MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 4 — 15 Questions

Question 1

A tenant administrator is advising a department that wants to let users sign in once and access connected Microsoft 365 and SaaS apps. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Single sign-on (SSO). Single sign-on (SSO) enables users to authenticate once and gain access to multiple applications, including Microsoft 365 and third-party SaaS apps, without re-entering credentials. This is achieved through federation protocols such as SAML 2.0 or OpenID Connect, which allow the identity provider (Azure AD) to issue security tokens to relying party applications. SSO is the correct Microsoft security and identity capability for this requirement.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 2

A business stakeholder asks how Microsoft 365 can help them periodically review group memberships and application access. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Access reviews. Access reviews in Microsoft Entra ID (formerly Azure AD) allow administrators to periodically review and certify group memberships and application access. This capability directly addresses the stakeholder's requirement by automating recurring attestation workflows, ensuring that only authorized users retain access. It is part of Microsoft's identity governance framework, not a general productivity or media tool.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 3

While preparing a Microsoft 365 adoption plan, a consultant is asked to give external partners controlled access to Teams and SharePoint resources. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra External ID / B2B collaboration. Microsoft Entra External ID (formerly Azure AD B2B collaboration) is the correct capability because it enables organizations to securely share Teams and SharePoint resources with external partners by inviting them as guest users. This feature uses identity federation to allow partners to authenticate with their own credentials, while enforcing conditional access policies and compliance controls. It directly addresses the requirement for controlled, compliant external access without exposing internal directories or requiring additional licenses for partners.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 4

A service owner is comparing Microsoft 365 capabilities and needs to detect exact customer records rather than only generic data patterns. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Exact Data Match sensitive information type. Exact Data Match (EDM) sensitive information types allow a service owner to define custom sensitive information types based on exact database records, such as customer names or account numbers, rather than relying on generic pattern matching like regular expressions. This capability is part of Microsoft Purview compliance and enables precise detection of specific customer data in Microsoft 365 environments.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 5

During requirements gathering, an IT manager says the organization must discover where sensitive information is stored across Microsoft 365. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Data classification / Content explorer. Data classification and Content explorer in Microsoft 365 Purview allow organizations to discover, classify, and monitor sensitive information across Exchange, SharePoint, OneDrive, and Teams. This capability uses trainable classifiers and sensitive information types to identify data like credit card numbers or PII, providing a unified view in Content explorer for compliance administrators. It directly meets the requirement to discover where sensitive information is stored.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 6

A help desk lead is documenting the correct Microsoft 365 approach to allow browser access to SharePoint from unmanaged devices but restrict downloads. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Conditional Access access/session controls. Conditional Access access/session controls allow administrators to enforce granular restrictions on browser access to SharePoint from unmanaged devices, such as blocking download of sensitive content while still permitting view-only access. This is achieved through session policies that integrate with Microsoft Defender for Cloud Apps (formerly Cloud App Security) to apply real-time controls at the protocol level, without requiring device enrollment or compliance.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 7

A compliance-aware administrator is selecting the right Microsoft 365 capability to manage formal records that must be retained and disposed of according to policy. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Records Management. Records Management in Microsoft 365 (part of Microsoft Purview) is specifically designed to manage formal records by applying retention labels that enforce retention and disposition policies. It allows administrators to declare records, lock them against modification or deletion, and trigger disposal actions based on regulatory or organizational requirements. This directly addresses the need to retain and dispose of records according to policy.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 8

A department head asks which Microsoft 365 option should be used to search, review, and export content for a legal investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery is the correct choice because it is the dedicated Microsoft 365 compliance solution for searching, reviewing, and exporting content in legal investigations. It provides advanced search capabilities across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams, and supports legal hold, review sets, and export workflows to meet eDiscovery requirements.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 9

An administrator is reviewing a request from users who need to discover cloud apps being used by employees and assess their risk. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is the correct choice because it is a Cloud Access Security Broker (CASB) that provides visibility into cloud app usage, shadow IT discovery, and risk assessment. It integrates with Microsoft 365 to monitor user activities and apply data loss prevention (DLP) policies across sanctioned and unsanctioned cloud apps.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 10

During a Microsoft 365 planning workshop, show security recommendations and a score for Microsoft 365 posture. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Secure Score. Microsoft Secure Score is the correct tool because it provides a numerical score and actionable security recommendations based on your tenant's security posture. It analyzes configurations across Microsoft 365 services (e.g., Exchange Online, Azure AD, Intune) and suggests improvements to reduce risk, directly matching the workshop requirement for showing recommendations and a score.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 11

A tenant administrator is advising a department that wants to automatically apply a label when sensitive customer identifiers are detected. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Auto-labeling for sensitivity labels. Auto-labeling can apply sensitivity labels based on configured conditions.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 12

A business stakeholder asks how Microsoft 365 can help them allow sign-in using biometrics or FIDO2 security keys. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID passwordless authentication. Microsoft Entra ID passwordless authentication (Option B) is the correct capability because it directly supports sign-in using biometrics (Windows Hello, Microsoft Authenticator) and FIDO2 security keys. This feature eliminates the need for passwords by leveraging public-key cryptography and the WebAuthn standard, aligning with the stakeholder's request for passwordless sign-in methods.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 13

While preparing a Microsoft 365 adoption plan, a consultant is asked to let users report suspicious phishing messages from Outlook for investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Office 365 user submissions. Microsoft Defender for Office 365 user submissions (Option A) is the correct capability because it allows users to report suspicious phishing messages directly from Outlook, which are then routed to the Microsoft 365 Defender portal for investigation and analysis. This feature integrates with the built-in Report Message or Report Phishing add-ins, enabling security teams to review and act on user-reported threats within the unified security operations framework.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 14

A service owner is comparing Microsoft 365 capabilities and needs to make sign-in decisions based on risk, location, and device compliance. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Conditional Access policy. Conditional Access policy is the correct answer because it is the Microsoft Entra ID (formerly Azure AD) feature that enforces sign-in decisions based on risk, location, and device compliance. It allows administrators to create policies that require multi-factor authentication, block access from untrusted locations, or require compliant devices before granting access to Microsoft 365 resources.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 15

During requirements gathering, an IT manager says the organization must make document protection persist after a file is downloaded or emailed. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels can apply persistent encryption and access restrictions.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream