MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 17 — 15 Questions

Question 1

Your organization wants to ensure that data sent to Microsoft 365 is encrypted in transit. Which protocol should you enforce for all client connections?

Accepted Answer

TLS 1.2. TLS 1.2 is the correct protocol because Microsoft 365 enforces TLS 1.2 or later for all client-to-service connections to ensure data is encrypted in transit. TLS provides end-to-end encryption for HTTP-based traffic (including HTTPS) and is the standard protocol used by Microsoft 365 services like Exchange Online, SharePoint Online, and Teams. Enforcing TLS 1.2 ensures that older, less secure versions like TLS 1.0 and 1.1 are blocked, meeting the organization's encryption requirement.

Answer

IPsec

Answer

HTTPS

Answer

SSH

Question 2

A user accidentally shared a file containing credit card numbers with a partner organization. You need to prevent similar incidents and detect when such data is shared externally. What should you configure?

Accepted Answer

Microsoft 365 Data Loss Prevention (DLP) policy. Microsoft 365 Data Loss Prevention (DLP) policies are specifically designed to identify sensitive information such as credit card numbers using sensitive information types and to prevent or detect when that data is shared externally. DLP can block sharing, generate alerts, and provide policy tips to users, directly addressing both prevention and detection requirements.

Answer

Azure Information Protection (AIP)

Answer

Microsoft Purview eDiscovery

Answer

Information Rights Management (IRM)

Question 3

Which THREE capabilities are provided by Microsoft Purview Information Protection? (Choose three.)

Accepted Answer

Auto-classify content based on sensitive data types. Microsoft Purview Information Protection provides auto-classification of content by detecting sensitive data types (e.g., credit card or national ID patterns) through trainable classifiers and sensitive information types, which justifies option A. It also lets organizations apply sensitivity labels to documents and emails across Microsoft 365 apps, making option B correct. Those same sensitivity labels can enforce encryption and access restrictions (e.g., via Azure Rights Management), so option C is correct. Option D is not a core Information Protection capability; blocking email sharing of sensitive data is handled by Data Loss Prevention (DLP) policies, a related but distinct workload. Option E is also incorrect here because retention policies for mailboxes belong to Microsoft Purview Data Lifecycle Management, not Information Protection.

Answer

Block sharing of sensitive data via email

Answer

Define retention policies for mailboxes

Question 4

Your company is subject to the General Data Protection Regulation (GDPR). Which Microsoft 365 compliance feature helps you respond to a Data Subject Request (DSR) to export a user's personal data?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery (Standard or Premium) is the compliance tool designed to identify, collect, preserve, and export content in response to Data Subject Requests under GDPR. It can search across Exchange, SharePoint, OneDrive, Teams, and other workloads, then export the results in a review set that satisfies the DSR 'right of access' and 'right to data portability' requirements.

Answer

Microsoft Information Protection

Answer

Data Loss Prevention

Answer

Unified audit log

Question 5

You are configuring a Communication Compliance policy to detect workplace harassment. The policy currently includes conditions for sensitive information types (credit card numbers, SSN) and keywords. After deployment, the policy generates many irrelevant alerts for routine HR communications that contain the keywords but no harassment. What should you modify to improve detection accuracy?

Accepted Answer

Use a trainable classifier for 'harassment' instead of keyword matching. Trainable classifiers in Microsoft Purview use machine learning to identify specific types of content based on examples, rather than relying on predefined keywords or sensitive information types. For detecting workplace harassment, a trainable classifier can be trained with actual examples of harassing language, making it far more accurate than keyword matching, which often triggers false positives in routine HR communications. This directly addresses the problem of irrelevant alerts.

Answer

Expand the keyword list to include more terms

Answer

Add more sensitive information types

Answer

Enable audit logging for all communications

Question 6

Which TWO are key capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Cloud Discovery to identify shadow IT. Option D (Cloud Discovery to identify shadow IT) is correct because Defender for Cloud Apps uses Cloud Discovery to analyze traffic logs from firewalls and proxies (or via the Defender for Endpoint integration) to detect unsanctioned SaaS apps, giving organizations visibility into shadow IT. Option E (Session control to monitor and control app access in real-time) is correct because Conditional Access App Control uses a reverse proxy to enforce real-time session policies, such as blocking downloads or uploads, on cloud apps. Option A is incorrect because email encryption and secure messaging are capabilities of Microsoft Purview (Exchange Online/Message Encryption), not Defender for Cloud Apps. Option B is incorrect because device compliance policy enforcement is handled by Microsoft Intune and Conditional Access, not Defender for Cloud Apps. Option C is incorrect because on-device malware scanning is provided by Microsoft Defender for Endpoint, not Defender for Cloud Apps.

