MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 2 — 15 Questions

Question 1

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 (option A) is the correct capability for investigating emails tied to a phishing campaign, since it lets security teams view, filter, and pivot on email data such as sender, recipient, URL, and detection technology to identify and remediate threats. Option D is also correct because any new policy or protection configuration, including those used in phishing investigations and response, should be piloted with a limited group before broad rollout to validate behavior and avoid disrupting legitimate mail flow. Option B is incorrect because Threat Explorer is an email threat investigation and hunting tool and does not replace identity and access management, which is handled by services like Microsoft Entra ID. Option C is incorrect because investigating phishing emails never requires making documents public; that would be a severe security and compliance violation.

Answer

It replaces the need for identity and access management

Answer

It requires every document to be made public

Question 2

Your organization is deploying Microsoft 365 and needs to ensure that data stored in SharePoint Online and OneDrive for Business is protected against accidental deletion by end users. The compliance team requires that deleted files be recoverable for at least 90 days. What should you implement?

Accepted Answer

Create a Microsoft Purview retention policy with a retention period of 90 days.. A Microsoft Purview retention policy with a 90-day retention period ensures that content in SharePoint Online and OneDrive for Business is retained for at least 90 days, even if users delete it. Retention policies preserve data for the specified period and can be configured to retain only or retain-then-delete, directly satisfying the compliance requirement for recoverability.

Answer

Enable versioning on all document libraries.

Answer

Increase the SharePoint Online recycle bin retention to 90 days.

Answer

Configure a Microsoft Purview Data Loss Prevention (DLP) policy for SharePoint.

Question 3

Refer to the exhibit. You are reviewing a Microsoft Purview Information Protection policy created by a colleague. The policy is intended to prevent users from sharing files labeled 'Highly Confidential' with external parties. However, users are still able to share these files externally. Which of the following is the most likely reason?

Accepted Answer

The sensitivity label is not published to the users.. The most likely reason is that the sensitivity label is not published to the users. Even if a sensitivity label is configured with encryption and content marking, it must be published via a label policy to the intended users. If not published, users cannot apply the label, and thus the protection (e.g., blocking external sharing) does not take effect. The policy to block external sharing is typically part of the label's protection settings, but it only applies when the label is applied.

Answer

The policy is missing the 'blockAccess' action.

Answer

The action should be set to 'blockAccess' only.

Answer

The condition should check for file extension instead of sensitivity label.

Question 4

Refer to the exhibit. A Microsoft 365 administrator runs the PowerShell script against Microsoft Entra ID. The script outputs several enabled Conditional Access policies. However, users report they are not prompted for MFA even though there is an enabled policy that should require MFA for all users. What is the most likely reason?

Accepted Answer

The policy is set to 'report-only' mode.. The most likely reason users are not prompted for MFA despite an enabled Conditional Access policy requiring MFA is that the policy is set to 'report-only' mode. In report-only mode, the policy is evaluated and logged but not enforced, meaning users will not be prompted for MFA. This is a common configuration used for testing before enabling the policy in 'on' mode.

Answer

The script is not executed with administrative privileges.

Answer

The script does not run against all policies.

Answer

The script disables the MFA policy inadvertently.

Question 5

Which TWO of the following are requirements for implementing Microsoft Purview Customer Key? (Choose two.)

Accepted Answer

An Azure subscription with Azure Key Vault. Option B is correct because Customer Key requires an Azure subscription in which you create and manage the Azure Key Vault (or Managed HSM) that holds the two encryption keys used as the root of the data-at-rest encryption hierarchy for Microsoft 365 workloads. Option C is correct because implementing Customer Key requires an eligible Microsoft 365 license, specifically Microsoft 365 E5 (or the equivalent E5/G5 offerings that include the Customer Key feature). Option A is not required; Customer Key does not depend on Microsoft Entra ID Premium P2, which is tied to Identity Protection and PIM rather than key management. Option D is not required; Microsoft Defender for Cloud Apps is a CASB solution unrelated to establishing Customer Key. Option E is not required; Customer Key uses Azure Key Vault or Azure Managed HSM in Azure, not an on-premises HSM.

Answer

Microsoft Entra ID Premium P2 licenses

Answer

Microsoft Defender for Cloud Apps

Answer

An on-premises Hardware Security Module (HSM)

Question 6

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel to investigate a user's deleted files. The query returns no results even though the user has deleted files. Which of the following is the most likely reason?

Accepted Answer

The Microsoft 365 connector is not configured in Sentinel.. The KQL query targets the 'OfficeActivity' table, which is populated by the Microsoft 365 connector in Microsoft Sentinel. If this connector is not configured, the table will be empty, causing the query to return no results even though the user has deleted files. All other options are incorrect because the query syntax is valid, the operation name 'DeleteFile' is correct for the OfficeActivity schema, and the UserId field is a legitimate field in that table.

Answer

The query filters by Result column which doesn't exist.

Answer

The query should use 'where Operation == "FileDeleted"' but the operation is 'DeleteFile'.

Answer

The UserId field should be replaced with UserPrincipalName.

Question 7

Your organization is required to retain all communications related to a legal case for 5 years. Emails and Teams messages must be preserved immutably. Which Microsoft 365 feature should you use?

Accepted Answer

Litigation Hold. Litigation Hold preserves all mailbox and Teams chat content immutably for legal purposes. Option A is correct. Option B, Data Loss Prevention (DLP) policies, is used to prevent sensitive data from being shared, not for preservation. Option C, Retention policies and tags, can retain or delete data based on policies but does not provide the immutable preservation required for legal holds. Option D, eDiscovery (Standard), is used for searching and exporting content, not for preservation.

Answer

Data Loss Prevention (DLP) policies

Answer

Retention policies and tags

Answer

eDiscovery (Standard)

Question 8

An organization uses Microsoft 365 Copilot for Microsoft 365. The security team wants to ensure that Copilot responses are based only on data that users already have permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. Microsoft 365 Copilot respects the permissions of the user, meaning it only surfaces data that the user already has access to. This enforces the principle of least privilege, which states that users should only have the minimum necessary access to perform their tasks. By ensuring Copilot responses are based only on data the user can access, it prevents unauthorized data exposure.

Answer

Defense in depth

Answer

Privileged Identity Management

Answer

Zero Trust

Question 9

Which THREE of the following are included in Microsoft 365 E5 compliance features?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) (A) is an E5-only compliance feature that provides longer audit log retention (up to 10 years), high-value events, and intelligent insights, which are not available in lower SKUs. Microsoft Purview eDiscovery (Premium) (B) is likewise E5-only, adding custodian management, review sets, and predictive coding beyond the basic eDiscovery capabilities in E3. Microsoft Purview Communication Compliance (E) is also an E5-only feature that uses machine learning to detect policy violations in Teams, Exchange, and other channels. By contrast, Microsoft Purview Data Loss Prevention (C) and Microsoft Purview Records Management (D) are available in Microsoft 365 E3 as well, so they are not exclusive to E5 and are therefore not correct answers here.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Records Management

Question 10

A multinational company uses Microsoft 365 E5 and needs to meet data residency requirements in the EU and Asia. They plan to use Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from leaving approved geographic boundaries. Which action should they take to enforce this policy?

Accepted Answer

Create a DLP policy that detects sensitive data and blocks sharing outside approved regions.. Microsoft Purview DLP policies can detect sensitive information types and apply restrictions based on location or region. To prevent sensitive data from leaving approved geographic boundaries, you create a DLP policy that blocks sharing outside those regions. This directly enforces data residency requirements at the data level.

Answer

Apply sensitivity labels to all data and configure auto-labeling.

Answer

Enable Microsoft Purview Customer Lockbox to restrict data access.

Answer

Configure Conditional Access policies to block access from unauthorized regions.

Question 11

Which TWO actions should you take to protect against ransomware attacks in Microsoft 365?

Accepted Answer

Enable anti-malware policies in Microsoft Defender for Office 365.. Option A is correct because anti-malware policies in Microsoft Defender for Office 365 scan inbound and outbound email attachments and URLs for malicious payloads, including known ransomware variants, and can block or quarantine them before delivery, directly reducing the most common ransomware entry vector. Option E is correct because restricting access and permissions in SharePoint and OneDrive limits the blast radius of a ransomware infection by preventing compromised accounts from encrypting or overwriting files across broad site collections, and it enforces least-privilege so malicious encryption cannot propagate to unrelated data. Option B is not a direct protective control against ransomware; attack simulation training is an awareness tool that measures and improves user behavior but does not itself block or contain an attack. Option C is incorrect here because sensitivity labels with auto-labeling classify and protect information for compliance and confidentiality, not for detecting or stopping ransomware execution. Option D is also incorrect because DLP policies are designed to prevent unauthorized exfiltration or sharing of sensitive data, not to block ransomware encryption or malicious code execution.

Answer

Deploy attack simulation training to educate users.

Answer

Apply sensitivity labels with auto-labeling.

Answer

Configure Data Loss Prevention (DLP) policies.

Question 12

Your organization has a Microsoft 365 E5 subscription and wants to use Microsoft Purview to identify and protect sensitive data. Which feature should you use to automatically discover sensitive data across Exchange Online, SharePoint Online, and OneDrive?

Accepted Answer

Content explorer. Content explorer in Microsoft Purview (compliance portal) lets administrators browse and search for sensitive information types across Exchange Online, SharePoint Online, and OneDrive for Business, showing exactly where classified data resides. It is the discovery/investigation tool purpose-built for locating sensitive data across Microsoft 365 workloads. DLP policies, sensitivity labels, and Activity explorer serve different roles (enforcement, classification, and activity monitoring).

Answer

Data Loss Prevention (DLP) policies

Answer

Sensitivity labels

Answer

Activity explorer

Question 13

Refer to the exhibit. The exhibit shows an auto-labeling policy configuration. What will happen when a document labeled 'EU PII' is shared externally via SharePoint?

Accepted Answer

The document will be encrypted before sharing.. When a document labeled 'EU PII' is shared externally via SharePoint, the auto-labeling policy will apply encryption based on the label's protection settings. Since the label likely includes encryption, the document will be encrypted before sharing. This ensures that sensitive data remains protected even when shared externally, assuming the recipient has appropriate permissions.

Answer

The document will be automatically labeled as confidential.

Answer

The document will be shared without encryption.

Answer

The document will be blocked from sharing.

Question 14

Refer to the exhibit. The exhibit shows an anti-phishing policy in Microsoft Defender for Office 365. Which users receive the highest level of protection?

Accepted Answer

The CEO and CFO specifically.. In Microsoft Defender for Office 365 anti-phishing policies, the highest level of protection is applied through the 'Protected users' or 'Priority account protection' setting, which is typically configured for high-value targets such as executives. In the exhibit, the policy explicitly lists the CEO and CFO as protected users, so they receive the most stringent anti-phishing protections, including impersonation protection and advanced spoof intelligence.

Answer

All users in the organization.

Answer

Only users in the quarantine list.

Answer

Users with phishing threshold level 2.

Question 15

Which THREE statements about the Microsoft Service Trust Portal are true?

Accepted Answer

It includes the Compliance Manager tool.. Option A is correct because the Microsoft Service Trust Portal hosts the Compliance Manager tool, which lets organizations assess and manage their compliance posture against standards such as ISO 27001, GDPR, and NIST. Option B is correct because access to the Service Trust Portal requires signing in with an Microsoft Entra ID (Azure AD) account, which gates the compliance content behind authentication. Option C is correct because the portal's core purpose is to provide independent third-party audit reports (for example SOC 1/2/3, ISO, and FedRAMP reports) along with compliance documentation such as whitepapers and assessment templates. Option D is not correct because real-time data location tracking is not a Service Trust Portal feature; data residency and location information is surfaced through resources like the Microsoft Trust Center and Azure data residency documentation, not live tracking in the portal. Option E is not correct because the Service Trust Portal is a compliance and trust documentation resource, not a distribution channel for Microsoft software patches, which are delivered through Windows Update, Microsoft Update Catalog, and similar servicing channels.

Answer

It allows real-time tracking of data location.

Answer

It provides downloads of Microsoft software patches.