MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 8 — 15 Questions

Question 1

Which TWO of the following are features of Microsoft Purview Information Protection?

Accepted Answer

Sensitivity labels. Sensitivity labels are a core feature of Microsoft Purview Information Protection, allowing organizations to classify and protect sensitive data by applying labels that enforce encryption, access restrictions, and visual markings (e.g., headers/footers). These labels can be automatically applied based on content patterns or manually by users, and they persist with the data even when it leaves Microsoft 365, ensuring consistent protection across emails, documents, and other content.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery (Premium)

Answer

Azure Information Protection (AIP) scanner

Question 2

Which THREE of the following are included in Microsoft 365 E5 compliance features?

Accepted Answer

Microsoft Purview Audit (Premium). E5 includes Advanced Audit, eDiscovery Premium, and Microsoft Purview Communication Compliance. DLP is in E3, and Records Management is in E3.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Records Management

Question 3

Which TWO of the following are required to implement Microsoft Entra ID Conditional Access?

Accepted Answer

Microsoft Entra ID P1 or P2 licenses. Conditional Access requires Azure AD P1 or P2 licenses and roles that allow policy management. MFA and Intune are not required for all policies.

Answer

Microsoft 365 E5 license

Answer

Multifactor Authentication enabled for all users

Answer

Microsoft Intune subscription

Question 4

Your organization is deploying Microsoft 365 Copilot for sales teams. The compliance team requires that Copilot interactions with customer data in Dynamics 365 Sales be subject to retention policies. Which Microsoft Purview feature should you configure to manage this data?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management enforces retention policies for Copilot interactions. Option B is incorrect because eDiscovery is for search and export. Option C is incorrect because Communication Compliance is for monitoring inappropriate messages. Option D is incorrect because Sensitivity labels are for classification.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communication Compliance

Question 5

A multinational company uses Microsoft 365 E5 and needs to meet data residency requirements in the EU and Asia. They plan to use Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from leaving approved geographic boundaries. Which action should they take to enforce this policy?

Accepted Answer

Create a DLP policy that detects sensitive data and blocks sharing outside approved regions.. D is correct because Microsoft Purview Data Loss Prevention (DLP) policies can be configured to detect sensitive data and block sharing outside approved geographic regions, enabling enforcement of data residency requirements. A is incorrect because sensitivity labels and auto-labeling classify data but do not block data movement based on location. B is incorrect because Customer Lockbox controls access to data by Microsoft support personnel, not data location enforcement. C is incorrect because Conditional Access policies control access to resources based on conditions like location, but they do not prevent data from being shared or transferred after access is granted.

Answer

Apply sensitivity labels to all data and configure auto-labeling.

Answer

Enable Microsoft Purview Customer Lockbox to restrict data access.

Answer

Configure Conditional Access policies to block access from unauthorized regions.

Question 6

Your organization is implementing Microsoft Entra ID (formerly Azure AD) for identity management. Users report that they are prompted for multifactor authentication (MFA) every time they sign in, even from trusted devices. What should you configure to reduce MFA prompts while maintaining security?

Accepted Answer

Modify the Conditional Access policy to set session control 'Sign-in frequency' to a longer period.. Conditional Access policies allow you to set session controls such as 'Sign-in frequency' to reduce MFA prompts on trusted devices within a specified time period. Option A is incorrect because Named locations define trusted IP ranges, not MFA frequency. Option B is incorrect because self-service password reset (SSPR) does not control MFA prompt frequency. Option C is incorrect because Privileged Identity Management (PIM) manages admin roles and just-in-time access, not MFA exemptions.

Answer

Define trusted IP ranges in Named locations.

Answer

Configure self-service password reset (SSPR) to require MFA less often.

Answer

Use Microsoft Entra Privileged Identity Management (PIM) to grant MFA exemption.

Question 7

Your company uses Microsoft Defender for Office 365 and wants to prevent users from clicking malicious links in email. A user reports that a known phishing link was not blocked. Which step should you take to investigate?

Accepted Answer

Search in Threat Explorer for the URL and review the verdict.. Threat Explorer allows security administrators to search for specific URLs and review the verdict (e.g., allowed, blocked, or redirected). This helps determine why a known phishing link was not blocked. Option A is incorrect because Microsoft Secure Score provides recommendations for improving security posture, not for investigating specific incidents. Option B is incorrect because while checking the Safe Links policy is important, it only confirms whether the policy is enabled; it does not provide the specific verdict for the URL. Option D is incorrect because attack simulation is used to create and test phishing campaigns, not to investigate past email threats.

Answer

Check the Microsoft Secure Score for recommendations.

Answer

Review the Safe Links policy to ensure it is enabled.

Answer

Run an attack simulation to test the link.

Question 8

A healthcare organization is using Microsoft 365 and needs to ensure that patient data (protected health information) is not accidentally shared externally. They want to classify all documents containing medical terms and apply automatic encryption when shared outside the organization. Which two Microsoft Purview features should they combine? (Select TWO)

Accepted Answer

Sensitivity labels with auto-labeling based on trainable classifiers. To classify documents containing medical terms and automatically encrypt them when shared externally, the correct combination is sensitivity labels with auto-labeling based on trainable classifiers (option A) and Data Loss Prevention (DLP) policies with encryption action (option B). Sensitivity labels classify and optionally protect data; when combined with auto-labeling using trainable classifiers, they can detect medical terms and apply appropriate labels. DLP policies can then enforce actions such as encryption when labeled content is shared externally. Option C (Insider Risk Management) focuses on detecting risky user activities, not external sharing protection. Option D (Communication Compliance) monitors communications for policy violations, not document classification. Option E (Conditional Access) controls access based on conditions but does not classify or encrypt documents. Therefore, A and B are correct.

