MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 6 — 15 Questions

Question 1

A compliance administrator needs to apply encryption and usage restrictions to confidential documents. Which Microsoft 365 capability is the best fit? The design must avoid adding custom operational scripts.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sensitivity labels. Sensitivity labels are the correct choice because they allow the compliance administrator to apply encryption and usage restrictions (such as 'Do Not Forward' or 'View Only') directly to confidential documents without writing any custom scripts. This capability is built into Microsoft 365 and integrates with Azure Information Protection to enforce protection policies at the file level, meeting the requirement for a no-code solution.

Answer

OneDrive sync client

Answer

Microsoft Bookings

Answer

Microsoft Teams live events

Question 2

A compliance administrator needs to assess compliance posture against standards and improvement actions. Which Microsoft 365 capability is the best fit? The design must avoid adding custom operational scripts.

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct choice because it provides a built-in, no-code solution for assessing compliance posture against standards (e.g., ISO 27001, NIST) and generates actionable improvement actions. It eliminates the need for custom operational scripts by offering pre-configured assessments and automated tracking of controls.

Answer

OneDrive sync client

Answer

Microsoft Teams live events

Answer

Microsoft Bookings

Question 3

Which three of the following are core components of Microsoft’s Zero Trust security model as implemented in Microsoft 365? (Choose three.)

Accepted Answer

Assume breach. The Zero Trust security model is built on three foundational principles: verify explicitly, use least privileged access, and assume breach. In Microsoft 365, 'verify explicitly' means authenticating and authorizing every access request based on all available data points (user identity, device health, location, etc.). 'Use least privileged access' limits user permissions to only what is necessary, enforced through tools like Privileged Identity Management (PIM) and Conditional Access. 'Assume breach' designs the environment to minimize blast radius and segment access, assuming an attacker is already present, which drives practices like micro-segmentation and continuous monitoring.

Answer

Deploy a single firewall for all traffic

Answer

Encrypt all data at rest only

Answer

Require on-premises identity provider

Question 4

A company is expanding globally and needs to meet data residency and compliance requirements in multiple regions. Which three Microsoft 365 compliance and privacy features should they consider? (Choose three.)

Accepted Answer

Customer Lockbox. Data Loss Prevention (DLP) policies help organizations identify, monitor, and protect sensitive data across Microsoft 365 services, ensuring compliance with regional data residency requirements by preventing unauthorized sharing or leakage. Compliance Manager provides a centralized dashboard to assess compliance posture against regulations like GDPR, ISO 27001, and local data residency laws, offering actionable recommendations. Customer Lockbox ensures that Microsoft support engineers cannot access customer data without explicit approval, addressing privacy and data sovereignty concerns in multi-region deployments.

Answer

Exchange Online archival mailboxes

Answer

Microsoft 365 Copilot

Answer

Azure Active Directory (Azure AD) Connect

Question 5

Which three options describe key capabilities of Microsoft Purview that help organizations manage compliance and data governance in Microsoft 365? (Choose three.)

Accepted Answer

Conduct eDiscovery searches and hold content for legal cases. Microsoft Purview provides integrated data governance and compliance capabilities across Microsoft 365. It automatically classifies and labels sensitive data using trainable classifiers and exact data match, applies retention policies and labels to meet legal and regulatory requirements, and enables eDiscovery searches with legal hold to preserve content for litigation. These three capabilities directly address data classification, lifecycle management, and legal discovery.

Answer

Monitor network traffic to prevent DDoS attacks

Answer

Provide anti-malware and phishing protection in email

Answer

Manage user passwords and enforce multi-factor authentication

Question 6

Which four of the following are key components of the Microsoft 365 defense-in-depth security strategy? (Choose all that apply. There are four correct answers.)

Accepted Answer

Data encryption at rest and in transit, using technologies like BitLocker and TLS.. The Microsoft 365 defense-in-depth strategy relies on multiple layers of security controls. Physical security of datacenters (biometric access, 24/7 monitoring) is the foundational layer. User identity protection via Azure AD MFA and Conditional Access secures the authentication layer. Data encryption at rest (BitLocker) and in transit (TLS) protects data confidentiality. Advanced Threat Protection (ATP) for email, SharePoint, and Teams defends against malware and phishing at the workload layer. These four components collectively implement a layered security model.

Answer

Automated rollback of all user changes to previous versions within 24 hours.

Answer

Unrestricted access for Microsoft engineers to all customer data for continuous security scanning.

Question 7

Drag and drop the steps to configure a data loss prevention (DLP) policy in the Microsoft 365 compliance center into the correct order.

Accepted Answer

Step 1: Select a DLP template or start with a custom policy. Step 2: Choose the locations (Exchange, SharePoint, OneDrive, Teams) where the policy applies. Step 3: Define the policy rules with conditions and actions.. DLP policies are created in the compliance center by selecting a template, locations, and rules.

Answer

Step 1: Choose locations (Exchange, SharePoint, OneDrive, Teams). Step 2: Select a DLP template or start with a custom policy. Step 3: Define the policy rules with conditions and actions.

Answer

Step 1: Define the policy rules with conditions and actions. Step 2: Select a DLP template or start with a custom policy. Step 3: Choose locations (Exchange, SharePoint, OneDrive, Teams).

Answer

Step 1: Select a DLP template or start with a custom policy. Step 2: Define the policy rules with conditions and actions. Step 3: Choose locations (Exchange, SharePoint, OneDrive, Teams).

Question 8

Match each Microsoft 365 compliance term to its definition.

