MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 16 — 15 Questions

Question 1

A healthcare organization must ensure that electronic protected health information (ePHI) in Microsoft 365 is encrypted both at rest and in transit. Which Microsoft 365 feature provides encryption for data in transit?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TLS/SSL encryption. TLS/SSL encryption is the Microsoft 365 feature that protects data in transit — all Microsoft 365 services use TLS by default for client-to-service and service-to-service communication, and TLS 1.2+ is enforced for modern clients. This directly satisfies the requirement to encrypt ePHI in transit, complementing at-rest encryption provided by BitLocker and service-side encryption.

Answer

Azure Information Protection

Answer

BitLocker Drive Encryption

Answer

Microsoft Purview Information Protection

Question 2

Which TWO of the following are key capabilities of Microsoft Purview Communication Compliance? (Choose two.)

Accepted Answer

Detect and respond to inappropriate messages. Option A is correct because Microsoft Purview Communication Compliance is specifically designed to detect potentially inappropriate, harassing, or offensive messages across channels like Teams, Exchange, and Viva Engage, and to let reviewers investigate and remediate them with actions such as tagging, notifying, or escalating. Option D is correct because the same solution supports regulatory compliance use cases by monitoring communications for policy violations tied to regulations (for example, FINRA, HIPAA, or insider trading), using trainable classifiers, sensitive information types, and review workflows. Option B is not a capability of Communication Compliance; multifactor authentication is enforced through Microsoft Entra ID (Conditional Access / authentication methods), not through communication monitoring policies. Option C is not part of Communication Compliance; retention labels are configured in Microsoft Purview Data Lifecycle Management / Records Management to govern how long content is kept. Option E is not a Communication Compliance feature; blocking external email forwarding is handled by Exchange Online transport rules, Defender for Office 365 anti-spam/anti-phishing policies, or DLP, not by Communication Compliance's detection-and-review model.

Answer

Enforce multifactor authentication

Answer

Configure retention labels

Answer

Block external email forwarding

Question 3

Which TWO of the following are examples of security defaults in Microsoft Entra ID? (Choose two.)

Accepted Answer

Require multifactor authentication for all users. Security defaults in Microsoft Entra ID are a preconfigured set of baseline protections that Microsoft enables for tenants that have not purchased Entra ID P1/P2 licenses. Option A is correct because security defaults require all users to register for and use multifactor authentication (MFA) via the Microsoft Authenticator app when necessary, protecting against credential-stuffing and password-spray attacks. Option E is correct because security defaults block legacy authentication protocols (such as POP, IMAP, SMTP AUTH, and older Office clients) that cannot enforce MFA, thereby closing a common MFA-bypass vector. Option B is incorrect because allowing legacy authentication is the opposite of what security defaults do — they block it. Option C is incorrect because security defaults do not disable self-service password reset; SSPR is a separate feature configured independently. Option D is incorrect because enabling guest user access is not part of security defaults; guest access is governed by external collaboration settings, and security defaults actually restrict guest actions such as Azure portal access.

Answer

Allow legacy authentication protocols

Answer

Disable self-service password reset

Answer

Enable guest user access

Question 4

Which THREE of the following are valid data subject rights under GDPR? (Choose three.)

Accepted Answer

Right to data portability. Under GDPR, Article 20 grants the Right to data portability (A), allowing data subjects to receive their personal data in a structured, commonly used, machine-readable format and transmit it to another controller. Article 17 establishes the Right to erasure, also known as the right to be forgotten (B), enabling individuals to request deletion of personal data under specified conditions. Article 15 provides the Right of access (C), giving data subjects the ability to obtain confirmation of whether their data is processed and access to that data plus related information. Options D and E are not GDPR rights: the regulation instead embodies storage limitation (Article 5(1)(e)), which discourages perpetual storage, and it does not grant a right to monetize one's data.

Answer

Right to perpetual storage

Answer

Right to monetization of data

Question 5

Which TWO of the following are capabilities of Microsoft Priva? (Choose two.)

Accepted Answer

Automate subject rights requests. Microsoft Priva includes Subject Rights Requests, which lets organizations automate the intake, tracking, and fulfillment of data subject requests (DSRs) under regulations like GDPR and CCPA, so option A is correct. Priva also provides Privacy Risk Management capabilities, including the ability to assess and remediate privacy risks in data transfers across tenants and regions, making option C correct. Option B is not a Priva capability; retention labels are configured through Microsoft Purview records management and data lifecycle management. Option D is incorrect because network traffic monitoring is handled by tools such as Microsoft Defender for Cloud Apps or network security solutions, not Priva. Option E is incorrect because malware detection in email attachments is performed by Microsoft Defender for Office 365, not Priva.

Answer

Configure retention labels

Answer

Monitor network traffic

Answer

Detect malware in email attachments

Question 6

Which THREE of the following are key pillars of the Microsoft Trusted Cloud? (Choose three.)

Accepted Answer

Security. The Microsoft Trusted Cloud is built on three foundational pillars: Security, Privacy, and Compliance. Option C (Security) is correct because Microsoft protects customer data using defense-in-depth measures such as encryption, identity controls, and threat detection across its cloud services. Option D (Privacy) is correct because Microsoft commits to being transparent about data collection and usage, giving customers control over their data and not using it for advertising without consent. Option E (Compliance) is correct because Microsoft maintains a broad portfolio of certifications and attestations (e.g., ISO 27001, SOC, GDPR, HIPAA) so customers can meet their own regulatory obligations. Options A (Cost optimization) and B (Performance) are not pillars of the Trusted Cloud; they are general cloud benefits addressed by tools like Azure Cost Management and Azure Monitor, but they are not part of the trust framework.

Answer

Cost optimization

Answer

Performance

Question 7

A user reports receiving a phishing email in their Outlook inbox. The organization uses Microsoft Defender for Office 365. Which feature should the user use to report the email to the security team?

Accepted Answer

Use the Report Message add-in in Outlook. The Report Message add-in in Outlook is the user-facing tool that lets users report suspicious emails directly to the security team with a single click. Reported messages are sent to Microsoft for analysis and can be routed to the organization's security operations team via the Microsoft 365 Defender portal's user-reported settings. This is the intended workflow for phishing reports in Defender for Office 365 environments.

Answer

Block the sender in Outlook

Answer

Submit the email to the Microsoft 365 Defender portal

Answer

Enable Safe Links in Outlook

Question 8

A company uses Microsoft Purview Communication Compliance to detect inappropriate messages. Which action can an administrator take after reviewing a flagged message?

Accepted Answer

Resolve the case with a notification to the sender. In Microsoft Purview Communication Compliance, after a reviewer investigates a flagged message, they can resolve the case by taking actions such as notifying the sender, escalating, or marking as false positive. Resolving with a notification to the sender is a standard remediation action. Retention policies and DLP policies are separate Purview solutions and cannot be applied directly from a Communication Compliance case.

Answer

Apply a retention policy to the message

Answer

Create a DLP policy based on the message

Answer

Recall the message from the recipient

Question 9

An organization wants to ensure that only compliant devices can access Microsoft 365 resources. They use Microsoft Intune for device management. Which policy should they configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID. Conditional Access in Microsoft Entra ID is the policy engine that evaluates signals (user, device, location, app) and enforces access controls such as 'require compliant device' before granting access to Microsoft 365 resources. Intune supplies the device compliance state, but it is Conditional Access that actually blocks non-compliant devices from reaching the resource. This is the only option that enforces the access decision at authentication time.

Answer

Enable device enrollment in Intune

Answer

Create a compliance policy in Intune

Answer

Create a device configuration policy in Intune

Question 10

An administrator is assigned the Global Reader role in Microsoft Entra ID as shown in the exhibit. What can this administrator do?

Accepted Answer

View all user and group properties in the directory. The Global Reader role in Microsoft Entra ID is a read-only role that allows viewing all directory settings, including user and group properties, but does not grant any write permissions. This enables the administrator to view but not modify user or group attributes, making option A correct.

Answer

Reset user passwords

Answer

Assign administrative roles to other users

Answer

Create new users in the directory

Question 11

An organization uses Microsoft Defender XDR and wants to investigate a potential ransomware attack. Which portal should the security team use to see the full attack timeline?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the unified investigation surface for Microsoft Defender XDR, where incidents, alerts, and the full attack timeline are correlated across endpoints, identities, email, and cloud apps. It provides the incident graph and timeline view needed to trace a ransomware attack end-to-end. Microsoft Sentinel is a SIEM/SOAR platform, not the native Defender XDR investigation portal.

Answer

Microsoft Purview compliance portal

Answer

Microsoft Sentinel

Answer

Azure portal

Question 12

A user needs to sign in to Microsoft 365 from an untrusted device. The company requires multifactor authentication (MFA) for all external access. Which Microsoft Entra ID feature enforces this requirement?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the feature that enforces access controls based on conditions such as user, device, location, and application. It can require MFA for access from untrusted devices or external locations. By creating a Conditional Access policy that targets all users and requires MFA when the device is not compliant or not trusted, the company can enforce MFA for external access.

Answer

Microsoft Entra ID Protection

Answer

Security defaults

Answer

Microsoft Entra ID Password Protection

Question 13

Which TWO components are part of Microsoft's Service Trust Portal?

Accepted Answer

Audit reports and compliance guides. Options A and C are correct. The Service Trust Portal provides compliance reports, audit reports, and trust documents. Options B, D, and E are not part of the Service Trust Portal; they are separate portals.

Answer

Azure portal

Answer

Microsoft Purview compliance portal

Answer

Microsoft 365 Defender portal

Question 14

Which THREE are features of Microsoft Purview Information Protection?

Accepted Answer

Auto-labeling for sensitive data. Auto-labeling for sensitive data (A) is a core Microsoft Purview Information Protection feature that uses trainable classifiers and sensitive information types to automatically apply sensitivity labels to content at rest or in transit. Encryption for emails and documents (B) is provided through sensitivity labels, which can enforce Azure Rights Management (Azure RMS) encryption so that only authorized users can decrypt protected content. Sensitivity labels (E) are the foundational capability of Information Protection, allowing classification and protection settings (encryption, content marking, and restrictions) to travel with the data. Data loss prevention policies (C) belong to Microsoft Purview Data Loss Prevention, a separate workload that detects and blocks risky sharing, and retention policies (D) belong to Microsoft Purview Data Lifecycle Management for retaining or deleting content, so neither is a feature of Information Protection itself.

Answer

Data loss prevention policies

Answer

Retention policies

Question 15

Which THREE are core pillars of the Microsoft Trust Center?

Accepted Answer

Compliance. The Microsoft Trust Center is built on three core pillars: Security, Privacy, and Compliance. Option D (Security) is correct because Microsoft's trust framework centers on protecting customer data through encryption, identity controls, and threat protection across its cloud services. Option E (Privacy) is correct because Microsoft commits to being transparent about data collection and giving customers control over their data through privacy statements and data subject rights. Option A (Compliance) is correct because the Trust Center provides compliance offerings, audit reports, and certifications (such as ISO 27001, SOC, and GDPR resources) that demonstrate adherence to regulatory standards. Option B (Reliability) is not one of the three pillars; while reliability is an important service quality, it is not part of the Trust Center's core trust pillars. Option C (Transparency) is also not one of the three pillars; transparency is a principle Microsoft emphasizes within its privacy and security practices, but it is not listed as a standalone core pillar of the Trust Center.

Answer

Reliability

Answer

Transparency