MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 7 — 15 Questions

Question 1

An organization needs to ensure that all Microsoft 365 data is encrypted at rest and in transit. Which of the following is a built-in encryption mechanism in Microsoft 365?

Accepted Answer

BitLocker Drive Encryption. BitLocker Drive Encryption is a built-in encryption mechanism in Microsoft 365 that encrypts data at rest on physical drives within Microsoft datacenters. It uses AES 256-bit encryption to protect data stored on disk volumes, ensuring that even if physical drives are removed, the data remains unreadable. Additionally, Microsoft 365 uses TLS 1.2+ for data in transit, but BitLocker specifically addresses the 'at rest' requirement as a native, default encryption layer.

Answer

Customer-managed keys (CMK) using Azure Key Vault

Answer

Office 365 Message Encryption

Answer

Azure Information Protection

Question 2

Your company uses Microsoft 365 E5 and has enabled Microsoft Purview Audit (Premium). The security team needs to investigate a potential data breach by searching for all activities related to a specific user in the last 90 days. Which tool should they use?

Accepted Answer

Microsoft Purview Audit (Premium) log search. Microsoft Purview Audit (Premium) log search is the appropriate tool to search the unified audit log for activities performed by a specific user across Microsoft 365 services. Since the security team needs to find all user-related activities in the last 90 days, the audit log search (Option C) directly meets this requirement. eDiscovery (Premium) is designed for finding content (e.g., emails, documents) and for legal holds, not for searching user activity logs.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Content Search

Answer

Microsoft Purview eDiscovery (Premium)

Question 3

Which TWO of the following are features of Microsoft Purview that help organizations meet compliance requirements for data lifecycle management? (Choose two.)

Accepted Answer

Retention policies. Retention policies allow organizations to define how long data is retained and when it should be deleted, directly supporting data lifecycle management. Option C is correct: Records management provides capabilities to declare records and manage their retention and disposition, which is a key part of data lifecycle compliance. Option B is incorrect: eDiscovery (Premium) is used for legal investigations and content search, not for lifecycle management. Option D is incorrect: Insider Risk Management focuses on detecting and mitigating internal risks, not on data lifecycle. Option E is incorrect: Data Loss Prevention (DLP) policies protect sensitive data from being shared improperly, but do not directly manage retention or lifecycle.

Answer

eDiscovery (Premium)

Answer

Insider Risk Management

Answer

Data Loss Prevention (DLP) policies

Question 4

Which THREE of the following are capabilities of Microsoft Entra ID that support identity security? (Choose three.)

Accepted Answer

Privileged Identity Management (PIM). The correct answers are C, D, and E. Option C (Privileged Identity Management) manages privileged roles and access. Option D (Conditional Access) enforces access policies based on conditions. Option E (Identity Protection) detects identity risks. Option A (Microsoft Defender XDR) is incorrect because it is a security solution for threats, not an identity security feature. Option B (Microsoft Intune) is incorrect because it is for mobile device management, not identity security.

Answer

Microsoft Defender XDR

Answer

Microsoft Intune

Question 5

Which TWO of the following are examples of Microsoft's commitments to data privacy as outlined in the Microsoft Privacy Statement and related agreements? (Choose two.)

Accepted Answer

Customers can access and export their data.. The Microsoft Privacy Statement explicitly grants customers the right to access, export, and delete their data, aligning with data portability and control principles under regulations like GDPR. This commitment ensures that customers maintain ownership and control over their data stored in Microsoft 365 services.

Answer

Microsoft uses customer data to train AI models by default.

Answer

Microsoft may share customer data with third parties for marketing purposes.

Answer

Microsoft allows third parties to access customer data without consent.

Question 6

Which THREE of the following are security features included in Microsoft 365 Business Premium? (Choose three.)

Accepted Answer

Microsoft Entra ID Plan 1. Microsoft Entra ID Plan 1 is included in Microsoft 365 Business Premium. It provides identity and access management capabilities such as single sign-on (SSO), multi-factor authentication (MFA), and conditional access policies. These features help secure user identities and control access to cloud resources, which is a core security requirement for business environments.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 7

Which TWO of the following are requirements for implementing Microsoft Purview Customer Key? (Choose two.)

Accepted Answer

An Azure subscription with Azure Key Vault. Customer Key uses Azure Key Vault to store customer-managed encryption keys, which requires an Azure subscription. Option C is correct because Customer Key is only available with a Microsoft 365 E5 license (or comparable license). Option A is incorrect because Customer Key does not require Microsoft Entra ID Premium P2; it requires E5 license. Option D is incorrect because Customer Key does not require Microsoft Defender for Cloud Apps. Option E is incorrect because Customer Key does not require an on-premises HSM; it uses Azure Key Vault.

Answer

Microsoft Entra ID Premium P2 licenses

Answer

Microsoft Defender for Cloud Apps

Answer

An on-premises Hardware Security Module (HSM)

Question 8

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel to investigate a user's deleted files. The query returns no results even though the user has deleted files. Which of the following is the most likely reason?

