MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 2 — 15 Questions

Question 1

A security analyst receives an alert about a user who downloaded a large number of files from a SharePoint document library in a short period. The analyst needs to investigate the user's activities across Exchange, SharePoint, and Teams to determine if data exfiltration is occurring. Which Microsoft Purview solution should the analyst use to review detailed activity logs?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) provides detailed, searchable activity logs for user actions across Exchange, SharePoint, and Teams, including file downloads, access events, and admin operations. The analyst can use the Audit log search to filter by user, date range, and activity type (e.g., 'FileDownloaded') to identify potential data exfiltration patterns. Audit (Premium) also offers longer retention (up to 1 year by default, extendable to 10 years) and higher-bandwidth APIs for large-scale investigations.

Answer

Microsoft Purview eDiscovery (Premium)

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention (DLP)

Question 2

A security team needs to ensure that all Microsoft 365 administrative actions—such as creating user accounts or resetting passwords—are logged and searchable for at least 90 days. They also need to create custom alert rules for suspicious admin activity. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) logs and retains all administrative actions (e.g., creating users, resetting passwords) for 90 days by default, meeting the retention requirement. It also supports creating custom alert rules for suspicious admin activity via the Microsoft 365 Defender portal, which queries the audit log. This makes it the correct solution for both logging and alerting on admin actions.

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Defender for Cloud Apps

Question 3

A security administrator needs to review all sign-in attempts and identify suspicious login patterns for the past 30 days. Which Microsoft 365 portal should they use to access this information?

Accepted Answer

Microsoft Entra ID sign-in logs. Microsoft Entra ID sign-in logs provide a detailed record of all sign-in attempts, including successful and failed logins, IP addresses, applications used, and risk detections. This data can be filtered and analyzed to identify suspicious patterns such as multiple failed attempts or sign-ins from unusual locations over the past 30 days, making it the correct choice for a security administrator.

Answer

Microsoft Purview compliance portal

Answer

Microsoft 365 admin center

Answer

Microsoft Defender for Cloud Apps

Question 4

A security team needs to monitor all administrative activities in Microsoft 365, including creating users, resetting passwords, and modifying policies. They require that logs be retained for at least 90 days and want to create custom alerts for suspicious admin actions (e.g., multiple password resets in a short time). Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides extended log retention of up to one year (or more with add-ons), which meets the 90-day requirement, and it supports custom alert policies via the Microsoft 365 Defender portal to detect suspicious admin activities like multiple password resets. Standard Audit only retains logs for 90 days but lacks the advanced alerting and investigation capabilities needed for custom alerts on admin actions.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID reporting

Question 5

A legal firm needs to send a confidential document to a client via email. The firm requires that the client cannot forward or print the email and that the email expires after seven days. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (A) is the correct solution because it allows the legal firm to apply usage restrictions such as preventing forwarding and printing, and to set an expiration period of seven days on the email. This is achieved through Azure Rights Management (Azure RMS) templates that enforce these controls directly on the encrypted message, ensuring the client cannot bypass the restrictions.

Answer

Data Loss Prevention (DLP) policies

Answer

Sensitivity labels

Answer

eDiscovery (Premium)

Question 6

A help desk lead is documenting the correct Microsoft 365 approach to require users to approve sign-ins with a mobile app after entering a password. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Multifactor authentication (MFA). Multifactor authentication (MFA) is the correct capability because it requires users to provide a second form of verification—such as approving a sign-in via the Microsoft Authenticator mobile app—after entering their password. This aligns with the security best practice of 'something you know' (password) plus 'something you have' (mobile device approval), which is a core MFA scenario in Microsoft Entra ID (formerly Azure AD).

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 7

A compliance-aware administrator is selecting the right Microsoft 365 capability to require MFA only for sign-ins from outside trusted locations. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Conditional Access. Conditional Access is the correct Microsoft 365 capability because it allows administrators to create policies that enforce MFA based on specific conditions, such as sign-in location. By configuring a Conditional Access policy with a 'location' condition that includes trusted IP ranges (defined via named locations), you can require MFA only when users sign in from outside those trusted locations. This directly addresses the requirement for location-aware MFA enforcement without affecting sign-ins from trusted networks.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 8

A department head asks which Microsoft 365 option should be used to provide a cloud identity platform for Microsoft 365 and approved SaaS applications. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) is the correct choice because it is the cloud-based identity and access management service that provides authentication, single sign-on (SSO), and conditional access for Microsoft 365 and thousands of pre-integrated SaaS applications. It acts as the identity platform, managing user identities and controlling access to resources, which directly aligns with the department head's requirement for a cloud identity platform.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 9

An administrator is reviewing a request from users who need to detect risky users and suspicious sign-ins. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection is the correct choice because it is specifically designed to detect risky users and suspicious sign-ins by analyzing signals such as leaked credentials, anonymous IP addresses, and atypical travel patterns. It uses risk-based conditional access policies to automatically block or require multi-factor authentication for high-risk sign-ins, directly addressing the administrator's requirement.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 10

During a Microsoft 365 planning workshop, let users reset forgotten passwords without calling the help desk. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Self-service password reset (SSPR). Self-service password reset (SSPR) is the correct Microsoft 365 capability because it allows users to reset their own forgotten passwords without requiring help desk intervention. SSPR is part of Microsoft Entra ID (formerly Azure Active Directory) and enforces security through multi-factor authentication verification before allowing a password change. This directly addresses the requirement to reduce help desk calls while maintaining identity security.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 11

A tenant administrator is advising a department that wants to grant temporary, approved privileged administrator access. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time privileged access, allowing the tenant administrator to grant temporary, approved administrator roles with time-bound activation and approval workflows. PIM is part of Microsoft Entra ID Governance and directly addresses the requirement for temporary privileged access with oversight.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 12

A business stakeholder asks how Microsoft 365 can help them manage laptops and mobile devices with compliance policies and app protection. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct answer because it is a cloud-based endpoint management solution that provides mobile device management (MDM) and mobile application management (MAM) capabilities. It allows administrators to enforce compliance policies (e.g., require PIN, encrypt device) and app protection policies (e.g., restrict copy/paste, prevent data leakage) on laptops and mobile devices, directly addressing the stakeholder's request.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 13

While preparing a Microsoft 365 adoption plan, a consultant is asked to protect corporate data inside mobile apps without enrolling the whole personal device. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

App protection policies / Mobile Application Management (MAM). App protection policies (APP), also known as Mobile Application Management (MAM), allow administrators to protect corporate data within mobile apps—such as enforcing encryption, preventing copy/paste, or requiring PIN—without enrolling the entire personal device into management. This is the correct capability because it separates data-level controls from device-level management, meeting the requirement to protect corporate data without full device enrollment.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 14

A service owner is comparing Microsoft 365 capabilities and needs to block emails containing credit card numbers from being sent externally. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft 365 is the correct capability because it is specifically designed to detect and protect sensitive information, such as credit card numbers, by scanning email content and attachments. DLP policies can be configured to block external transmission of emails containing sensitive data, using built-in sensitive information types like the Credit Card Number rule that matches patterns based on Luhn checksum validation. This directly addresses the service owner's requirement to prevent credit card numbers from being sent externally.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 15

During requirements gathering, an IT manager says the organization must classify files as Confidential and apply encryption to the most sensitive content. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Sensitivity labels. Sensitivity labels in Microsoft Purview Information Protection allow organizations to classify files as Confidential and apply encryption automatically or manually. This capability meets the requirement to protect the most sensitive content by enforcing access controls and encryption policies based on the label.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms