MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 4 — 15 Questions

Question 1

Which TWO Microsoft 365 security solutions are included in Microsoft Defender XDR (Extended Detection and Response)? (Choose two.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is a unified platform that brings together Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. All four are integral components of the XDR suite, providing extended detection and response across endpoints, email, identities, and cloud applications.

Answer

Microsoft Sentinel

Question 2

A company wants to ensure that employees can access corporate email on personal mobile devices without the company being able to wipe the entire device. What should you use?

Accepted Answer

Microsoft Intune App Protection Policies (APP). Microsoft Intune App Protection Policies (APP) are designed specifically to protect corporate data at the application layer without requiring device enrollment or full device management. APP allows the company to enforce policies like PIN requirements, data encryption, and selective wipe of only corporate data within managed apps, leaving personal data on the device untouched. This directly addresses the requirement of accessing corporate email without the ability to wipe the entire personal device.

Answer

Microsoft Intune Mobile Device Management (MDM)

Answer

Conditional Access policies in Microsoft Entra ID

Answer

Microsoft Intune Mobile Application Management (MAM)

Question 3

Which THREE statements about Microsoft Purview Audit (Standard) are true? (Choose three.)

Accepted Answer

Users must be assigned an appropriate license to view audit logs. Option A is correct because viewing and searching audit logs in Microsoft Purview Audit (Standard) requires the user to be assigned an appropriate license, such as an Office 365 E3/E5 or Microsoft 365 E3/E5 license, and to be granted the View-Only Audit Logs or Audit Logs role in Exchange Online. Option B is correct because Audit (Standard) retains audit records for 90 days by default, after which they are no longer searchable unless a longer retention policy is configured. Option E is correct because Exchange Online admin actions are among the workloads and activities audited by default in Audit (Standard), meaning administrators do not need to enable additional mailbox auditing for these admin events. Option C is not correct because not all SharePoint and OneDrive events are audited by default; some activities require specific configuration or are only captured under certain conditions, and the blanket statement is inaccurate. Option D is not correct because 180 days is the default retention period for Audit (Premium), not Audit (Standard), which uses 90 days by default.

Answer

All SharePoint and OneDrive events are audited by default

Answer

Audit records are retained for 180 days by default

Question 4

Your organization is deploying Microsoft 365 Copilot. The compliance team is concerned that Copilot might expose sensitive data in its responses. What should you configure to prevent Copilot from using sensitive content?

Accepted Answer

Sensitivity labels with 'Copilot' condition. To prevent Copilot from using sensitive content, you should configure sensitivity labels and enable the 'Copilot' condition. This restricts Copilot from accessing content labeled with those sensitivity labels. Option A (Retention policies) is incorrect because retention policies are for preserving data, not restricting Copilot access. Option C (Data Loss Prevention policies) is incorrect because DLP policies prevent sharing of sensitive data but do not directly restrict Copilot from using the content. Option D (Unified audit log) is incorrect because audit logging records activities but does not prevent Copilot from accessing sensitive data.

Answer

Retention policies

Answer

Data Loss Prevention policies

Answer

Unified audit log

Question 5

You are reviewing the device compliance configuration shown in the exhibit. Devices that do not meet the compliance policy are targeted by a Conditional Access policy whose grant control is set to block. What is the most likely outcome of this configuration?

Accepted Answer

Access for non-compliant devices will be blocked. When an Intune compliance policy marks a device noncompliant and a Conditional Access policy blocks access for noncompliant devices, users on those devices are blocked from signing in to Microsoft 365 cloud apps. Option B is wrong because automatic remediation requires configuring remediation actions, not a block grant. Option C is wrong because the assignment shown targets all users, not tagged devices. Option D describes report-only mode, which is not what a block grant control does.

Answer

Non-compliant devices will automatically be remediated

Answer

The policy will only apply to devices with specific tags

Answer

Non-compliant devices will be audited and logged

Question 6

Which TWO Microsoft 365 tools can help an organization detect and respond to insider data theft?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (D) is correct because it provides cloud app security posture management, anomaly detection, and behavioral analytics across Microsoft 365 and third-party SaaS apps, enabling detection of suspicious insider activities such as mass downloads, unusual file sharing, or exfiltration to personal cloud storage, and it supports automated governance and response actions. Microsoft Purview Insider Risk Management (E) is correct because it is purpose-built to correlate signals from Microsoft 365, endpoints, and HR data to identify risky insider behavior, surface alerts through built-in templates for data theft, and drive investigation and response workflows with case management and integration into eDiscovery and communication compliance. Microsoft Intune (A) is a device and application management service focused on configuration, compliance, and app deployment, not on detecting or responding to insider data theft. Microsoft Entra ID Identity Protection (B) detects risky sign-ins and compromised identities, which addresses account compromise rather than insider data theft behavior. Microsoft Sentinel (C) is a SIEM/SOAR platform that can ingest and correlate logs and automate responses, but it is not a Microsoft 365 insider-risk-specific tool for detecting and responding to insider data theft in the way the two correct answers are.

Answer

Microsoft Intune

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Sentinel

Question 7

Which THREE Microsoft Purview features are part of the eDiscovery workflow for legal investigations?

Accepted Answer

Content Search. Content Search (B) is correct because it is the core Microsoft Purview eDiscovery tool used to query Exchange mailboxes, SharePoint sites, OneDrive accounts, and Teams content with keyword, date, and property conditions to identify relevant items for a legal investigation. Export (C) is correct because after search results are reviewed, the eDiscovery workflow uses Export to download the identified content (including native files, PSTs, and reports) for attorney review and production. eDiscovery Hold (E) is correct because placing custodial or non-custodial holds preserves potentially relevant content in place, preventing deletion or modification during the investigation. Communication (A) and Analytics (D) are not among the three features in this scenario: Communication refers to the custodian communication workflow in Premium eDiscovery, and Analytics refers to advanced review features such as near-duplicate detection and relevance, neither of which is the marked set here.

Answer

Communication

Answer

Analytics

Question 8

Which TWO Microsoft 365 compliance centers provide tools for managing compliance requirements?

Accepted Answer

Microsoft Purview compliance portal. Microsoft Purview compliance portal is the main compliance center; Microsoft 365 admin center includes compliance management features. Defender XDR is security, Intune is device management, Entra ID is identity.

Answer

Microsoft Entra admin center

Answer

Microsoft Defender XDR portal

Answer

Microsoft Intune admin center

Question 9

You run the above PowerShell cmdlets against Microsoft Entra ID. What is the output?

Accepted Answer

List of Microsoft 365 group names the user is a member of. The cmdlet Get-MgUserMemberOf retrieves the groups, directory roles, and administrative units that the specified user is a direct member of. In the context of Microsoft 365, this includes Microsoft 365 groups (Unified groups) that the user belongs to. Therefore, the output is a list of Microsoft 365 group names (and possibly other directory objects) that the user is a member of. Option A correctly identifies this as the list of Microsoft 365 group names.

Answer

List of roles assigned to the user

Answer

List of devices enrolled by the user

Answer

List of licenses assigned to the user

Question 10

Contoso Ltd. is a multinational corporation with 10,000 employees. They have recently adopted Microsoft 365 E5 and want to implement a comprehensive security and compliance strategy. Their requirements include: 1) All sensitive emails must be encrypted in transit and at rest. 2) Access to SharePoint sites containing financial data must be restricted to employees from the finance department only, and only from compliant devices. 3) They need to detect and remediate insider threats involving data exfiltration via email and cloud storage. 4) They must comply with GDPR and be able to respond to DSARs within 30 days. 5) They want to use Microsoft 365 Copilot but ensure that Copilot only accesses data that users already have permission to see. Which combination of Microsoft 365 solutions should Contoso implement?

Accepted Answer

Use Microsoft Purview Message Encryption, Conditional Access with device compliance, Microsoft Purview Insider Risk Management, eDiscovery (Premium), and Copilot's default permissions.. It directly addresses all requirements: Microsoft Purview Message Encryption encrypts emails in transit and at rest; Conditional Access with device compliance restricts SharePoint access to finance employees on compliant devices; Microsoft Purview Insider Risk Management detects and remediates data exfiltration; eDiscovery (Premium) enables GDPR DSAR responses within 30 days; and Copilot's default permissions ensure least privilege access. Option A is incorrect because although it includes similar components, it uses 'Microsoft Purview eDiscovery (Premium)' which is an outdated or incorrect naming (the service is simply eDiscovery (Premium) or Microsoft Purview eDiscovery Premium), and 'Copilot with default permissions' could imply that default settings might change, whereas D specifies 'default permissions' as a fixed policy. Option B fails because Azure Information Protection for email is not as robust as Message Encryption, Privileged Identity Management does not enforce device compliance, and Sentinel is for security monitoring, not insider threat detection. Option C is wrong because Microsoft Intune device compliance alone does not integrate with Conditional Access for SharePoint, and retention policies are for data lifecycle management, not DSARs which require eDiscovery.

