MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 17 — 15 Questions

Question 1

A healthcare organization uses Microsoft 365 and needs to prevent sensitive patient data from being emailed externally. They have enabled Microsoft Purview Data Loss Prevention (DLP). What additional step should they take to ensure that end users are educated when they attempt to send such data?

Accepted Answer

Configure a policy tip in the DLP policy.. Option B is correct because configuring a policy tip in DLP policies shows a notification to users when they attempt to send sensitive data, educating them about the policy. Option A is incorrect because sensitivity labels classify data but do not provide real-time user education. Option C is incorrect because auditing only logs events, it does not educate users. Option D is incorrect because Microsoft Defender for Cloud Apps is for cloud access security, not inline user education.

Answer

Enable auditing in Microsoft Purview Compliance Portal.

Answer

Deploy Microsoft Defender for Cloud Apps.

Answer

Apply a sensitivity label that blocks external sharing.

Question 2

Refer to the exhibit. A Microsoft Purview sensitivity label policy is defined as shown. A user applies this label to a document in Microsoft 365. Which action will occur automatically?

Accepted Answer

The document will be encrypted.. Option A is correct because the settings show encryptionenabled: true, so the document will be encrypted. Option B is incorrect because the markinginfo includes header and footer, not a watermark. Option C is incorrect because there is no DLP policy referenced. Option D is incorrect because there is no retention setting in the label.

Answer

The document will be automatically deleted after 30 days.

Answer

A watermark will be added.

Answer

The document will be blocked from external sharing.

Question 3

A company is adopting Microsoft 365 and wants to ensure they can investigate security incidents across email, endpoints, and identities in a unified console. Which Microsoft 365 workload should they use?

Accepted Answer

Microsoft Defender XDR. Option B is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides a unified incident investigation experience across domains. Option A is incorrect because Microsoft Sentinel is a SIEM that aggregates logs but is not the unified console in Microsoft 365. Option C is incorrect because Microsoft Purview is for compliance and governance, not security investigation. Option D is incorrect because Microsoft Intune is for device management.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Purview Compliance Portal

Question 4

An organization uses Microsoft 365 and wants to automatically classify and protect sensitive data in SharePoint Online based on content patterns. Which Microsoft Purview solution should they implement?

Accepted Answer

Auto-labeling policies. Option C is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive information types or patterns. Option A is incorrect because trainable classifiers require training, not automatic pattern detection. Option B is incorrect because DLP policies prevent data loss but do not automatically classify. Option D is incorrect because retention policies are for retention, not classification.

Answer

Retention policies

Answer

Data Loss Prevention (DLP) policies

Answer

Trainable classifiers

Question 5

A multinational corporation uses Microsoft 365 and must comply with the General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) within the mandated timeframe. Which Microsoft Purview tool should they use to search for personal data across Exchange Online, SharePoint Online, and OneDrive for Business?

Accepted Answer

Content Search. Option C is correct because Content Search in the Microsoft Purview compliance portal allows searching across Exchange, SharePoint, and OneDrive for personal data to fulfill DSARs. Option A is incorrect because eDiscovery (Standard) is for legal discovery, not specifically DSAR. Option B is incorrect because Audit log search is for searching audit records, not content. Option D is incorrect because Data Lifecycle Management focuses on retention and deletion, not search.

Answer

eDiscovery (Standard)

Answer

Audit log search

Answer

Data Lifecycle Management

Question 6

A company wants to ensure that only managed and compliant devices can access corporate email in Microsoft 365. Which Microsoft Entra ID capability should they configure?

Accepted Answer

Conditional Access. Option B is correct because Conditional Access policies in Microsoft Entra ID can require devices to be compliant (e.g., via Intune) before granting access. Option A is incorrect because Identity Protection is for risk detection, not device compliance. Option C is incorrect because Privileged Identity Management is for managing admin roles. Option D is incorrect because Microsoft Authenticator is an app for MFA, not device compliance.

Answer

Microsoft Authenticator

Answer

Privileged Identity Management

Answer

Identity Protection

Question 7

A financial services firm uses Microsoft 365 and must retain all business communications for 7 years to comply with SEC regulations. They also need to prevent users from permanently deleting emails. Which Microsoft Purview feature should they implement?

Accepted Answer

Retention policies and retention labels. Option C is correct because retention policies and labels can enforce retention periods and prevent permanent deletion. Option A is incorrect because DLP prevents data loss, not retention. Option B is incorrect because eDiscovery is for search and hold, not retention enforcement. Option D is incorrect because sensitivity labels classify data but do not enforce retention.

Answer

Sensitivity labels

Answer

eDiscovery (Standard)

Answer

Data Loss Prevention (DLP) policies

Question 8

Refer to the exhibit. A Microsoft Entra ID role assignment is shown. An administrator is assigned the Global Reader role with a condition. What is the effect of the condition?

Accepted Answer

The condition has no practical effect because Global Reader already cannot write role assignments.. Option D is correct because the condition prevents the Global Reader from writing role assignments, but since Global Reader already cannot write role assignments, the condition is redundant. Option A is incorrect because Global Reader inherently cannot create users. Option B is incorrect because the condition does not restrict read access. Option C is incorrect because the condition only blocks role assignment write operations.

Answer

The administrator can create new users.

Answer

The administrator can only read security recommendations.

Answer

The administrator cannot assign roles to other users.

Question 9

Which TWO of the following are key benefits of using Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

It enables organizations to meet compliance requirements by applying protection.. Option A is correct because Information Protection helps classify and protect sensitive data. Option B is correct because it helps meet compliance requirements by applying protection. Option C is incorrect because it does not directly detect phishing. Option D is incorrect because Information Protection is not a backup solution. Option E is incorrect because it does not manage device compliance.

Answer

It automatically detects and blocks phishing emails.

Answer

It manages device compliance with Conditional Access.

Answer

It provides backup and recovery for SharePoint Online.

Question 10

Which THREE of the following are included in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. Option A is correct because Microsoft Defender for Office 365 is part of Defender XDR. Option B is correct because Microsoft Defender for Endpoint is included. Option C is correct because Microsoft Defender for Identity is part of Defender XDR. Option D is incorrect because Microsoft Sentinel is a separate SIEM. Option E is incorrect because Microsoft Purview is a compliance solution.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 11

Which TWO are features of Microsoft Entra ID? (Choose two.)

Accepted Answer

Identity and access management. Option A is correct because Microsoft Entra ID provides identity and access management. Option B is correct because it supports Multi-Factor Authentication. Option C is incorrect because DLP is a Purview feature. Option D is incorrect because device management is Intune. Option E is incorrect because sensitivity labels are Purview.

Answer

Mobile device management

Answer

Data Loss Prevention policies

Answer

Sensitivity labels

Question 12

You are the security administrator for Contoso, a global consulting firm with 10,000 employees. Contoso uses Microsoft 365 E5 and Microsoft Entra ID P2. The company has a strict policy that all sensitive client data must be encrypted at rest and in transit. Additionally, the legal team requires that any document labeled as 'Highly Confidential' must be automatically encrypted and cannot be printed or forwarded. You have created a sensitivity label called 'Highly Confidential' with encryption and a protection setting that restricts actions like printing. However, you notice that users are still able to print documents that have the label applied. After investigation, you find that the label is correctly configured but users are manually applying the label. What should you do to ensure the label is consistently applied and printing is blocked?

Accepted Answer

Create an auto-labeling policy that automatically applies the 'Highly Confidential' label to documents that contain certain sensitive information types, and ensure the label's protection settings block printing.. Option C is correct because auto-labeling policies can automatically apply the sensitivity label based on conditions, ensuring consistent application. Additionally, the label's protection settings should block printing. Option A is incorrect because creating a DLP policy that blocks printing may not respect the sensitivity label's settings. Option B is incorrect because the label already has protection settings, but the issue is manual application. Option D is incorrect because Conditional Access does not control document actions like printing.

Answer

Create a Data Loss Prevention (DLP) policy that blocks printing of documents with the 'Highly Confidential' label.

Answer

Configure a Conditional Access policy that blocks printing for users accessing documents from unmanaged devices.

Answer

Modify the sensitivity label's encryption settings to require user authentication before printing.

Question 13

You are the compliance officer for Fabrikam, a medium-sized company with 500 users on Microsoft 365 Business Premium. Fabrikam must comply with the California Consumer Privacy Act (CCPA). The legal team has identified that they need to be able to respond to consumer requests to delete personal data within 45 days. They also need to ensure that personal data is not retained longer than necessary. You have been asked to configure Microsoft Purview to meet these requirements. Specifically, you need to search for and delete personal data when a deletion request is received, and set up a data retention policy to automatically delete personal data after 2 years. What should you do?

Accepted Answer

Use Content Search to find personal data, then use eDiscovery to delete it for deletion requests. Create a retention policy with a retention period of 2 years for all SharePoint sites and OneDrive accounts.. Option B is correct because to delete personal data for a specific user, you need to use Content Search to find the data and then eDiscovery to delete it. A retention policy can be set to automatically delete data after 2 years. Option A is incorrect because a retention label is for manual application, not automatic deletion. Option C is incorrect because DLP does not delete data. Option D is incorrect because auto-labeling does not delete data.

Answer

Implement auto-labeling to label personal data and configure a retention label to delete after 2 years.

Answer

Create a retention label that deletes data after 2 years and apply it manually to all documents containing personal data.

Answer

Configure a DLP policy to block sharing of personal data and set a retention policy for 2 years.

Question 14

You are the IT administrator for a non-profit organization that uses Microsoft 365 Business Basic. The organization has 50 volunteers who use their own personal devices to access email and SharePoint Online. The board of directors wants to ensure that if a volunteer's device is lost or stolen, the organization's data on that device can be removed remotely. They also want to ensure that volunteers use multi-factor authentication (MFA) to access corporate resources. What should you do?

Accepted Answer

Enroll devices in Microsoft Intune and configure a selective wipe policy. Set up a Conditional Access policy in Microsoft Entra ID to require MFA.. Option D is correct because Microsoft Intune can be used to manage mobile devices and perform selective wipe to remove corporate data. Conditional Access in Microsoft Entra ID can enforce MFA. Option A is incorrect because DLP does not wipe devices. Option B is incorrect because Microsoft Defender for Cloud Apps is for cloud app security, not device wipe. Option C is incorrect because Microsoft Purview does not manage devices.

Answer

Deploy Microsoft Defender for Cloud Apps and configure session controls.

Answer

Use Microsoft Purview to label all corporate data and configure a policy to revoke access.

Answer

Implement a Data Loss Prevention (DLP) policy that blocks access from unmanaged devices.

Question 15

Your organization is deploying Microsoft 365 and needs to ensure that data stored in Exchange Online is protected against accidental deletion. You need to implement a solution that allows users to recover deleted emails for up to 30 days, but also enables administrators to recover items for up to 90 days. Which feature should you configure?

Accepted Answer

Litigation Hold. Option B is correct because the Litigation Hold feature allows administrators to preserve mailbox items for a specified period, enabling recovery for up to 90 days. Single Item Recovery (A) only allows recovery within the deleted item retention period (default 14 days). In-Place Hold (C) is for eDiscovery holds, not general recovery. Retention Policy (D) manages retention but not recovery.

Answer

In-Place Hold

Answer

Single Item Recovery

Answer

Retention Policy