Answer

Email encryption and secure messaging

Answer

Device compliance policy enforcement

Answer

On-device malware scanning

Question 7

A company is deploying Microsoft 365 and needs to ensure that external sharing of sensitive documents is blocked. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP) policies. Microsoft Purview Data Loss Prevention (DLP) policies are designed to detect and block sensitive information (credit cards, SSNs, custom sensitive types) from being shared externally across Exchange, SharePoint, OneDrive, and Teams. DLP can enforce actions like blocking external sharing, encrypting content, or notifying users, which directly addresses the requirement to prevent external sharing of sensitive documents.

Answer

Sensitivity labels

Answer

Information Barriers

Answer

Retention policies

Question 8

An organization uses Microsoft 365 Copilot and wants to ensure that AI-generated content is automatically labeled with a sensitivity label. What should they configure?

Accepted Answer

Microsoft Purview auto-labeling policies. Microsoft Purview auto-labeling policies automatically apply sensitivity labels to content based on conditions such as sensitive information types or trainable classifiers. This ensures that AI-generated content, like that from Microsoft 365 Copilot, is labeled according to organizational policy without manual intervention. Auto-labeling can be configured to label content at rest or in transit.

Answer

Microsoft Defender for Cloud Apps session policies

Answer

Microsoft Intune app protection policies

Answer

Conditional Access policies in Microsoft Entra ID

Question 9

A company needs to audit user activities in Microsoft 365 for compliance. Which tool should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is specifically designed to retain and search audit logs for user and admin activities across Microsoft 365 services, meeting compliance and forensic investigation needs. It provides high-bandwidth access to the Office 365 Audit Log, supports custom retention policies (up to 10 years), and offers intelligent insights such as high-value events and access to critical events like MailItemsAccessed. This makes it the correct tool for auditing user activities for compliance.

Answer

Microsoft Defender XDR

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 10

A user reports that they cannot access a SharePoint site that contains sensitive data. The administrator confirms the user is licensed and the site permissions are correct. What should the administrator check next?

Accepted Answer

Conditional Access policies in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID are evaluated at sign-in and can block access to SharePoint Online based on user, device, location, or risk conditions — even when licensing and site permissions are correct. If the user's device is non-compliant, from an untrusted location, or the user fails an MFA requirement, Conditional Access will deny access to the SharePoint resource, which matches the symptom described.

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Microsoft Purview retention policies

Answer

Microsoft Intune device compliance policies

Question 11

An organization must comply with GDPR and needs to respond to a data subject access request (DSAR) within 30 days. Which Microsoft Purview solution helps search for personal data across Microsoft 365?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) in Microsoft Purview is purpose-built for identifying, collecting, and reviewing content across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) in response to legal and regulatory requests like GDPR DSARs. It supports keyword searches, custodian-based holds, and case management workflows that map directly to the DSAR process. Its search capabilities span mailboxes, sites, and chats, which is exactly what a DSAR requires to locate all personal data tied to a data subject.

Answer

Data Loss Prevention (DLP)

Answer

Records Management

Answer

Audit (Premium)

Question 12

A company wants to prevent employees from forwarding sensitive emails outside the organization. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (part of Purview Information Protection) lets organizations encrypt and apply usage restrictions to email, including preventing forwarding, printing, or copying of sensitive messages. It uses Azure Rights Management to enforce protection that travels with the message, so even if a recipient tries to forward it outside the organization, the protection persists. This directly addresses the requirement to prevent forwarding sensitive emails outside the organization.

Answer

Microsoft Intune Mobile Application Management

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Defender for Office 365 Anti-Phishing

Question 13

An organization uses Microsoft 365 Copilot and wants to ensure that Copilot responses are based only on data the user has permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. Microsoft 365 Copilot respects the permissions of the signed-in user, meaning it only surfaces data the user already has access to. This enforces the principle of least privilege by ensuring users cannot use Copilot to access information beyond their authorized scope. It does not grant new access; it inherits existing access controls.

Answer

Defense in depth

Answer

Segregation of duties

Answer

Zero Trust

Question 14

A company needs to enforce that all documents marked as 'Confidential' are encrypted and cannot be printed. Which combination of Microsoft Purview features should they use?

Accepted Answer

Sensitivity labels with encryption and rights management. Sensitivity labels in Microsoft Purview can apply encryption and rights management (Azure Rights Management) directly to documents, and label policies can enforce protection settings such as 'do not print' and 'do not copy.' When a user labels a document 'Confidential,' the label can automatically encrypt it and restrict actions like printing, fulfilling both requirements in a single control.

Answer

Microsoft Entra ID Conditional Access and Intune app protection

Answer

Data Loss Prevention (DLP) policies and retention labels

Answer

eDiscovery (Premium) and Audit (Premium)

Question 15

An administrator needs to ensure that only compliant devices can access Exchange Online. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID evaluate signals such as user, device compliance state, location, and app, and can grant or block access based on those conditions. To restrict Exchange Online access to compliant devices only, the admin creates a policy targeting Exchange Online that requires the device to be marked compliant (via Intune) or hybrid Microsoft Entra ID joined. This is the specific Entra ID feature designed for signal-based, conditional access enforcement.

Answer

Privileged Identity Management

Answer

Multi-Factor Authentication

Answer

Identity Protection