Answer

Insider Risk Management policies

Answer

Communication Compliance policies

Answer

Microsoft Entra ID Conditional Access policies

Question 9

Your organization is migrating from on-premises Exchange to Exchange Online. You need to ensure that email communications comply with regulatory requirements for retention. Which Microsoft 365 feature should you use to define retention periods for emails?

Accepted Answer

Microsoft Purview retention policies. Microsoft Purview retention policies allow you to define retention periods for emails in Exchange Online, ensuring compliance with regulatory requirements. Option A is incorrect because eDiscovery cases are used for searching and holding content during legal investigations, not for defining retention periods. Option C is incorrect because journaling archives communications but does not enforce retention periods. Option D is incorrect because litigation hold preserves emails indefinitely or for a specific period but is not designed for defining retention policies.

Answer

Microsoft Purview eDiscovery cases

Answer

Exchange Online journaling

Answer

Exchange Online litigation hold

Question 10

Which TWO actions should you take to protect against ransomware attacks in Microsoft 365?

Accepted Answer

Enable anti-malware policies in Microsoft Defender for Office 365.. The correct actions to protect against ransomware attacks in Microsoft 365 are enabling anti-malware policies in Microsoft Defender for Office 365 (A) and using SharePoint and OneDrive restricted access and permissions (E). Anti-malware policies block known ransomware at the email and file level, while restricted access and permissions prevent unauthorized users from encrypting or exfiltrating data in SharePoint and OneDrive. Attack simulation training (B) is for user education, not direct protection; sensitivity labels (C) are for classification; Data Loss Prevention policies (D) prevent data leakage but are not specifically designed for ransomware prevention.

Answer

Deploy attack simulation training to educate users.

Answer

Apply sensitivity labels with auto-labeling.

Answer

Configure Data Loss Prevention (DLP) policies.

Question 11

Which THREE conditions must be met for a Microsoft 365 tenant to use Customer Lockbox?

Accepted Answer

An authorized admin must submit a support request to Microsoft.. Customer Lockbox requires an authorized admin to explicitly approve or deny a Microsoft engineer's access request. This ensures that no data access occurs without the customer's explicit consent, aligning with the principle of 'approval-based access control' for support scenarios.

Answer

The tenant must be on a Microsoft 365 E3 plan.

Answer

Internal administrators must request access to user mailboxes.

Question 12

A law firm uses Microsoft 365 and wants to ensure that only authorized users can access client files stored in SharePoint Online. They also need to track when these files are accessed. Which combination of features should they use?

Accepted Answer

Sensitivity labels with encryption and Microsoft Purview auditing.. Sensitivity labels with encryption restrict access to files by applying encryption, and Microsoft Purview auditing tracks when files are accessed. Option B is incorrect because Conditional Access policies control sign-in conditions but do not restrict file-level access, and PIM manages role activation, not file access. Option C is incorrect because eDiscovery and Content search are used for legal discovery and searching content, not for access control. Option D is incorrect because DLP policies prevent data leakage but do not restrict access or provide tracking, and Microsoft Defender for Cloud Apps is for cloud app security, not file-level access control in SharePoint.

Answer

Conditional Access policies and Privileged Identity Management (PIM).

Answer

eDiscovery cases and Content search.

Answer

Data Loss Prevention (DLP) policies and Microsoft Defender for Cloud Apps.

Question 13

Your organization has a Microsoft 365 E5 subscription and wants to use Microsoft Purview to identify and protect sensitive data. Which feature should you use to automatically discover sensitive data across Exchange Online, SharePoint Online, and OneDrive?

Accepted Answer

Content explorer. Content explorer. Content explorer allows you to view and discover where sensitive data is stored across Exchange Online, SharePoint Online, and OneDrive. It is part of Microsoft Purview's data classification capabilities. Option B (Data Loss Prevention policies) is used to prevent unauthorized sharing of sensitive data, not to discover it. Option C (Sensitivity labels) classify and protect data based on labels. Option D (Activity explorer) tracks user activities, not data discovery.

Answer

Data Loss Prevention (DLP) policies

Answer

Sensitivity labels

Answer

Activity explorer

Question 14

Your company uses Microsoft 365 and wants to ensure that when employees access Microsoft 365 from unmanaged devices, they can only view data but not download or print it. Which technology should you use?

Accepted Answer

Microsoft Entra Conditional Access with session controls. Microsoft Entra Conditional Access with session controls (e.g., app protection policies) can restrict actions like download and print from unmanaged devices without requiring enrollment. Option A is incorrect because Intune compliance policies require device enrollment and do not directly control browser actions. Option C is incorrect because sensitivity labels with encryption protect data at rest but do not block printing from a browser. Option D is incorrect because Microsoft Purview DLP policies monitor and block sharing of sensitive data but do not prevent download or print from the browser.

Answer

Microsoft Intune compliance policies

Answer

Sensitivity labels with encryption

Answer

Microsoft Purview Data Loss Prevention (DLP) policies

Question 15

Refer to the exhibit. The exhibit shows a Conditional Access policy. Which requirement does this policy enforce?

Accepted Answer

Users must provide MFA and use a compliant device.. The Conditional Access policy shown in the exhibit enforces both MFA and a compliant device (AND operator). This means users must satisfy both requirements to access the resource. Option A is incorrect because users from trusted IPs are excluded from the policy, not blocked. Option B is incorrect because the policy requires both MFA and compliant device, not just MFA. Option D is incorrect because the policy uses AND, not OR, so both conditions must be met.

Answer

Users from trusted IPs are blocked.

Answer

Users must provide MFA only.

Answer

Users must provide MFA or use a compliant device.