MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 14 — 15 Questions

Question 1

A multinational company must comply with the General Data Protection Regulation (GDPR). They need to be able to search for and delete personal data of a user upon request (right to erasure). Which Microsoft Purview solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) supports searching across Microsoft 365 workloads for personal data and applying holds or deletions to satisfy data subject requests, including the GDPR right to erasure. It provides case management, review sets, and the ability to purge content, which are the capabilities needed to locate and delete a user's personal data on request.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management

Question 2

Your organization uses Microsoft 365 Business Premium. You need to protect users from phishing attacks by blocking malicious links in real-time when they click them in emails. Which feature provides this capability?

Accepted Answer

Microsoft Defender for Office 365 Safe Links. Safe Links in Microsoft Defender for Office 365 provides real-time protection by checking links in emails and documents at the time of click. It blocks malicious links and can also detonate URLs to analyze for phishing. This directly matches the requirement to block malicious links in real-time when clicked.

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Exchange Online Protection (EOP) anti-spam policy

Answer

Microsoft Defender XDR

Question 3

An organization needs to ensure that all Microsoft 365 data is encrypted at rest and in transit. Which of the following is a built-in encryption mechanism in Microsoft 365?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption is a built-in encryption mechanism in Microsoft 365 that encrypts data at rest on physical drives within Microsoft datacenters. It uses AES 256-bit encryption to protect data stored on disk volumes, ensuring that even if physical drives are removed, the data remains unreadable. Additionally, Microsoft 365 uses TLS 1.2+ for data in transit, but BitLocker specifically addresses the 'at rest' requirement as a native, default encryption layer.

Answer

Customer-managed keys (CMK) using Azure Key Vault

Answer

Office 365 Message Encryption

Answer

Azure Information Protection

Question 4

Your company uses Microsoft 365 E5 and has enabled Microsoft Purview Audit (Premium). The security team needs to investigate a potential data breach by searching for all activities related to a specific user in the last 90 days. Which tool should they use?

Accepted Answer

Microsoft Purview Audit (Premium) log search. Microsoft Purview Audit (Premium) log search is the appropriate tool to search the unified audit log for activities performed by a specific user across Microsoft 365 services. Since the security team needs to find all user-related activities in the last 90 days, the audit log search (Option C) directly meets this requirement. eDiscovery (Premium) is designed for finding content (e.g., emails, documents) and for legal holds, not for searching user activity logs.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Content Search

Answer

Microsoft Purview eDiscovery (Premium)

Question 5

Which TWO of the following are features of Microsoft Purview that help organizations meet compliance requirements for data lifecycle management? (Choose two.)

Accepted Answer

Retention policies. Retention policies (A) are a core Microsoft Purview capability that let organizations keep or delete content for a defined period, directly supporting data lifecycle management by governing how long data is retained and when it is disposed of. Records management (C) extends this by letting organizations declare content as records, apply retention and disposition rules (including event-based retention and regulatory records), and manage the full lifecycle of high-value or regulated data. Together, A and C are the Purview features specifically designed for lifecycle governance from creation through disposal. eDiscovery (Premium) (B) focuses on identifying, preserving, collecting, and reviewing content for legal investigations rather than lifecycle retention. Insider Risk Management (D) detects and mitigates risky user activity, and Data Loss Prevention policies (E) prevent sharing of sensitive data in motion — neither governs retention or disposition of data over its lifecycle.

Answer

eDiscovery (Premium)

Answer

Insider Risk Management

Answer

Data Loss Prevention (DLP) policies

Question 6

Which THREE of the following are capabilities of Microsoft Entra ID that support identity security? (Choose three.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is correct because it provides just-in-time privileged access with approval workflows, time-bound role activation, and access reviews, directly reducing standing admin rights in Microsoft Entra ID. Conditional Access is correct because it enforces signal-based access policies (user, device, location, risk) to grant, block, or require MFA/compliant device before access to resources. Identity Protection is correct because it detects and remediates identity risks using signals like leaked credentials, anonymous IP addresses, and atypical sign-in behavior, feeding risk detections into Conditional Access. Microsoft Defender XDR is not an Entra ID identity-security capability; it is a broader extended detection and response suite spanning endpoints, email, identities, and cloud apps. Microsoft Intune is a device and application management service (MDM/MAM) rather than a native Entra ID identity-security capability, even though it integrates with Conditional Access for device compliance.

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 7

Which TWO of the following are examples of Microsoft's commitments to data privacy as outlined in the Microsoft Privacy Statement and related agreements? (Choose two.)

Accepted Answer

Customers can access and export their data.. The Microsoft Privacy Statement explicitly grants customers the right to access, export, and delete their data, aligning with data portability and control principles under regulations like GDPR. This commitment ensures that customers maintain ownership and control over their data stored in Microsoft 365 services.

Answer

Microsoft uses customer data to train AI models by default.

Answer

Microsoft may share customer data with third parties for marketing purposes.

