MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 2 — 15 Questions

Question 1

An administrator is reviewing a request from users who need to detect risky users and suspicious sign-ins. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection is the correct choice because it is specifically designed to detect risky users and suspicious sign-ins by analyzing signals such as leaked credentials, anonymous IP addresses, and atypical travel patterns. It uses risk-based conditional access policies to automatically block or require multi-factor authentication for high-risk sign-ins, directly addressing the administrator's requirement.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 2

During a Microsoft 365 planning workshop, let users reset forgotten passwords without calling the help desk. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Self-service password reset (SSPR). Self-service password reset (SSPR) is the correct Microsoft 365 capability because it allows users to reset their own forgotten passwords without requiring help desk intervention. SSPR is part of Microsoft Entra ID (formerly Azure Active Directory) and enforces security through multi-factor authentication verification before allowing a password change. This directly addresses the requirement to reduce help desk calls while maintaining identity security.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 3

A business stakeholder asks how Microsoft 365 can help them manage laptops and mobile devices with compliance policies and app protection. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct answer because it is a cloud-based endpoint management solution that provides mobile device management (MDM) and mobile application management (MAM) capabilities. It allows administrators to enforce compliance policies (e.g., require PIN, encrypt device) and app protection policies (e.g., restrict copy/paste, prevent data leakage) on laptops and mobile devices, directly addressing the stakeholder's request.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 4

While preparing a Microsoft 365 adoption plan, a consultant is asked to protect corporate data inside mobile apps without enrolling the whole personal device. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

App protection policies / Mobile Application Management (MAM). App protection policies (APP), also known as Mobile Application Management (MAM), allow administrators to protect corporate data within mobile apps—such as enforcing encryption, preventing copy/paste, or requiring PIN—without enrolling the entire personal device into management. This is the correct capability because it separates data-level controls from device-level management, meeting the requirement to protect corporate data without full device enrollment.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 5

A service owner is comparing Microsoft 365 capabilities and needs to block emails containing credit card numbers from being sent externally. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft 365 is the correct capability because it is specifically designed to detect and protect sensitive information, such as credit card numbers, by scanning email content and attachments. DLP policies can be configured to block external transmission of emails containing sensitive data, using built-in sensitive information types like the Credit Card Number rule that matches patterns based on Luhn checksum validation. This directly addresses the service owner's requirement to prevent credit card numbers from being sent externally.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 6

During requirements gathering, an IT manager says the organization must classify files as Confidential and apply encryption to the most sensitive content. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Sensitivity labels. Sensitivity labels in Microsoft Purview Information Protection allow organizations to classify files as Confidential and apply encryption automatically or manually. This capability meets the requirement to protect the most sensitive content by enforcing access controls and encryption policies based on the label.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 7

A healthcare organization must encrypt outbound email automatically when a message contains passport numbers. Which two Microsoft Purview capabilities are commonly combined? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct answer because it provides the policy engine that detects sensitive information, such as passport numbers, in outbound email. When a DLP rule matches, it can trigger automatic encryption of the message using Microsoft Purview Message Encryption, ensuring the email is protected before leaving the organization.

Answer

Microsoft Planner

Answer

Microsoft Viva Engage

Question 8

A compliance-aware administrator is selecting the right Microsoft 365 capability to delete content automatically after a defined retention period. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Retention policy or retention label. Retention policies and retention labels are the Microsoft 365 compliance capabilities designed to automatically delete content after a defined retention period. They enforce data lifecycle management by applying rules to content in Exchange, SharePoint, OneDrive, and Teams, ensuring compliance with regulatory requirements. Microsoft Forms, Planner, and Stream are productivity or collaboration tools, not compliance capabilities for automated deletion.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 9

A department head asks which Microsoft 365 option should be used to review file access, sharing changes, and administrator actions during an investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (formerly Office 365 Audit Log) is the correct choice because it provides a unified audit log that captures file access, sharing changes, and administrator actions across Microsoft 365 services. This capability is essential for security investigations, as it allows administrators to search and export detailed records of user and admin activities, meeting the department head's requirement for reviewing historical actions.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 10

An administrator is reviewing a request from users who need to detect risky users and suspicious sign-ins. Microsoft security, identity, or compliance capability should it use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct choice because it provides advanced threat protection specifically designed to safeguard users against phishing, unsafe links, and malicious attachments. It includes features like Safe Links, Safe Attachments, and anti-phishing policies that scan and detonate URLs and attachments in real-time, leveraging threat intelligence from the Microsoft Intelligent Security Graph.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 11

During a Microsoft 365 planning workshop, provide baseline anti-spam and anti-malware filtering for Exchange Online. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Exchange Online Protection. Exchange Online Protection (EOP) is the cloud-based filtering service built into Exchange Online that provides baseline anti-spam and anti-malware protection. It scans all inbound and outbound messages using heuristics, signature-based detection, and connection filtering to block malicious content before it reaches user mailboxes.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 12

A tenant administrator is advising a department that wants to investigate incidents across identities, email, endpoints, and cloud apps in one experience. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security operations platform that correlates alerts and incidents across identities (Azure AD), email (Exchange Online), endpoints (Microsoft Defender for Endpoint), and cloud apps (Microsoft Defender for Cloud Apps). This single-pane-of-glass experience allows a tenant administrator to investigate incidents holistically without switching between separate consoles.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 13

A business stakeholder asks how Microsoft 365 can help them protect Windows endpoints with endpoint detection and response capabilities. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint is the correct choice because it provides endpoint detection and response (EDR) capabilities specifically designed to protect Windows endpoints. It uses behavioral sensors, cloud analytics, and threat intelligence to detect, investigate, and respond to advanced threats in real time, aligning directly with the stakeholder's request.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 14

While preparing a Microsoft 365 adoption plan, a consultant is asked to identify risky user behaviour such as unusual downloads or policy violations. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is the correct capability because it is specifically designed to identify, detect, and act on risky user behaviors such as unusual downloads, data leaks, and policy violations. It uses machine learning models and predefined indicators to correlate user activities (e.g., mass file downloads, unauthorized sharing) with risk signals, enabling organizations to investigate and mitigate insider threats. This aligns directly with the consultant's need to monitor and address risky behavior in a Microsoft 365 adoption plan.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 15

A service owner is comparing Microsoft 365 capabilities and needs to prevent communication and collaboration between two business groups. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Information Barriers. Information Barriers (IB) in Microsoft 365 are specifically designed to prevent communication and collaboration between defined user groups, such as two business groups that must not interact. IB policies use segment-based rules to block chat, email, and file sharing across groups, enforced at the Exchange Online, Teams, and SharePoint levels. This directly meets the service owner's requirement to isolate groups, unlike the other options which are general-purpose tools without such isolation capabilities.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream