MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 16 — 15 Questions

Question 1

An organization uses Microsoft 365 Copilot and wants to ensure that AI-generated content is automatically labeled with a sensitivity label. What should they configure?

Accepted Answer

Microsoft Purview auto-labeling policies. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on conditions, including Copilot-generated content. Options A, C, and D are incorrect because they do not handle automatic labeling of Copilot output.

Answer

Microsoft Defender for Cloud Apps session policies

Answer

Microsoft Intune app protection policies

Answer

Conditional Access policies in Microsoft Entra ID

Question 2

A company needs to audit user activities in Microsoft 365 for compliance. Which tool should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) provides comprehensive auditing of user and admin activities. Option B is correct. The other options are for other purposes.

Answer

Microsoft Defender XDR

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 3

A user reports that they cannot access a SharePoint site that contains sensitive data. The administrator confirms the user is licensed and the site permissions are correct. What should the administrator check next?

Accepted Answer

Conditional Access policies in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID can block access based on conditions like device compliance or location. Option D is correct. The other options are less likely given the scenario.

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Microsoft Purview retention policies

Answer

Microsoft Intune device compliance policies

Question 4

An organization must comply with GDPR and needs to respond to a data subject access request (DSAR) within 30 days. Which Microsoft Purview solution helps search for personal data across Microsoft 365?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) allows searching across content locations for specific data, including personal data. Option C is correct. DLP and Records Management do not search, and Audit logs only track activities.

Answer

Data Loss Prevention (DLP)

Answer

Records Management

Answer

Audit (Premium)

Question 5

A company wants to prevent employees from forwarding sensitive emails outside the organization. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption allows encryption and rights protection, including preventing forwarding. Option A is correct. The other options do not specifically prevent forwarding.

Answer

Microsoft Intune Mobile Application Management

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Defender for Office 365 Anti-Phishing

Question 6

An organization uses Microsoft 365 Copilot and wants to ensure that Copilot responses are based only on data the user has permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. The principle of least privilege ensures users only access data they need. Copilot respects existing permissions. Option B is correct. Options A, C, and D are incorrect.

Answer

Defense in depth

Answer

Segregation of duties

Answer

Zero Trust

Question 7

A company needs to enforce that all documents marked as 'Confidential' are encrypted and cannot be printed. Which combination of Microsoft Purview features should they use?

Accepted Answer

Sensitivity labels with encryption and rights management. Sensitivity labels can apply encryption and usage restrictions like 'Do Not Print'. Option D is correct. The other options are incomplete or incorrect.

Answer

Microsoft Entra ID Conditional Access and Intune app protection

Answer

Data Loss Prevention (DLP) policies and retention labels

Answer

eDiscovery (Premium) and Audit (Premium)

Question 8

An administrator needs to ensure that only compliant devices can access Exchange Online. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access policies. Conditional Access policies can enforce device compliance. Option A is correct. The other options are not used for device access control.

Answer

Privileged Identity Management

Answer

Multi-Factor Authentication

Answer

Identity Protection

Question 9

Which TWO Microsoft 365 tools can help an organization detect and respond to insider data theft?

Accepted Answer

Microsoft Defender for Cloud Apps. Insider Risk Management in Microsoft Purview detects insider threats, and Microsoft Defender for Cloud Apps can detect anomalous data exfiltration. The other options are less relevant.

Answer

Microsoft Intune

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Sentinel

Question 10

Which THREE Microsoft Purview features are part of the eDiscovery workflow for legal investigations?

Accepted Answer

Content Search. eDiscovery workflow includes Content Search (identify data), Hold (preserve data), and Export (export data for review). Communication is part of eDiscovery Premium but not always required; Analytics is not a standard eDiscovery feature.

Answer

Communication

Answer

Analytics

Question 11

Which TWO Microsoft 365 compliance centers provide tools for managing compliance requirements?

Accepted Answer

Microsoft Purview compliance portal. Microsoft Purview compliance portal is the main compliance center; Microsoft 365 admin center includes compliance management features. Defender XDR is security, Intune is device management, Entra ID is identity.

Answer

Microsoft Entra admin center

Answer

Microsoft Defender XDR portal

Answer

Microsoft Intune admin center

Question 12

You have the above Microsoft Purview DLP policy JSON. What will this policy do?

Accepted Answer

Block external sharing of documents labeled Confidential. The policy blocks access when a document with sensitivity label 'Confidential' is shared externally. Option B is correct. It does not block internal sharing, apply encryption, or trigger alert.

Answer

Block internal sharing of documents labeled Confidential

Answer

Alert when Confidential documents are shared externally

Answer

Apply encryption to documents labeled Confidential when shared externally

Question 13

You run the above PowerShell cmdlets against Microsoft Entra ID. What is the output?

Accepted Answer

List of Microsoft 365 group names the user is a member of. The cmdlets retrieve the user's group memberships and filter for groups, outputting display names. Option C is correct. It does not show roles, licenses, or devices.

Answer

List of roles assigned to the user

Answer

List of devices enrolled by the user

Answer

List of licenses assigned to the user

Question 14

Contoso Ltd. is a multinational corporation with 10,000 employees. They have recently adopted Microsoft 365 E5 and want to implement a comprehensive security and compliance strategy. Their requirements include: 1) All sensitive emails must be encrypted in transit and at rest. 2) Access to SharePoint sites containing financial data must be restricted to employees from the finance department only, and only from compliant devices. 3) They need to detect and remediate insider threats involving data exfiltration via email and cloud storage. 4) They must comply with GDPR and be able to respond to DSARs within 30 days. 5) They want to use Microsoft 365 Copilot but ensure that Copilot only accesses data that users already have permission to see. Which combination of Microsoft 365 solutions should Contoso implement?

Accepted Answer

Use Microsoft Purview Message Encryption, Conditional Access with device compliance, Microsoft Purview Insider Risk Management, eDiscovery (Premium), and Copilot's default permissions.. Option D is the best answer because it covers all requirements: Microsoft Purview Message Encryption (email encryption), Conditional Access with device compliance (restrict access), Insider Risk Management (insider threats), eDiscovery (DSARs), and Copilot's built-in permissions (least privilege). Option A lacks device compliance and proper insider threat detection. Option B uses Intune app protection instead of Conditional Access, which is less specific for SharePoint access. Option C uses retention policies for DSARs, which is incorrect.

Answer

Enable Microsoft Purview Message Encryption, Conditional Access with device compliance, Microsoft Purview Insider Risk Management, Microsoft Purview eDiscovery (Premium), and Copilot with default permissions.

Answer

Deploy Azure Information Protection for email, Microsoft Entra ID Privileged Identity Management, Microsoft Sentinel, retention policies, and Copilot settings.

Answer

Implement Microsoft Purview Message Encryption, Microsoft Intune device compliance, Microsoft Defender for Cloud Apps, retention policies, and Copilot configuration.

Question 15

A company is deploying Microsoft 365 and wants to ensure that customer financial data remains within the European Union. Which Microsoft 365 feature should the administrator configure?

Accepted Answer

Configure Data Location settings in the Microsoft 365 admin center.. Option A is correct because Data Location (or data residency) is a Microsoft 365 feature that allows organizations to specify where their data is stored at rest, ensuring compliance with regional regulations like GDPR. Option B is incorrect because DLP prevents data loss but does not control storage location. Option C is incorrect because Conditional Access controls access, not storage. Option D is incorrect because sensitivity labels classify data but do not enforce storage location.

Answer

Apply sensitivity labels using Microsoft Purview.

Answer

Set up Conditional Access policies in Microsoft Entra ID.

Answer

Implement Data Loss Prevention (DLP) policies.