigate a potential ransomware attack. Which portal should the security team use to see the full attack timeline?

Accepted Answer

Microsoft 365 Defender portal. Option A is correct. The Microsoft 365 Defender portal provides a unified incident view with the full attack timeline. Option B is wrong because Microsoft Sentinel is a SIEM, not the primary portal for Microsoft 365 Defender. Option C is wrong because the Microsoft Purview portal is for compliance. Option D is wrong because the Azure portal is for Azure resources.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel

Answer

Azure portal

Question 8

A user needs to sign in to Microsoft 365 from an untrusted device. The company requires multifactor authentication (MFA) for all external access. Which Microsoft Entra ID feature enforces this requirement?

Accepted Answer

Conditional Access. Option C is correct. Conditional Access policies can require MFA based on conditions like device trust. Option A is wrong because Password protection prevents weak passwords. Option B is wrong because identity protection detects risks, not enforces MFA. Option D is wrong because security defaults provide baseline security but are not customizable like Conditional Access.

Answer

Microsoft Entra ID Protection

Answer

Security defaults

Answer

Microsoft Entra ID Password Protection

Question 9

Which TWO components are part of Microsoft's Service Trust Portal?

Accepted Answer

Audit reports and compliance guides. Options A and C are correct. The Service Trust Portal provides compliance reports, audit reports, and trust documents. Options B, D, and E are not part of the Service Trust Portal; they are separate portals.

Answer

Azure portal

Answer

Microsoft Purview compliance portal

Answer

Microsoft 365 Defender portal

Question 10

Which THREE actions can be performed using Microsoft Purview Data Loss Prevention (DLP) policies?

Accepted Answer

Display a policy tip to the user when sensitive data is detected. Options A, B, and C are correct. DLP policies can block sharing, show tips, and restrict access. Option D is wrong because auditing is separate. Option E is wrong because sensitivity labels are part of Information Protection, not DLP.

Answer

Apply sensitivity labels automatically

Answer

Audit all access to SharePoint sites

Question 11

Which TWO are true about Microsoft's data residency commitments in the Microsoft 365 Trust Center?

Accepted Answer

Customers can choose where their data is stored at rest. Options B and D are correct. Microsoft offers data residency options, and customers can choose the region. Option A is wrong because data is stored at rest in the chosen region, not all regions. Option C is wrong because data may move for disaster recovery. Option E is wrong because data can be stored at rest in the selected region.

Answer

Data never leaves the selected geographic region

Answer

All customer data is encrypted in transit only

Answer

Customer data is always stored in the customer's country only

Question 12

Which THREE are features of Microsoft Purview Information Protection?

Accepted Answer

Auto-labeling for sensitive data. Options A, B, and D are correct. Information Protection includes sensitivity labels, auto-labeling, and encryption. Option C is wrong because DLP is a separate solution. Option E is wrong because retention policies are part of Data Lifecycle Management.

Answer

Data loss prevention policies

Answer

Retention policies

Question 13

Which TWO are valid data classification labels in Microsoft Purview?

Accepted Answer

Confidential. Options A and C are correct. Microsoft Purview includes built-in labels like 'Highly Confidential' and 'Confidential'. Options B, D, and E are not standard labels.

Answer

Secret

Answer

Classified

Answer

Public

Question 14

Which THREE are core pillars of the Microsoft Trust Center?

Accepted Answer

Compliance. Options A, B, and D are correct. The Trust Center pillars are Security, Privacy, and Compliance. Options C and E are not core pillars.

Answer

Reliability

Answer

Transparency

Question 15

Your organization wants to ensure that data sent to Microsoft 365 is encrypted in transit. Which protocol should you enforce for all client connections?

Accepted Answer

TLS 1.2. TLS 1.2 is the minimum recommended protocol for encrypting data in transit to Microsoft 365. Option A (IPsec) is used for site-to-site VPNs, not client connections. Option C (HTTPS) is the application-layer protocol that uses TLS underneath. Option D (SSH) is for remote administration, not email or general traffic.

Answer

IPsec

Answer

HTTPS

Answer

SSH