MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 3 — 15 Questions

Question 1

A healthcare organization must encrypt outbound email automatically when a message contains passport numbers. Which two Microsoft Purview capabilities are commonly combined? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct answer because it provides the policy engine that detects sensitive information, such as passport numbers, in outbound email. When a DLP rule matches, it can trigger automatic encryption of the message using Microsoft Purview Message Encryption, ensuring the email is protected before leaving the organization.

Answer

Microsoft Planner

Answer

Microsoft Viva Engage

Question 2

A compliance-aware administrator is selecting the right Microsoft 365 capability to delete content automatically after a defined retention period. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Retention policy or retention label. Retention policies and retention labels are the Microsoft 365 compliance capabilities designed to automatically delete content after a defined retention period. They enforce data lifecycle management by applying rules to content in Exchange, SharePoint, OneDrive, and Teams, ensuring compliance with regulatory requirements. Microsoft Forms, Planner, and Stream are productivity or collaboration tools, not compliance capabilities for automated deletion.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 3

A department head asks which Microsoft 365 option should be used to review file access, sharing changes, and administrator actions during an investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (formerly Office 365 Audit Log) is the correct choice because it provides a unified audit log that captures file access, sharing changes, and administrator actions across Microsoft 365 services. This capability is essential for security investigations, as it allows administrators to search and export detailed records of user and admin activities, meeting the department head's requirement for reviewing historical actions.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 4

An administrator is reviewing a request from users who need to protect users from phishing, unsafe links, and malicious attachments. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct choice because it provides advanced threat protection specifically designed to safeguard users against phishing, unsafe links, and malicious attachments. It includes features like Safe Links, Safe Attachments, and anti-phishing policies that scan and detonate URLs and attachments in real-time, leveraging threat intelligence from the Microsoft Intelligent Security Graph.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 5

During a Microsoft 365 planning workshop, provide baseline anti-spam and anti-malware filtering for Exchange Online. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Exchange Online Protection. Exchange Online Protection (EOP) is the cloud-based filtering service built into Exchange Online that provides baseline anti-spam and anti-malware protection. It scans all inbound and outbound messages using heuristics, signature-based detection, and connection filtering to block malicious content before it reaches user mailboxes.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 6

A tenant administrator is advising a department that wants to investigate incidents across identities, email, endpoints, and cloud apps in one experience. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security operations platform that correlates alerts and incidents across identities (Azure AD), email (Exchange Online), endpoints (Microsoft Defender for Endpoint), and cloud apps (Microsoft Defender for Cloud Apps). This single-pane-of-glass experience allows a tenant administrator to investigate incidents holistically without switching between separate consoles.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 7

A business stakeholder asks how Microsoft 365 can help them protect Windows endpoints with endpoint detection and response capabilities. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint is the correct choice because it provides endpoint detection and response (EDR) capabilities specifically designed to protect Windows endpoints. It uses behavioral sensors, cloud analytics, and threat intelligence to detect, investigate, and respond to advanced threats in real time, aligning directly with the stakeholder's request.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 8

While preparing a Microsoft 365 adoption plan, a consultant is asked to identify risky user behaviour such as unusual downloads or policy violations. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is the correct capability because it is specifically designed to identify, detect, and act on risky user behaviors such as unusual downloads, data leaks, and policy violations. It uses machine learning models and predefined indicators to correlate user activities (e.g., mass file downloads, unauthorized sharing) with risk signals, enabling organizations to investigate and mitigate insider threats. This aligns directly with the consultant's need to monitor and address risky behavior in a Microsoft 365 adoption plan.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 9

A service owner is comparing Microsoft 365 capabilities and needs to prevent communication and collaboration between two business groups. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Information Barriers. Information Barriers (IB) in Microsoft 365 are specifically designed to prevent communication and collaboration between defined user groups, such as two business groups that must not interact. IB policies use segment-based rules to block chat, email, and file sharing across groups, enforced at the Exchange Online, Teams, and SharePoint levels. This directly meets the service owner's requirement to isolate groups, unlike the other options which are general-purpose tools without such isolation capabilities.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 10

During requirements gathering, an IT manager says the organization must review employee messages for harassment or regulatory policy violations. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Communication Compliance. Communication Compliance in Microsoft 365 is the correct capability because it is specifically designed to detect, capture, and act on inappropriate messages—such as harassment or regulatory policy violations—across email, Microsoft Teams, and third-party communications. It uses configurable policies with built-in classifiers for harassment, threats, and regulatory compliance, enabling automated review and remediation. This directly addresses the IT manager's requirement to monitor employee messages for policy violations.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 11

A help desk lead is documenting the correct Microsoft 365 approach to track compliance assessments and improvement actions. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct tool because it provides a centralized dashboard for tracking compliance assessments, managing improvement actions, and monitoring regulatory compliance posture. It integrates with Microsoft 365 services to automate risk assessments and generate detailed reports for standards like ISO 27001, SOC 2, and GDPR.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 12

A compliance-aware administrator is selecting the right Microsoft 365 capability to encrypt email messages sent to internal or external recipients. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (B) is the correct choice because it is the dedicated Microsoft 365 service that provides encryption for email messages sent to both internal and external recipients. It leverages Azure Rights Management (Azure RMS) to protect messages, ensuring only intended recipients can decrypt and read them, which directly meets the compliance requirement for email encryption.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 13

A security team wants Microsoft 365 access to be allowed only when a user's device is marked compliant by management policy. Which two capabilities are normally combined? (Choose two.)

Accepted Answer

Microsoft Intune compliance policies. Microsoft Intune compliance policies define the rules that a device must meet (e.g., encryption, OS version, threat level) to be considered compliant. Conditional Access enforces access decisions based on signals like device compliance status, blocking or granting access to Microsoft 365 services. Together, they ensure only compliant devices can access corporate resources.

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 14

An administrator is reviewing a request from users who need to analyze attachments in a protected environment before delivery. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Safe Attachments. Safe Attachments is the correct Microsoft 365 Defender capability that detonates email attachments in a virtual, protected environment before delivery. It uses behavioral analysis and machine learning to detect malicious content, ensuring that only safe attachments reach the user's inbox. This directly addresses the requirement to analyze attachments in a protected environment.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 15

During a Microsoft 365 planning workshop, allow access to Exchange Online only from compliant devices. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Intune compliance policies with Conditional Access. Microsoft Intune compliance policies define the security requirements (e.g., device encryption, jailbreak detection, minimum OS version) that a device must meet. When combined with Conditional Access in Azure AD, you can create a policy that blocks access to Exchange Online unless the device is marked as compliant by Intune. This ensures only compliant devices can connect, directly meeting the requirement.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner