MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 14 — 15 Questions

Question 1

You are the security administrator for Contoso, a global consulting firm with 10,000 employees. Contoso uses Microsoft 365 E5 and Microsoft Entra ID P2. The company has a strict policy that all sensitive client data must be encrypted at rest and in transit. Additionally, the legal team requires that any document labeled as 'Highly Confidential' must be automatically encrypted and cannot be printed or forwarded. You have created a sensitivity label called 'Highly Confidential' with encryption and a protection setting that restricts actions like printing. However, you notice that users are still able to print documents that have the label applied. After investigation, you find that the label is correctly configured but users are manually applying the label. What should you do to ensure the label is consistently applied and printing is blocked?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an auto-labeling policy that automatically applies the 'Highly Confidential' label to documents that contain certain sensitive information types, and ensure the label's protection settings block printing.. Auto-labeling policies automatically apply the 'Highly Confidential' label to documents containing specified sensitive information types, ensuring consistent labeling. Once applied, the label's built-in protection settings block printing. Option A is incorrect because DLP policies can block printing but do not apply sensitivity labels. Option B is incorrect because Conditional Access controls access to resources, not document-level actions like printing. Option C is incorrect because the label already has encryption; the issue is manual application, not encryption settings.

Answer

Create a Data Loss Prevention (DLP) policy that blocks printing of documents with the 'Highly Confidential' label.

Answer

Configure a Conditional Access policy that blocks printing for users accessing documents from unmanaged devices.

Answer

Modify the sensitivity label's encryption settings to require user authentication before printing.

Question 2

You are the IT administrator for a non-profit organization that uses Microsoft 365 Business Basic. The organization has 50 volunteers who use their own personal devices to access email and SharePoint Online. The board of directors wants to ensure that if a volunteer's device is lost or stolen, the organization's data on that device can be removed remotely. They also want to ensure that volunteers use multi-factor authentication (MFA) to access corporate resources. What should you do?

Accepted Answer

Enroll devices in Microsoft Intune and configure a selective wipe policy. Set up a Conditional Access policy in Microsoft Entra ID to require MFA.. Microsoft Intune allows you to enroll devices and perform a selective wipe to remove only corporate data from personal devices. Conditional Access in Microsoft Entra ID can enforce MFA for accessing corporate resources. Option A is incorrect because Microsoft Defender for Cloud Apps provides cloud app security (e.g., session controls) but does not perform device wipe or manage device enrollment. Option B is incorrect because Microsoft Purview is for data governance, compliance, and labeling, not for device management or selective wipe. Option C is incorrect because Data Loss Prevention (DLP) policies control data sharing but cannot block access from unmanaged devices; that would require Conditional Access policies with device compliance.

Answer

Deploy Microsoft Defender for Cloud Apps and configure session controls.

Answer

Use Microsoft Purview to label all corporate data and configure a policy to revoke access.

Answer

Implement a Data Loss Prevention (DLP) policy that blocks access from unmanaged devices.

Question 3

Your organization is deploying Microsoft 365 and needs to ensure that data stored in Exchange Online is protected against accidental deletion. You need to implement a solution that allows users to recover deleted emails for up to 30 days, but also enables administrators to recover items for up to 90 days. Which feature should you configure?

Accepted Answer

Litigation Hold. Litigation Hold preserves mailbox items indefinitely or for a specified period, allowing administrators to recover deleted items for up to 90 days (or longer). Single Item Recovery (B) only allows recovery within the default deleted item retention period (14 days, configurable up to 30 days). In-Place Hold (A) is used for eDiscovery holds but not for general recovery. Retention Policy (C) manages retention but does not enable recovery of deleted items beyond the retention period.

