MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 3 — 15 Questions

Question 1

A company is subject to GDPR and needs to respond to a data subject request to delete a user's personal data from Microsoft 365. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management provides capabilities to manage data subject requests (DSRs) under GDPR, including the ability to delete personal data. Option B is correct. Options A, C, and D are not designed for DSR management.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 2

Refer to the exhibit. You are reviewing a Conditional Access policy configuration. What is the effect of this policy on a user who signs in from a known device but with medium sign-in risk?

Accepted Answer

The user is prompted for multifactor authentication.. In Conditional Access, a policy can require multifactor authentication (MFA) when sign-in risk is medium or high. Since the user signs in from a known device but with medium sign-in risk, the policy likely enforces MFA as a condition. The known device does not automatically bypass all controls; risk-based policies often still require additional verification.

Answer

The user is required to reset their password.

Answer

The user is blocked from signing in.

Answer

The user is allowed without any additional prompts because the device is known.

Question 3

Refer to the exhibit. An administrator configured a sensitivity label with auto-labeling for credit card numbers. What happens when a user creates a document containing a credit card number and saves it to SharePoint Online?

Accepted Answer

The label is automatically applied, and the document is encrypted.. When a sensitivity label with auto-labeling for credit card numbers is configured and a user creates a document containing a credit card number and saves it to SharePoint Online, the label is automatically applied. If the label is configured with encryption, the document is encrypted according to the label's protection settings. This ensures that sensitive data is protected without relying on user action.

Answer

The label is applied only when the user manually selects it.

Answer

The document is blocked from being saved.

Answer

The label is applied, but encryption is not enforced because the user can override.

Question 4

Your organization is adopting Microsoft 365 Copilot and wants to prevent the AI from using internal customer data in its training models. Which data protection option should be enabled?

Accepted Answer

Microsoft Commercial Data Protection. Microsoft Commercial Data Protection (formerly known as Enterprise Data Protection / the protection previously branded for Copilot) ensures that prompts and responses in Microsoft 365 Copilot are not used to train the underlying foundation models and are not accessible to other tenants. It is the specific control Microsoft provides to guarantee that commercial customer data stays within the tenant boundary and out of model training. Enabling it satisfies the requirement to prevent internal customer data from being used in AI training.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Audit

Answer

Conditional Access policies

Question 5

Which THREE of the following are included in Microsoft 365 E5 compliance features? (Choose three.)

Accepted Answer

Privileged Access Management. Microsoft 365 E5 compliance features include advanced capabilities: Privileged Access Management (A) controls just-in-time access to sensitive data; Customer Key (C) provides tenant-level encryption key management; Communication Compliance (E) helps monitor communications to minimize compliance risks. Options B (Microsoft Intune) is a device management tool, not specifically a compliance feature within E5 compliance. Option D (Basic audit log search) is included in E3, not an E5 advanced feature.

Answer

Microsoft Intune

Answer

Basic audit log search

Question 6

A company is deploying Microsoft 365 Copilot and wants to ensure that only users with the appropriate sensitivity labels can access Copilot-generated content. What should the administrator configure to enforce this requirement?

Accepted Answer

Enable auto-labeling for sensitivity labels in Microsoft Purview Information Protection. Auto-labeling for sensitivity labels in Microsoft Purview Information Protection is the feature that automatically applies sensitivity labels to content based on detection of sensitive information types or trainable classifiers. Once labels are applied, they enforce encryption and access restrictions, so Copilot-generated content inherits the same protection and only authorized users can access it. This directly satisfies the requirement to enforce label-based access to Copilot output.

Answer

Create a retention label policy in Microsoft Purview

Answer

Create a Conditional Access policy in Microsoft Entra ID

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview

Question 7

An administrator configures the SharePoint Online sharing policy as shown in the exhibit. What is the result of this configuration?

Accepted Answer

External users and guests from fabrikam.com can access content after accepting an invitation.. The policy allows external users and guests from fabrikam.com to access content after they accept the sharing invitation. The allowed domain list permits fabrikam.com, and the requirement for invitation acceptance is implied by the non-'Anyone' sharing setting. Option A is wrong because external users must accept an invitation; they are not allowed to access content without accepting. Option B is wrong because external users and guests from fabrikam.com can access, but they must accept an invitation; they are not added manually in this context. Option D is wrong because external sharing is not blocked for all domains except fabrikam.com; rather, sharing is allowed only from fabrikam.com.

Answer

External users from any domain can access content without accepting an invitation.

Answer

Only guests from any domain can access, but external users must be added manually.

Answer

External sharing is blocked for all domains except fabrikam.com.

Question 8

A company needs to meet GDPR compliance requirements for data subject requests. Which Microsoft Purview tool should they use to manage these requests?

Accepted Answer

Data Lifecycle Management. Microsoft Purview Data Lifecycle Management includes functionality to manage data subject requests (DSRs) under GDPR, such as finding and acting on personal data. Option A is wrong because eDiscovery (Premium) is used for legal discovery, not for managing DSRs. Option B is wrong because Compliance Manager assesses compliance posture and provides recommendations but does not directly execute DSRs. Option C is wrong because Audit (Premium) logs activities but does not provide DSR management capabilities.

