MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 15 — 15 Questions

Question 1

A user reports receiving a phishing email that bypassed Exchange Online Protection (EOP). What should you configure to add a second layer of defense against sophisticated phishing attacks?

Accepted Answer

Purchase and assign Microsoft Defender for Office 365 Plan 2 licenses. Microsoft Defender for Office 365 Plan 2 provides advanced anti-phishing policies, including impersonation protection and automated investigation. Option A (Safe Attachments in EOP) is basic. Option B (DKIM) is email authentication. Option D (blocking all external images) is not a standard anti-phishing measure.

Answer

Block all external images in email

Answer

Enable Safe Attachments in Exchange Online Protection

Answer

Configure DKIM signing for your domain

Question 2

Your organization is required to retain all customer emails for 7 years due to industry regulations. The legal team also needs to be able to search and hold relevant emails during active litigation. Which two Microsoft Purview features should you implement? (Choose two.)

Accepted Answer

Retention policy. Retention policies (A) enforce the 7-year retention. Litigation hold (C) preserves emails for legal cases. Option B (eDiscovery) is for search and export, not hold. Option D (DLP) prevents data leaks. Option E (MIP labels) classify data.

Answer

Data Loss Prevention policy

Answer

eDiscovery (Standard)

Answer

Sensitivity labels

Question 3

Your company uses Microsoft 365 and wants to ensure that when employees share sensitive documents externally, access is automatically revoked after 30 days. Which solution should you use?

Accepted Answer

Microsoft Entra ID Conditional Access. Azure AD (Entra ID) Conditional Access policies can enforce access time limits. Option A (MIP) classifies data. Option C (Defender for Cloud Apps) provides session control. Option D (Intune) manages devices, not access duration.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Information Protection (MIP)

Question 4

A user accidentally shared a file containing credit card numbers with a partner organization. You need to prevent similar incidents and detect when such data is shared externally. What should you configure?

Accepted Answer

Microsoft 365 Data Loss Prevention (DLP) policy. A DLP policy (B) can detect credit card numbers and block external sharing. Option A (IRM) protects files after sharing. Option C (AIP) is now part of MIP. Option D (eDiscovery) is for search, not prevention.

Answer

Azure Information Protection (AIP)

Answer

Microsoft Purview eDiscovery

Answer

Information Rights Management (IRM)

Question 5

Which THREE capabilities are provided by Microsoft Purview Information Protection? (Choose three.)

Accepted Answer

Auto-classify content based on sensitive data types. Sensitivity labels (A), auto-classification (C), and label-based protection (E) are core capabilities. Option B (retention policies) is part of Purview Records Management. Option D (DLP) is a separate Purview feature.

Answer

Block sharing of sensitive data via email

Answer

Define retention policies for mailboxes

Question 6

Your organization is using Microsoft 365 Copilot. You want to ensure that Copilot uses only data that users have permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. Least privilege (B) ensures users only access data they need. Option A (zero trust) is broader. Option C (defense in depth) has multiple layers. Option D (need-to-know) is similar but less formal in Microsoft 365.

Answer

Zero Trust

Answer

Defense in depth

Answer

Need-to-know

Question 7

Your company is subject to the General Data Protection Regulation (GDPR). Which Microsoft 365 compliance feature helps you respond to a Data Subject Request (DSR) to export a user's personal data?

Accepted Answer

Microsoft Purview eDiscovery. eDiscovery (D) allows search and export of content. Option A (Audit) logs activities. Option B (MIP) classifies data. Option C (DLP) prevents leaks.

Answer

Microsoft Information Protection

Answer

Data Loss Prevention

Answer

Unified audit log

Question 8

You are configuring a Communication Compliance policy to detect workplace harassment. The policy currently includes conditions for sensitive information types (credit card numbers, SSN) and keywords. After deployment, the policy generates many irrelevant alerts for routine HR communications that contain the keywords but no harassment. What should you modify to improve detection accuracy?

Accepted Answer

Use a trainable classifier for 'harassment' instead of keyword matching. The policy should use a trainable classifier specifically for harassment (Option B) instead of broad sensitive info types and keywords. Sensitive info types (A) do not detect harassment. Option C (audit log is not relevant). Option D (expanding keywords would increase false positives).

Answer

Expand the keyword list to include more terms

Answer

Add more sensitive information types

Answer

Enable audit logging for all communications

Question 9

Which TWO Microsoft 365 security solutions are included in Microsoft Defender XDR (Extended Detection and Response)? (Choose two.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR includes Defender for Office 365 (B) and Defender for Endpoint (C). Option A (Defender for Identity) is separate. Option D (Defender for Cloud Apps) is also separate. Option E (Azure Sentinel) is a SIEM, not part of Defender XDR.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 10

A company wants to ensure that employees can access corporate email on personal mobile devices without the company being able to wipe the entire device. What should you use?

Accepted Answer

Microsoft Intune App Protection Policies (APP). Intune App Protection Policies (APP) (B) protect data at the app level and allow selective wipe. Option A (MDM) can wipe the whole device. Option C (CA) controls access. Option D (MAM) is essentially APP.

Answer

Microsoft Intune Mobile Device Management (MDM)

Answer

Conditional Access policies in Microsoft Entra ID

Answer

Microsoft Intune Mobile Application Management (MAM)

Question 11

Which THREE statements about Microsoft Purview Audit (Standard) are true? (Choose three.)

Accepted Answer

Users must be assigned an appropriate license to view audit logs. Audit (Standard) retains logs for 90 days (A), includes Exchange admin actions (D), and requires appropriate permissions (E). Option B (180 days) is for Audit (Premium). Option C (all SharePoint events) is also Premium.

Answer

All SharePoint and OneDrive events are audited by default

Answer

Audit records are retained for 180 days by default

Question 12

Your organization is deploying Microsoft 365 Copilot. The compliance team is concerned that Copilot might expose sensitive data in its responses. What should you configure to prevent Copilot from using sensitive content?

Accepted Answer

Sensitivity labels with 'Copilot' condition. Sensitivity labels (C) can restrict Copilot from accessing labeled content. Option A (DLP) blocks sharing, not Copilot. Option B (retention) is for preservation. Option D (audit) logs usage.

Answer

Retention policies

Answer

Data Loss Prevention policies

Answer

Unified audit log

Question 13

You are reviewing an Azure Policy assignment in the exhibit. The policy set definition ID corresponds to the 'Microsoft cloud security benchmark' initiative. The effect is set to 'Deny'. What is the most likely outcome of this policy assignment?

Accepted Answer

Creation of non-compliant resources will be blocked. The 'Deny' effect (C) will block any resource creation that does not meet the benchmark. Option A (audit) would require 'Audit' effect. Option B (deploy) would require 'DeployIfNotExists'. Option D (exempt) is a different feature.

Answer

Non-compliant resources will automatically be remediated

Answer

The policy will only apply to resources with specific tags

Answer

Resources that are non-compliant will be audited and logged

Question 14

Which TWO are key capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Cloud Discovery to identify shadow IT. Defender for Cloud Apps provides Cloud Discovery (A) to identify cloud apps in use, and session control (B) to monitor and control app sessions. Option C (malware scanning) is for Defender for Endpoint. Option D (device compliance) is for Intune. Option E (email encryption) is for Office 365.

Answer

Email encryption and secure messaging

Answer

Device compliance policy enforcement

Answer

On-device malware scanning

Question 15

A company is deploying Microsoft 365 and needs to ensure that external sharing of sensitive documents is blocked. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP) policies. Information Barriers prevent communication and collaboration between specific groups, but DLP policies detect and block sharing of sensitive content. Sensitivity labels and retention policies do not block sharing. Option B is correct because DLP can block sharing of sensitive data.

Answer

Sensitivity labels

Answer

Information Barriers

Answer

Retention policies