Accepted Answer

Data Loss Prevention (DLP): Helps prevent sensitive data from being shared or exposed.. Microsoft 365 compliance features include Data Loss Prevention (prevent data leaks), eDiscovery (search and export for legal needs), Retention Policies (manage content lifecycle), and Sensitivity Labels (classify and protect). Common confusions involve mixing the definitions of these tools.

Answer

Data Loss Prevention (DLP): Used to search for and export content for legal or compliance purposes.

Answer

Retention Policies: Classify and protect data based on sensitivity.

Question 9

Match each Microsoft 365 pricing model to its description.

Accepted Answer

Per-user subscription: Each user has a unique license to access services from any device.. Microsoft 365 offers different pricing models: per-user (each user licensed), per-device (each device licensed), and consumption-based (pay per use). Common confusions include swapping per-user and per-device, or confusing consumption with subscriptions.

Answer

Per-user subscription: Licensing is tied to a specific device rather than a user.

Answer

Per-device subscription: Each user must have their own license regardless of device.

Answer

Consumption-based pricing: A fixed monthly fee per user for unlimited usage.

Question 10

Your organization is deploying Microsoft 365 and needs to ensure that data stored in SharePoint Online and OneDrive for Business is protected against accidental deletion by end users. The compliance team requires that deleted files be recoverable for at least 90 days. What should you implement?

Accepted Answer

Create a Microsoft Purview retention policy with a retention period of 90 days.. A Microsoft Purview retention policy with a retention period of 90 days ensures that deleted files are preserved for at least 90 days, meeting the compliance requirement. Option A is incorrect because versioning retains previous versions of files but does not recover deleted files. Option C is incorrect because even though the SharePoint recycle bin retention can be extended, it is not a guaranteed policy and may be bypassed by users with permissions. Option D is incorrect because a DLP policy is designed to prevent data loss through monitoring and blocking, not to retain deleted items.

Answer

Enable versioning on all document libraries.

Answer

Increase the SharePoint Online recycle bin retention to 90 days.

Answer

Configure a Microsoft Purview Data Loss Prevention (DLP) policy for SharePoint.

Question 11

Refer to the exhibit. You are reviewing a Microsoft Purview Information Protection policy created by a colleague. The policy is intended to prevent users from sharing files labeled 'Highly Confidential' with external parties. However, users are still able to share these files externally. Which of the following is the most likely reason?

Accepted Answer

The sensitivity label is not published to the users.. Even if the policy condition checks for the 'Highly Confidential' sensitivity label, the label itself must be published to users for the policy to apply correctly. If the label is not published, users may not have the label available to assign, and the policy may not enforce as intended. Option B is incorrect because the absence of a 'blockAccess' action is not stated; the policy likely already includes a blocking action like 'blockSharing'. Option C is incorrect because setting the action to 'blockAccess' only would not address the root cause—the label being unpublished. Option D is incorrect because checking file extension is not a substitute for sensitivity label; the policy is correctly using label-based conditions.

Answer

The policy is missing the 'blockAccess' action.

Answer

The action should be set to 'blockAccess' only.

Answer

The condition should check for file extension instead of sensitivity label.

Question 12

Your organization uses Microsoft 365 E5 and wants to automatically classify emails containing credit card numbers as 'Sensitive' and apply encryption when sent externally. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct feature because it is specifically designed to detect sensitive data types—such as credit card numbers—via built-in sensitive info types (e.g., Credit Card Number) and automatically enforce protective actions like blocking or encrypting emails when sent externally. Unlike sensitivity labels, DLP policies can inspect content in transit (Exchange Online) and apply encryption through transport rules or Office 365 Message Encryption (OME) without requiring user-applied labels.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 13

A multinational company must comply with the General Data Protection Regulation (GDPR). They need to be able to search for and delete personal data of a user upon request (right to erasure). Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) enables searching for content across Microsoft 365, including Exchange, SharePoint, OneDrive, and Teams, which allows organizations to locate personal data of a user and facilitate its deletion to comply with GDPR right to erasure requests. Option B is incorrect because Audit (Standard) only logs user and admin activities; it does not provide capabilities to search and delete content. Option C is incorrect because Communication Compliance focuses on monitoring communications for inappropriate content, not on data deletion. Option D is incorrect because Insider Risk Management identifies and analyzes risky user activities but does not include search and delete functionality for personal data.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management

Question 14

Your organization uses Microsoft 365 Business Premium. You need to protect users from phishing attacks by blocking malicious links in real-time when they click them in emails. Which feature provides this capability?

Accepted Answer

Microsoft Defender for Office 365 Safe Links. Microsoft Defender for Office 365 Safe Links provides time-of-click protection against malicious URLs. Option A is wrong because Safe Attachments scans email attachments for malware, not links. Option C is wrong because Exchange Online Protection (EOP) anti-spam policies filter spam, not protect against malicious links. Option D is wrong because Microsoft Defender XDR is a broader security suite that includes multiple products, but the specific feature for real-time link protection is Safe Links.

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Exchange Online Protection (EOP) anti-spam policy

Answer

Microsoft Defender XDR

Question 15

Refer to the exhibit. A Microsoft 365 administrator runs the PowerShell script against Microsoft Entra ID. The script outputs several enabled Conditional Access policies. However, users report they are not prompted for MFA even though there is an enabled policy that should require MFA for all users. What is the most likely reason?

Accepted Answer

The policy is set to 'report-only' mode.. The most likely reason users are not prompted for MFA despite an enabled Conditional Access policy requiring MFA is that the policy is set to 'report-only' mode. In report-only mode, the policy is evaluated and logged but not enforced, meaning users will not be prompted for MFA. This is a common configuration used for testing before enabling the policy in 'on' mode.

Answer

The script is not executed with administrative privileges.

Answer

The script does not run against all policies.

Answer

The script disables the MFA policy inadvertently.