Answer

In-Place Hold

Answer

Single Item Recovery

Answer

Retention Policy

Question 4

A multinational company uses Microsoft 365 and wants to ensure that data stored in SharePoint Online is only accessible from specific geographic regions. The company has offices in the US, EU, and Asia. You need to implement a solution that restricts access based on the user's physical location. Which feature should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID can enforce access controls based on the user's IP address, effectively restricting access from specific geographic regions. Option A (Data Residency) controls where data is stored, not who can access it. Option C (Geofencing in Intune) is not a feature for SharePoint Online access control. Option D (Location-Based Policies) is not a built-in feature in SharePoint Admin Center; location-based access is managed through Conditional Access.

Answer

Data Residency in Microsoft Purview

Answer

Geofencing in Microsoft Intune

Answer

Location-Based Policies in SharePoint Admin Center

Question 5

Your organization is planning to use Microsoft Purview to meet compliance requirements. Which TWO capabilities are part of Microsoft Purview? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) helps organizations detect and prevent sensitive information from being shared inappropriately, and Data Lifecycle Management manages the retention and deletion of data to comply with regulations. Both are core capabilities of Microsoft Purview. Advanced Threat Analytics is part of Microsoft Defender for Identity, not Purview. Data Classification and Insider Risk Management are also Purview capabilities, but the question requires exactly two correct answers: DLP and Data Lifecycle Management.

Answer

Data Classification

Answer

Advanced Threat Analytics

Answer

Insider Risk Management

Question 6

You are responsible for securing identities in Microsoft 365. Which THREE actions should you take to improve the security posture of user accounts? (Choose three.)

Accepted Answer

Enable multifactor authentication (MFA) for all users. Enabling multifactor authentication (MFA) for all users is a foundational security measure that adds a second layer of verification beyond just a password. This significantly reduces the risk of account compromise, even if a password is stolen, because an attacker would also need access to the user's trusted device or biometric. Microsoft 365 MFA supports methods like the Microsoft Authenticator app, SMS, phone call, and OATH tokens, and can be enforced via Conditional Access policies or security defaults.

Answer

Require complex passwords with a minimum length of 16 characters

Answer

Disable legacy authentication protocols

Question 7

Your company is adopting Microsoft 365 Copilot and wants to ensure that data security and compliance requirements are met. Which THREE considerations should be addressed? (Choose three.)

Accepted Answer

Configure policies in the Microsoft 365 admin center to manage Copilot features.. Options A, C, and E are correct. Microsoft 365 Copilot inherits compliance settings from underlying Microsoft 365 services (E), respects sensitivity labels to control data access (C), and can be managed via policies in the Microsoft 365 admin center (A). Option D (data residency verification) is not a requirement because Copilot processes data according to the tenant's existing data residency, making it an incorrect answer. Option B (disabling Copilot) is an extreme measure, not a consideration.

Answer

Disable Copilot for all users if any compliance requirement cannot be met.

Answer

Verify that data processed by Copilot is stored in the same geographic region as the tenant.

Question 8

Refer to the exhibit. You are reviewing a sensitivity label policy configuration in Microsoft Purview. What is the outcome of this configuration?

Accepted Answer

Users can manually change the label, but the default label is 'Public'.. The default label is set to 'Public', and with MandatoryLabelType set to 'none', users are not required to apply a label but the default label is applied unless changed. Option A is incorrect because both labels are enabled in the policy configuration; the 'Confidential' label is not disabled. Option B is incorrect because mandatory labeling is not enforced (MandatoryLabelType is 'none'). Option D is incorrect because a default label ('Public') is specified, so it is applied automatically.

Answer

The 'Confidential' label is disabled and cannot be applied.

Answer

Users are required to apply a sensitivity label to all documents.

Answer

No default label is applied to documents.

Question 9

Your company, Contoso Ltd., has a Microsoft 365 E5 subscription with 500 users. The IT department recently discovered that some employees are sharing sensitive customer data via email with external parties. You need to implement a solution that automatically detects and prevents the sharing of credit card numbers and social security numbers in emails. The solution should notify the sender when a potential violation occurs and allow them to override the block by providing a business justification. The compliance team must be able to review these overrides. What should you configure?

Accepted Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy in the Microsoft Purview compliance portal.. A Microsoft Purview Data Loss Prevention (DLP) policy can detect sensitive information types such as credit card numbers and social security numbers, and can be configured to block emails containing that data, notify the sender with an option to override by providing a business justification, and allow compliance team review of overrides. Option A is incorrect because Microsoft Defender for Office 365 Safe Attachments and Safe Links protect against malicious attachments and links, not against data leakage of sensitive information. Option C is incorrect because sensitivity labels are used for classification and protection (e.g., encryption) but not for blocking emails based on content. Option D is incorrect because an Exchange mail flow rule can block emails based on patterns but lacks the built-in sensitive info types, override with justification, and compliance review capabilities that DLP provides.

Answer

Enable Microsoft Defender for Office 365 Safe Attachments and Safe Links.

Answer

Create a sensitivity label with auto-labeling for emails containing sensitive data.

Answer

Create an Exchange mail flow rule to block emails containing sensitive data and send a non-delivery report.

Question 10

Northwind Traders is a legal firm that uses Microsoft 365 E5. They have strict regulatory requirements to retain all email communications for 7 years. Additionally, they need to ensure that employees cannot permanently delete emails before the retention period ends. The IT team has implemented a retention policy in Microsoft Purview to retain all Exchange Online mailboxes for 7 years after creation. However, users are still able to delete emails and permanently delete them from the Recoverable Items folder. You need to ensure that emails are preserved even if users try to delete them. What should you do?

Accepted Answer

Enable Litigation Hold for all mailboxes.. Litigation Hold places a hold on an entire mailbox, preserving all content including deleted items and versions, preventing permanent deletion. This meets the requirement to retain emails and prevent deletion. Option B (In-Place Hold) is a legacy hold that requires targeting specific mailboxes and is less comprehensive than Litigation Hold. Option C (eDiscovery hold) is used for legal cases and requires specific search criteria, not broad retention. Option D (retention tag in MRM policy) manages mailbox size by moving items, not preventing deletion.

Answer

Place an In-Place Hold on all mailboxes.

Answer

Configure an eDiscovery hold for all mailboxes.

Answer

Create a new retention tag in the default MRM policy to prevent deletion.

Question 11

Adventure Works is a global manufacturing company with 10,000 employees using Microsoft 365 E3. They have a hybrid identity setup with Microsoft Entra Connect syncing on-premises Active Directory to Microsoft Entra ID. The company wants to implement a zero-trust security model and has identified that many users still use weak passwords and do not use MFA. They want to enforce MFA for all users, but they also want to allow users to register for MFA on their own using the Microsoft Authenticator app. The security team is concerned about phishing attacks and wants to use a more secure MFA method. Additionally, they want to ensure that any new user created in on-premises AD is automatically enabled for MFA within 24 hours. What should you recommend?

Accepted Answer

Create a Conditional Access policy that requires MFA for all users and configure authentication methods policy to allow only Microsoft Authenticator.. A Conditional Access policy requiring MFA for all users, combined with an authentication methods policy that limits allowed methods to Microsoft Authenticator, meets all requirements. Users can self-register MFA via the Microsoft Authenticator app when prompted at sign-in. The policy automatically applies to new users synced from on-premises AD, so they will be required to register MFA on their first sign-in. Option A (Identity Protection) only enforces MFA for risky sign-ins, not all users. Option B (per-user MFA) is an older, less scalable method that does not allow self-registration easily and is not recommended. Option C (SSPR) resets passwords but does not enforce MFA for all sign-ins.

Answer

Configure Identity Protection to enforce MFA for risky sign-ins.

Answer

Enable per-user MFA in the Microsoft 365 admin center for all users.

Answer

Enable self-service password reset (SSPR) and require MFA for password changes.

Question 12

Tailwind Traders uses Microsoft 365 Business Premium. They have 200 users and want to ensure that company data on mobile devices is protected. They have implemented Microsoft Intune for mobile device management (MDM). Now they need to ensure that if a device is lost or stolen, the company data on the device can be removed without affecting personal data. The devices are personally owned (BYOD). What should you configure?