Accepted Answer

The Microsoft 365 connector is not configured in Sentinel.. The KQL query targets the 'OfficeActivity' table, which is populated by the Microsoft 365 connector in Microsoft Sentinel. If this connector is not configured, the table will be empty, causing the query to return no results even though the user has deleted files. All other options are incorrect because the query syntax is valid, the operation name 'DeleteFile' is correct for the OfficeActivity schema, and the UserId field is a legitimate field in that table.

Answer

The query filters by Result column which doesn't exist.

Answer

The query should use 'where Operation == "FileDeleted"' but the operation is 'DeleteFile'.

Answer

The UserId field should be replaced with UserPrincipalName.

Question 9

Your organization is deploying Microsoft 365 for a healthcare company that must comply with HIPAA. Which Microsoft 365 compliance feature should you use to prevent sensitive patient data from being shared externally via email?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies in Microsoft Purview are designed to detect and prevent the sharing of sensitive data, such as protected health information (PHI) subject to HIPAA. DLP can automatically block or warn users when they attempt to email sensitive data externally. Microsoft Purview Message Encryption (Option A) secures emails in transit but does not proactively prevent data leakage. eDiscovery (Option B) and Audit (Option C) are investigative tools, not preventive controls. Therefore, DLP is the correct choice for preventing external sharing of patient data.

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 10

A user reports receiving a phishing email that bypassed Exchange Online Protection (EOP). You need to investigate the threat and automate a response across email, endpoints, and identities. Which Microsoft 365 security solution should you use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security solution that correlates signals across email, endpoints, and identities. When a phishing email bypasses Exchange Online Protection (EOP), Defender XDR can automatically trigger an investigation and response (e.g., remediating the email, isolating the affected endpoint, and resetting the compromised user's credentials) through its automated incident response and playbooks, leveraging data from Defender for Office 365, Defender for Endpoint, and Microsoft Entra ID Protection.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 11

Your organization uses Microsoft Purview to manage data governance. A data owner needs to classify sensitive data across SharePoint, OneDrive, and Exchange automatically based on content patterns. Which Microsoft Purview feature should they use?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling policies can automatically classify data based on content patterns across SharePoint, OneDrive, and Exchange. The correct answer is A. Option B (eDiscovery Premium) is used for search and legal hold, not classification. Option C (Data Loss Prevention policies) prevents sharing but does not classify. Option D (Audit Standard) is for logging user and admin activity.

Answer

eDiscovery (Premium)

Answer

Data Loss Prevention (DLP) policies

Answer

Audit (Standard)

Question 12

A multinational corporation needs to restrict access to Microsoft 365 services based on user location and device state. They have offices in countries with strict data sovereignty laws. Which combination of Microsoft Entra ID features should they use to enforce these policies?

Accepted Answer

Conditional Access with location policies and device compliance. Conditional Access in Microsoft Entra ID allows administrators to enforce granular access policies based on signals like user location and device state. By combining location policies (e.g., blocking access from specific countries or requiring trusted IPs) with device compliance policies (e.g., requiring devices to be marked as compliant via Intune or domain-joined), the organization can meet data sovereignty requirements and restrict access based on both criteria simultaneously.

Answer

Microsoft Entra ID Governance

Answer

Identity Protection and Privileged Identity Management

Answer

Conditional Access with device compliance policies only

Answer

Conditional Access with location policies only

Question 13

Your company wants to run a phishing simulation to test employee awareness. Which Microsoft 365 tool can you use to create and launch a simulated phishing campaign?

Accepted Answer

Microsoft Defender for Office 365 Attack Simulation Training. Microsoft Defender for Office 365 includes Attack Simulation Training, which allows you to create and launch simulated phishing attacks. Option B is correct. Option A (Microsoft Defender for Cloud Apps) is a CASB, Option C (Microsoft Intune) is for device management, and Option D (Microsoft Purview Compliance Manager) is for compliance.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Purview Compliance Manager

Question 14

Your organization is required to retain all communications related to a legal case for 5 years. Emails and Teams messages must be preserved immutably. Which Microsoft 365 feature should you use?

Accepted Answer

Litigation Hold. Litigation Hold preserves all mailbox and Teams chat content immutably for legal purposes. Option A is correct. Option B, Data Loss Prevention (DLP) policies, is used to prevent sensitive data from being shared, not for preservation. Option C, Retention policies and tags, can retain or delete data based on policies but does not provide the immutable preservation required for legal holds. Option D, eDiscovery (Standard), is used for searching and exporting content, not for preservation.

Answer

Data Loss Prevention (DLP) policies

Answer

Retention policies and tags

Answer

eDiscovery (Standard)

Question 15

An organization uses Microsoft 365 Copilot for Microsoft 365. The security team wants to ensure that Copilot responses are based only on data that users already have permission to access. Which principle does this enforce?

Accepted Answer

Least privilege. The principle of least privilege ensures that users can only access the data necessary for their roles. Microsoft 365 Copilot adheres to this by grounding its responses in the user's existing permissions, meaning it cannot access data beyond what the user is already authorized to see. Option A (Least privilege) is correct. Zero Trust is a security model that requires verification for every request, Privileged Identity Management is for managing elevated roles, and Defense in depth involves multiple layers of security controls.

Answer

Defense in depth

Answer

Privileged Identity Management

Answer

Zero Trust