Answer

Enable Microsoft Purview Message Encryption, Conditional Access with device compliance, Microsoft Purview Insider Risk Management, Microsoft Purview eDiscovery (Premium), and Copilot with default permissions.

Answer

Deploy Azure Information Protection for email, Microsoft Entra ID Privileged Identity Management, Microsoft Sentinel, retention policies, and Copilot settings.

Answer

Implement Microsoft Purview Message Encryption, Microsoft Intune device compliance, Microsoft Defender for Cloud Apps, retention policies, and Copilot configuration.

Question 11

A healthcare organization uses Microsoft 365 and needs to prevent sensitive patient data from being emailed externally. They have enabled Microsoft Purview Data Loss Prevention (DLP). What additional step should they take to ensure that end users are educated when they attempt to send such data?

Accepted Answer

Configure a policy tip in the DLP policy.. Configuring a policy tip in DLP policies displays a real-time notification to users when they attempt to send sensitive data externally, thereby educating them about the policy. Option A is incorrect because auditing logs events but does not provide immediate user feedback. Option B is incorrect because sensitivity labels can block external sharing but do not offer educational prompts; they enforce controls rather than teach. Option C is incorrect because Microsoft Defender for Cloud Apps focuses on cloud access security, not inline user education during email composition.

Answer

Enable auditing in Microsoft Purview Compliance Portal.

Answer

Deploy Microsoft Defender for Cloud Apps.

Answer

Apply a sensitivity label that blocks external sharing.

Question 12

Refer to the exhibit. A Microsoft Purview sensitivity label policy is defined as shown. A user applies this label to a document in Microsoft 365. Which action will occur automatically?

Accepted Answer

The document will be encrypted.. The correct action is encryption because Microsoft Purview sensitivity labels can enforce encryption as part of the label's protection settings. When a label configured with encryption is applied to a document, the document is automatically encrypted using Azure Rights Management (Azure RMS), restricting access to authorized users. The exhibit likely shows a label with encryption enabled, so applying it triggers encryption.

Answer

The document will be automatically deleted after 30 days.

Answer

A watermark will be added.

Answer

The document will be blocked from external sharing.

Question 13

A multinational corporation uses Microsoft 365 and must comply with the General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) within the mandated timeframe. Which Microsoft Purview tool should they use to search for personal data across Exchange Online, SharePoint Online, and OneDrive for Business?

Accepted Answer

Content Search. Content Search in Microsoft Purview allows you to search for personal data across Exchange Online, SharePoint Online, and OneDrive for Business. It is the appropriate tool for locating data in response to a DSAR.

Answer

eDiscovery (Standard)

Answer

Audit log search

Answer

Data Lifecycle Management

Question 14

Refer to the exhibit. A Microsoft Entra ID role assignment is shown. An administrator is assigned the Global Reader role with a condition. What is the effect of the condition?

Accepted Answer

The condition has no practical effect because Global Reader already cannot write role assignments.. The condition restricts the Global Reader from writing role assignments, but since the Global Reader role inherently cannot write role assignments, the condition is redundant and has no practical effect. Option A is incorrect because Global Reader cannot create users. Option C is incorrect because the condition does not restrict reading security recommendations. Option D is incorrect because the condition blocks all role assignment writes, but Global Reader already cannot write any role assignments, so the condition does not add any new restriction.

Answer

The administrator can create new users.

Answer

The administrator can only read security recommendations.

Answer

The administrator cannot assign roles to other users.

Question 15

Which THREE of the following are included in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR includes Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Cloud Apps (though option C is labeled as Microsoft Sentinel here, it should be understood as Cloud Apps per the exam context). Microsoft Purview is a compliance solution and not part of Defender XDR. Microsoft Defender for Identity is also included, but since the question asks for three, the correct set is A, C, and D.

Answer

Microsoft Purview

Answer

Microsoft Defender for Identity