Answer

Microsoft allows third parties to access customer data without consent.

Question 8

Which THREE of the following are security features included in Microsoft 365 Business Premium? (Choose three.)

Accepted Answer

Microsoft Entra ID Plan 1. Microsoft Entra ID Plan 1 is included in Microsoft 365 Business Premium. It provides identity and access management capabilities such as single sign-on (SSO), multi-factor authentication (MFA), and conditional access policies. These features help secure user identities and control access to cloud resources, which is a core security requirement for business environments.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 9

Your organization is deploying Microsoft 365 for a healthcare company that must comply with HIPAA. Which Microsoft 365 compliance feature should you use to prevent sensitive patient data from being shared externally via email?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is designed to identify, monitor, and automatically protect sensitive information across Microsoft 365 workloads, including Exchange Online, SharePoint, OneDrive, and Teams. DLP policies can detect sensitive data types such as HIPAA-related identifiers (e.g., U.S. Social Security numbers, medical record numbers) and enforce actions like blocking external email sharing or requiring encryption. This directly addresses the requirement to prevent sensitive patient data from being shared externally via email.

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 10

Your company wants to ensure that only managed and compliant devices can access Microsoft 365 resources. Which Microsoft 365 security feature enforces conditional access based on device compliance?

Accepted Answer

Microsoft Intune with Conditional Access in Microsoft Entra ID. Microsoft Intune manages device compliance policies (e.g., requiring encryption, antivirus, or a minimum OS version), and when integrated with Conditional Access in Microsoft Entra ID (formerly Azure AD), it enforces access decisions based on the device's compliance status. This ensures only managed and compliant devices can access Microsoft 365 resources, blocking or granting limited access to non-compliant devices.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 11

A user reports receiving a phishing email that bypassed Exchange Online Protection (EOP). You need to investigate the threat and automate a response across email, endpoints, and identities. Which Microsoft 365 security solution should you use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security solution that correlates signals across email, endpoints, and identities. When a phishing email bypasses Exchange Online Protection (EOP), Defender XDR can automatically trigger an investigation and response (e.g., remediating the email, isolating the affected endpoint, and resetting the compromised user's credentials) through its automated incident response and playbooks, leveraging data from Defender for Office 365, Defender for Endpoint, and Microsoft Entra ID Protection.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 12

Your organization uses Microsoft Purview to manage data governance. A data owner needs to classify sensitive data across SharePoint, OneDrive, and Exchange automatically based on content patterns. Which Microsoft Purview feature should they use?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling in Microsoft Purview are designed to automatically classify and label content based on sensitive information types (SITs) or trainable classifiers. They apply across SharePoint, OneDrive, and Exchange, matching content patterns to detect sensitive data. This is the correct feature for automatic classification based on content patterns.

Answer

eDiscovery (Premium)

Answer

Data Loss Prevention (DLP) policies

Answer

Audit (Standard)

Question 13

A multinational corporation needs to restrict access to Microsoft 365 services based on user location and device state. They have offices in countries with strict data sovereignty laws. Which combination of Microsoft Entra ID features should they use to enforce these policies?

Accepted Answer

Conditional Access with location policies and device compliance. Conditional Access in Microsoft Entra ID allows administrators to enforce granular access policies based on signals like user location and device state. By combining location policies (e.g., blocking access from specific countries or requiring trusted IPs) with device compliance policies (e.g., requiring devices to be marked as compliant via Intune or domain-joined), the organization can meet data sovereignty requirements and restrict access based on both criteria simultaneously.

Answer

Microsoft Entra ID Governance

Answer

Identity Protection and Privileged Identity Management

Answer

Conditional Access with device compliance policies only

Answer

Conditional Access with location policies only

Question 14

Your company wants to run a phishing simulation to test employee awareness. Which Microsoft 365 tool can you use to create and launch a simulated phishing campaign?

Accepted Answer

Microsoft Defender for Office 365 Attack Simulation Training. Microsoft Defender for Office 365 includes Attack Simulation Training, a feature specifically designed to create and launch simulated phishing campaigns. It provides realistic phishing emails, landing pages, and training assignments to educate users. This tool is part of the Threat Protection suite and is accessible via the Microsoft 365 Defender portal. It allows administrators to select payloads, target users, and schedule simulations, then review results and assign training.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Purview Compliance Manager

Question 15

Your company is deploying Microsoft Purview to manage data subject requests (DSRs) under GDPR. Users need to submit requests to access or delete their personal data. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Data Subject Requests. Microsoft Purview Data Subject Requests is the dedicated solution for managing data subject requests (DSRs) under GDPR. It provides a centralized interface for users to submit requests to access or delete their personal data, and for administrators to track and fulfill those requests. The other options are incorrect: Records Management handles retention and disposition of records, Audit (Premium) provides logging and investigation capabilities, and Data Loss Prevention (DLP) protects against data leaks. Therefore, option A is the correct answer.

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview Data Loss Prevention (DLP)