Accepted Answer

Configure a selective wipe in Intune to remove corporate data.. A selective wipe in Intune removes only corporate data from a device, leaving personal data intact. Option A (App Protection Policy) manages data at the app level but does not provide remote wipe for the entire device. Option B (device compliance policy) enforces compliance settings like PIN but does not wipe data. Option D (full wipe) removes all data, which is not desired for BYOD scenarios.

Answer

Configure an App Protection Policy to wipe managed apps when the device is reported lost.

Answer

Create a device compliance policy that requires a PIN to access the device.

Answer

Configure a full wipe in Intune for the device.

Question 13

Wide World Importers is a financial services company that must comply with GDPR. They use Microsoft 365 E5 and have enabled audit logging. The Data Protection Officer (DPO) needs to be able to search and export all audit records related to a specific user's activities for the past 90 days. The DPO is not a global admin and should only have permissions to view and export audit logs. You need to provide the DPO with the appropriate access. What should you do?

Accepted Answer

Add the DPO to the 'Audit Logs' role in the Microsoft Purview compliance portal.. The 'Audit Logs' role in the Microsoft Purview compliance portal grants read and export permissions for audit logs, which is exactly what the DPO needs. Option B (Global Administrator) grants far too many privileges. Option C (Security Reader) in Microsoft Entra ID does not include Purview audit log access. Option D (Compliance Administrator) is a broader role that includes many other permissions beyond audit log access.

Answer

Add the DPO to the Global Administrator role.

Answer

Assign the Security Reader role in Microsoft Entra ID.

Answer

Assign the Compliance Administrator role in Microsoft Entra ID.

Question 14

Contoso Pharmaceuticals uses Microsoft 365 E5 with Microsoft Purview. They have a requirement to automatically classify and protect documents containing research and development (R&D) data. The R&D data is stored in SharePoint Online and is defined by a custom sensitive info type that matches a specific pattern (e.g., 'R&D-XXXX-XXXX'). They want to apply a sensitivity label called 'Highly Confidential' to any document containing this pattern. The label should encrypt the document and restrict access to members of the R&D team only. Additionally, they want users to be prompted to apply the label when they create a new document in the R&D site. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that applies the 'Highly Confidential' label to documents containing the custom sensitive info type.. Auto-labeling policies in Microsoft Purview can automatically apply a sensitivity label based on sensitive info types (e.g., custom pattern 'R&D-XXXX-XXXX'). The 'Highly Confidential' label must be pre-configured with encryption and access restrictions for the R&D team. Option A (DLP policy) detects and blocks sharing but does not apply labels. Option B (default label) applies a static label to all documents in the site, not based on content. Option D (manual labeling) does not meet the automatic requirement.

Answer

Create a DLP policy that blocks sharing of documents containing the pattern.

Answer

Configure a default sensitivity label for the R&D SharePoint site.

Answer

Train users to manually apply the 'Highly Confidential' label to R&D documents.

Question 15

Litware Inc. is a law firm that uses Microsoft 365 E5. They have a requirement to preserve all communications between attorneys and clients as legal hold for ongoing litigation. The legal team needs to identify and preserve all relevant emails and documents from specific users. The preservation should be indefinite until the hold is released. The IT team has enabled Litigation Hold for the mailboxes of the involved users. However, the legal team also needs to preserve documents in SharePoint Online and OneDrive for Business. What should you do to preserve the documents?

Accepted Answer

Create an eDiscovery case and place a hold on the relevant SharePoint sites and OneDrive accounts.. A eDiscovery hold can be placed on specific sites and mailboxes for a specific case. Option A (Litigation Hold) only applies to mailboxes, not SharePoint/OneDrive. Option B (retention policy) is for time-based retention, not indefinite hold. Option D (label) does not preserve content permanently.

Answer

Create a retention policy in Microsoft Purview to retain all documents in the involved sites for 10 years.

Answer

Enable Litigation Hold for the users' OneDrive for Business accounts.

Answer

Apply a retention label to all documents in the involved sites.