MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 4 — 15 Questions

Question 1

During a Microsoft 365 planning workshop, show security recommendations and a score for Microsoft 365 posture. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Secure Score. Microsoft Secure Score is the correct tool because it provides a numerical score and actionable security recommendations based on your tenant's security posture. It analyzes configurations across Microsoft 365 services (e.g., Exchange Online, Azure AD, Intune) and suggests improvements to reduce risk, directly matching the workshop requirement for showing recommendations and a score.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 2

A tenant administrator is advising a department that wants to automatically apply a label when sensitive customer identifiers are detected. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Auto-labeling for sensitivity labels. Auto-labeling can apply sensitivity labels based on configured conditions.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 3

While preparing a Microsoft 365 adoption plan, a consultant is asked to let users report suspicious phishing messages from Outlook for investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Office 365 user submissions. Microsoft Defender for Office 365 user submissions (Option A) is the correct capability because it allows users to report suspicious phishing messages directly from Outlook, which are then routed to the Microsoft 365 Defender portal for investigation and analysis. This feature integrates with the built-in Report Message or Report Phishing add-ins, enabling security teams to review and act on user-reported threats within the unified security operations framework.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 4

A service owner is comparing Microsoft 365 capabilities and needs to make sign-in decisions based on risk, location, and device compliance. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Conditional Access policy. Conditional Access policy is the correct answer because it is the Microsoft Entra ID (formerly Azure AD) feature that enforces sign-in decisions based on risk, location, and device compliance. It allows administrators to create policies that require multi-factor authentication, block access from untrusted locations, or require compliant devices before granting access to Microsoft 365 resources.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 5

During requirements gathering, an IT manager says the organization must make document protection persist after a file is downloaded or emailed. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels can apply persistent encryption and access restrictions.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 6

A legal team needs to ensure that all documents related to an ongoing case are retained for exactly 7 years and then automatically deleted. During the retention period, no user should be able to permanently delete these documents. Which two Microsoft Purview features should be used together to meet this requirement? (Choose two.)

Accepted Answer

Retention policy. A retention policy is correct because it can be applied at the site or folder level to enforce a mandatory 7-year retention period for all documents in a location, such as a SharePoint site for the legal case. It prevents users from permanently deleting documents during the retention period by blocking deletion actions and preserving the content in a preservation hold library. A retention label is not required for this scenario because the retention policy already meets both the retention and automatic deletion requirements. Retention labels are used when different retention settings need to be applied to individual items, which is not the case here.

Answer

Retention label

Answer

Litigation hold

Answer

Data loss prevention (DLP) policy

Question 7

A company wants to ensure that sensitive documents stored in SharePoint Online are automatically classified and protected if they contain credit card numbers or social security numbers. Which Microsoft Purview feature should they implement?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to automatically detect, classify, and protect sensitive information such as credit card numbers and social security numbers. When a DLP policy is configured with sensitive information types (e.g., Credit Card Number, U.S. Social Security Number), it can scan documents in SharePoint Online and automatically apply protective actions like blocking access or triggering notifications. This makes DLP the correct feature for the described requirement.

Answer

Data Lifecycle Management (DLM)

Answer

Information Protection (Sensitivity labels)

Answer

Insider Risk Management

Question 8

A compliance officer needs to ensure that all user activities related to sensitive data in Microsoft 365 are recorded and available for forensic investigation. They require detailed logs of who accessed specific files in SharePoint Online, including attempts to access files that were blocked by DLP policies. Which solution should they enable?

Accepted Answer

Microsoft 365 Audit Log. Microsoft 365 Audit Log (Unified Audit Log) is the correct solution because it captures detailed records of user activities, including file access in SharePoint Online and blocked DLP policy actions. These logs are retained for forensic investigation and can be searched via the Microsoft 365 Purview compliance portal or accessed programmatically.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Activity Explorer

Answer

Microsoft 365 Defender

Question 9

An organization needs to automatically delete Microsoft Teams chat messages after 90 days to comply with a data minimization policy. Which Microsoft Purview feature should they use?

Accepted Answer

Retention policies. Retention policies in Microsoft Purview are designed to either retain data for a specified period, delete it after that period, or both. For Microsoft Teams chat messages, a retention policy can be configured to automatically delete messages after 90 days, directly supporting a data minimization policy. This is the correct feature because it provides time-based deletion for compliance requirements.

Answer

Data Loss Prevention (DLP)

Answer

Communication Compliance

Answer

Information Barriers

Question 10

A compliance officer needs to automatically label and encrypt documents that contain personally identifiable information (PII) when they are saved in SharePoint. The labeling should happen without manual user intervention. Which Microsoft Purview feature should they configure?

Accepted Answer

Sensitivity labels (auto-labeling policy). Sensitivity labels with auto-labeling policies in Microsoft Purview can automatically detect and classify documents containing PII when they are saved in SharePoint, and apply encryption based on the label configuration. This meets the requirement of automatic, user-intervention-free labeling and encryption by scanning content for sensitive data types (e.g., Social Security numbers) and applying the label at rest.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention labels

Answer

Communication Compliance

Question 11

A global financial services firm needs to protect highly confidential documents containing trade secrets. The protection must restrict access to a specific group of employees, prevent editing and printing, and remain enforced even if the document is downloaded and saved to an external device. Which Microsoft Purview solution should be used?

Accepted Answer

Sensitivity labels (Azure Information Protection). Sensitivity labels from Azure Information Protection (AIP) allow you to classify and protect documents with persistent protection that travels with the file, even when it is downloaded to an external device. By configuring a sensitivity label with encryption, you can restrict access to a specific group of employees, disable editing and printing, and enforce these restrictions regardless of where the file is stored. This meets all the requirements of the scenario, including persistent protection after download.

Answer

Data Loss Prevention (DLP) policy

Answer

Information Barriers

Answer

Advanced Audit

Question 12

A compliance administrator needs to automatically protect sensitive data by applying a 'Confidential' label that encrypts documents and restricts access to a specific user group. The label must be applied when a document containing a credit card number is saved in SharePoint. Which Microsoft Purview feature should be configured?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling are the correct choice because they allow you to automatically apply a 'Confidential' label that encrypts documents and restricts access based on sensitive content (e.g., credit card numbers) when documents are saved in SharePoint. This feature uses conditions like sensitive information types to trigger label application, ensuring data protection at rest and in use.

Answer

Retention labels

Answer

Data Loss Prevention (DLP) policies

Answer

Data classification service

Question 13

A legal firm needs to automatically encrypt and apply access restrictions to all documents that contain case numbers considered highly confidential. The protection must remain enforced even if the document is emailed to external parties or saved to a personal device. Which Microsoft Purview solution should be configured?

Accepted Answer

Sensitivity Labels with encryption. Sensitivity Labels with encryption are the correct solution because they allow the legal firm to classify documents containing confidential case numbers and enforce persistent protection (encryption and access restrictions) that travels with the document, even when emailed externally or saved to a personal device. This is achieved by applying Azure Rights Management (Azure RMS) encryption directly to the file, ensuring the protection is embedded in the document itself, not just at the network or service boundary.

Answer

Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Answer

Customer Lockbox

Question 14

A global company has a strict policy that any Microsoft 365 administrator who needs to access a user's mailbox for troubleshooting must first obtain explicit approval from the user. The company wants to implement a process that requires approval for such access and logs the activity. Which Microsoft Purview feature should they use?

Accepted Answer

Privileged Access Management (PAM). Privileged Access Management (PAM) in Microsoft Purview is specifically designed to provide just-in-time access to sensitive administrative roles and tasks, such as accessing a user's mailbox for troubleshooting. It enforces an approval workflow before the privileged operation is executed and logs all access attempts, meeting the company's requirement for explicit user approval and activity logging.

Answer

Customer Lockbox

Answer

Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 15

A legal firm must ensure that all documents containing a specific project code are automatically retained for 7 years after the project ends. After the 7-year period, the documents should be permanently deleted. The firm already uses sensitivity labels to classify documents. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Records Management. Microsoft Purview Records Management is the correct solution because it provides the ability to mark documents as records (or regulatory records) and apply retention labels that enforce a specific retention period—in this case, 7 years after the project ends—followed by automatic deletion. Records Management is designed for legal and compliance scenarios and includes disposition review and event-based retention, which align with the legal firm's requirement. While Data Lifecycle Management also supports event-based retention, it does not offer record declaration and disposition review, making Records Management the better choice for this compliance-driven requirement.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview Data Loss Prevention