Answer

eDiscovery (Premium)

Answer

Compliance Manager

Answer

Audit (Premium)

Question 9

Which THREE actions can be performed using Microsoft Purview Data Loss Prevention (DLP) policies?

Accepted Answer

Display a policy tip to the user when sensitive data is detected. Option A is correct because Microsoft Purview DLP policies can show a policy tip (a notification) to users in apps like Word, Excel, and Outlook when content matching sensitive information types is detected, warning them before they share or send data. Option B is correct because DLP can restrict access to sensitive documents, for example by blocking users from opening, copying, printing, or saving content in apps, or by using restrictions on SharePoint/OneDrive files. Option E is correct because DLP policies can block sharing of sensitive information via email, such as preventing an email from being sent or encrypting/blocking it when it contains sensitive data. Option C is not correct because automatically applying sensitivity labels is the function of auto-labeling policies (sensitivity labels), not DLP policies. Option D is not correct because auditing all access to SharePoint sites is handled by Microsoft Purview Audit (or audit log/activity alerts), not by DLP policies.

Answer

Apply sensitivity labels automatically

Answer

Audit all access to SharePoint sites

Question 10

Which TWO are true about Microsoft's data residency commitments in the Microsoft 365 Trust Center?

Accepted Answer

Customers can choose where their data is stored at rest. Options A and E are correct. Microsoft offers data residency options in the Microsoft 365 Trust Center, allowing customers to choose the geographic region where their data is stored at rest (A). This confirms that Microsoft provides data residency options for customer data (E). Option B is incorrect because while data is primarily stored in the selected region, it may be replicated or processed in other regions for disaster recovery or performance purposes. Option C is incorrect because customer data is encrypted both at rest and in transit, not only in transit. Option D is incorrect because customer data can be stored in a broader geographic region (e.g., North America) rather than strictly the customer's country.

Answer

Data never leaves the selected geographic region

Answer

All customer data is encrypted in transit only

Answer

Customer data is always stored in the customer's country only

Question 11

Which TWO are valid data classification labels in Microsoft Purview?

Accepted Answer

Confidential. The correct answers are B (Confidential) and D (Highly Confidential). Microsoft Purview includes built-in data classification labels such as 'Confidential' and 'Highly Confidential'. Labels like 'Secret', 'Classified', and 'Public' are not recognized as standard classification labels in Purview.

Answer

Secret

Answer

Classified

Answer

Public

Question 12

A user reports receiving a phishing email that bypassed Exchange Online Protection (EOP). What should you configure to add a second layer of defense against sophisticated phishing attacks?

Accepted Answer

Purchase and assign Microsoft Defender for Office 365 Plan 2 licenses. Microsoft Defender for Office 365 Plan 2 provides advanced anti-phishing capabilities beyond Exchange Online Protection (EOP), including impersonation protection, machine learning models, and automated investigation and response. Option B (Block all external images) is not a standard anti-phishing measure; it is used for privacy or to prevent tracking but does not analyze the email content for phishing. Option C (Enable Safe Attachments in Exchange Online Protection) is incorrect because Safe Attachments is a feature of Microsoft Defender for Office 365, not available in EOP. Option D (Configure DKIM signing) is an email authentication method that helps verify sender legitimacy but does not add a second layer of defense against sophisticated phishing; it is a foundational security control. Therefore, purchasing and assigning Microsoft Defender for Office 365 Plan 2 licenses is the appropriate action to add a second layer of defense.

Answer

Block all external images in email

Answer

Enable Safe Attachments in Exchange Online Protection

Answer

Configure DKIM signing for your domain

Question 13

Your organization is required to retain all customer emails for 7 years due to industry regulations. The legal team also needs to be able to search and hold relevant emails during active litigation. Which two Microsoft Purview features should you implement? (Choose two.)

Accepted Answer

Retention policy. Retention policy (B) enforces the 7-year retention. Litigation hold (C) preserves emails for legal cases. Option D (eDiscovery) is for search and export, not hold. Option A (DLP) prevents data leaks. Option E (Sensitivity labels) classify data.

Answer

Data Loss Prevention policy

Answer

eDiscovery (Standard)

Answer

Sensitivity labels

Question 14

Your company uses Microsoft 365 and wants to ensure that when employees share sensitive documents externally, access is automatically revoked after 30 days. Which solution should you use?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID (formerly Azure AD) Conditional Access policies can enforce time-based access restrictions for external sharing, such as requiring access to be revoked after 30 days. Option A (Microsoft Intune) is used for mobile device and application management, not for setting access durations. Option B (Microsoft Defender for Cloud Apps) offers cloud app security and session controls but does not directly provide automatic revocation after a fixed period. Option D (Microsoft Information Protection) focuses on classifying and protecting sensitive data with labels, not access expiration.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Information Protection (MIP)

Question 15

Your organization is using Microsoft 365 Copilot. You want to ensure that Copilot uses only data that users have permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. Microsoft 365 Copilot respects the permissions already configured in Microsoft 365, meaning it only surfaces data that the signed-in user has been granted access to. This enforces the principle of least privilege by ensuring users (and by extension Copilot acting on their behalf) can only reach the minimum data necessary for their role. Copilot does not bypass existing access controls.

Answer

Zero Trust

Answer

Defense in depth

Answer

Need-to-know