MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 5 — 15 Questions

Question 1

A company wants to ensure that all Microsoft 365 admin actions are recorded and searchable for at least 180 days. They also need to create custom alert rules to notify the security team when critical events occur, such as a user being added to the Global Admin role. Which Microsoft Purview solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) is the correct solution because it records all admin actions from Microsoft 365 services into the unified audit log, retains those logs for at least 180 days (Audit Standard) or up to 10 years (Audit Premium), and allows you to create custom alert policies that trigger notifications when specific events like 'Added member to role' (e.g., Global Admin) occur. This directly meets the requirement for recording, searchability, and custom alerting on critical admin events.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Question 2

A legal department requires that when an employee deletes any email message in Exchange Online that is related to active litigation, the message must be automatically retained for an additional 5 years after deletion. The retention must be applied based on keywords found in the email content. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview retention labels with auto-labeling based on keywords. Microsoft Purview retention labels with auto-labeling based on keywords can automatically apply a retention label to emails that match specific keywords in their content. When the label is configured to retain items for 5 years after deletion, it ensures that emails related to active litigation are preserved even after the user deletes them. This meets the legal department's requirement for content-based, automatic retention.

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 3

A healthcare organization needs to automatically apply a sensitivity label to any document stored in a SharePoint document library that contains patient diagnosis codes. The label should prevent the document from being shared externally. The classification must happen after the document is saved, not during creation. Which Microsoft Purview solution should be configured?

Accepted Answer

Auto-labeling with sensitivity labels in Microsoft Purview. Auto-labeling with sensitivity labels in Microsoft Purview is correct because it automatically applies a sensitivity label to documents containing sensitive content (like patient diagnosis codes) after they are saved to SharePoint. This label can enforce protection actions such as preventing external sharing, meeting the requirement for post-save classification.

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Answer

Microsoft Purview retention labels

Answer

Microsoft Purview Information Barriers

Question 4

A healthcare organization must ensure that all outgoing emails containing protected health information (PHI) are automatically encrypted. External recipients must be able to read the encrypted messages without installing any software or signing up for a service. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (C) is the correct solution because it enables automatic encryption of outgoing emails based on rules (e.g., detecting PHI) and allows external recipients to read encrypted messages via a secure web portal or inline rendering in supported email clients, without requiring any software installation or account sign-up. This directly meets the requirement for seamless, no-friction decryption by external parties.

Answer

Data Loss Prevention (DLP)

Answer

Sensitivity labels

Answer

Information protection policies

Question 5

A legal team needs to place a hold on all data belonging to a specific user who is involved in a lawsuit. The hold must preserve Exchange Online email, SharePoint sites, and Teams chat messages. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) is the correct solution because it allows legal teams to place a hold on a specific user's data across Exchange Online, SharePoint, and Teams. This hold preserves all content, including email, documents, and chat messages, ensuring that data cannot be altered or deleted during litigation. eDiscovery (Standard) is designed for legal holds and integrates with Microsoft Purview to manage custodians and preserve data.

Answer

Data Lifecycle Management (retention policies)

Answer

Communication Compliance

Answer

Audit log

Question 6

A compliance officer needs to automatically classify and protect documents stored in SharePoint Online that contain personal data such as passport numbers. The classification should happen without user intervention and must apply encryption and access restrictions. Which Microsoft Purview solution should be configured?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling (Option B) are the correct solution because they can automatically classify documents based on patterns like passport numbers using trainable classifiers or exact data match (EDM), and then apply encryption and access restrictions via the label's protection settings—all without user intervention. This meets the compliance officer's requirement for automatic classification and protection of personal data in SharePoint Online.

Answer

Data Loss Prevention (DLP) policy

Answer

eDiscovery (Standard)

Answer

Communication Compliance

Question 7

A legal team at a company needs to preserve all data belonging to a user who is involved in litigation. The preservation must cover Exchange Online email, SharePoint sites, OneDrive for Business files, and Teams chat messages. They also need to be able to search the preserved content and export it. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Standard) case hold. eDiscovery (Standard) allows you to create a case, place a hold on user mailboxes, SharePoint sites, OneDrive accounts, and Teams chat messages to preserve content relevant to litigation. It also provides built-in search and export capabilities, making it the correct solution for the legal team's requirements.

Answer

Litigation Hold

Answer

Auto-apply retention labels

Answer

Data Loss Prevention (DLP) policy

Question 8

A security team wants to ensure that only devices that are compliant with company security policies (e.g., antivirus enabled, disk encrypted) can access Exchange Online and SharePoint Online. Which feature should they configure in Microsoft 365?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) allow administrators to enforce device compliance as a condition for granting access to cloud apps like Exchange Online and SharePoint Online. By integrating with Microsoft Intune device compliance policies (e.g., requiring antivirus, disk encryption), Conditional Access can block or allow access based on real-time device health signals, ensuring only compliant devices can connect.

Answer

Data loss prevention (DLP) policies

Answer

Information Rights Management (IRM)

Answer

Microsoft Defender for Office 365

Question 9

A legal team needs to preserve all data related to a specific user involved in litigation, including Exchange emails, SharePoint documents, OneDrive files, and Teams chats. They require a hold that cannot be removed by the user and must allow for later searching and export. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) is the correct solution because it allows legal teams to place a hold on all content relevant to a specific user, including Exchange emails, SharePoint documents, OneDrive files, and Teams chats. This hold is enforced at the service level, preventing the user from deleting or modifying the data, and it preserves the content in its original location for later searching and export via Content Search or eDiscovery export tools.

Answer

Retention policies

Answer

Communication Compliance

Answer

Data Loss Prevention (DLP)

Question 10

A compliance team needs to implement a Data Loss Prevention (DLP) policy to protect credit card information. What is the correct order of steps for a successful implementation?

Accepted Answer

Identify locations, Create policy, Deploy in production, Monitor alerts and refine. Best practice for DLP implementation: first identify where sensitive data resides (locations), then create the DLP policy with conditions and actions, test the policy in simulation mode before deploying to production, and finally monitor alerts and refine the policy. The option starting with 'Identify locations' followed by 'Create policy', 'Deploy in production', and 'Monitor' matches this sequence.

Answer

Create policy, Identify locations, Deploy in production, Monitor alerts and refine

Answer

Deploy in production, Monitor alerts and refine, Identify locations, Create policy

Answer

Identify locations, Deploy in production, Create policy, Monitor alerts and refine

Question 11

An organisation wants to identify documents containing credit card numbers and prevent users from sharing them externally from SharePoint Online and Exchange Online. Which two Microsoft Purview capabilities are most relevant? (Choose 2.)

Accepted Answer

Sensitive information types.. Sensitive information types (A) are predefined or custom patterns that detect sensitive data like credit card numbers using regex and checksum validation. Data Loss Prevention policies (B) use these sensitive information types to enforce rules that block external sharing of documents containing credit card numbers in SharePoint Online and Exchange Online. Together, they identify the sensitive content and prevent its unauthorized external distribution.

Answer

Microsoft Bookings.

Answer

Windows Autopilot.

Question 12

A compliance manager wants a dashboard that maps Microsoft 365 controls to regulatory standards and gives recommended improvement actions. Which portal capability should they use?

Accepted Answer

Microsoft Purview Compliance Manager.. Microsoft Purview Compliance Manager is the correct portal because it provides a centralized dashboard that maps Microsoft 365 controls to regulatory standards (e.g., ISO 27001, NIST, GDPR) and generates recommended improvement actions with implementation steps. It uses built-in assessments and control scoring to track compliance posture, directly meeting the compliance manager's need for a regulatory mapping and action-oriented dashboard.

Answer

Microsoft Defender for Endpoint.

Answer

Exchange admin center message trace.

Answer

Microsoft Viva Connections.

Question 13

An organization wants to block sharing of documents containing credit card numbers. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

Data Loss Prevention policies. Data Loss Prevention (DLP) policies in Microsoft 365 are specifically designed to detect and block the sharing of sensitive information, such as credit card numbers, by scanning content for predefined or custom sensitive information types. When a match is found, DLP can enforce actions like blocking the share or sending a notification, directly addressing the organization's requirement. This capability operates across Exchange Online, SharePoint, OneDrive, and Teams, providing comprehensive protection against accidental or malicious data leaks.

Answer

It replaces the need for identity and access management

Answer

It requires every document to be made public

Question 14

A compliance administrator needs to investigate emails that may be part of a phishing campaign. Which Microsoft 365 capability is the best fit?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 is the correct tool because it provides security teams with a powerful, real-time investigation interface to search, filter, and analyze email threats, including phishing campaigns. It allows administrators to view detailed email metadata, delivery actions, and threat types (e.g., phishing, malware) across the organization, making it the best fit for investigating suspected phishing emails.

Answer

Microsoft Bookings

Answer

Microsoft Teams live events

Answer

OneDrive sync client

Question 15

A compliance administrator needs to manage user sign-in risk and require MFA for risky sign-ins. Which Microsoft 365 capability is the best fit?

Accepted Answer

Microsoft Entra ID Protection with Conditional Access. Microsoft Entra ID Protection (formerly Azure AD Identity Protection) detects sign-in risks such as anonymous IP addresses, atypical travel, or leaked credentials. When combined with Conditional Access policies, it can automatically require MFA for risky sign-ins, giving the compliance administrator precise control over user authentication based on real-time risk signals.

Answer

OneDrive sync client

Answer

Microsoft Bookings

Answer

Microsoft Teams live events