MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 8 — 15 Questions

Question 1

A compliance-aware administrator is selecting the right Microsoft 365 capability to encrypt email messages sent to internal or external recipients. Microsoft security, identity, or compliance capability should it use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (B) is the correct choice because it is the dedicated Microsoft 365 service that provides encryption for email messages sent to both internal and external recipients. It leverages Azure Rights Management (Azure RMS) to protect messages, ensuring only intended recipients can decrypt and read them, which directly meets the compliance requirement for email encryption.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 2

A security team wants Microsoft 365 access to be allowed only when a user's device is marked compliant by management policy. Which two capabilities are normally combined? (Choose two.)

Accepted Answer

Microsoft Intune compliance policies. Microsoft Intune compliance policies define the rules that a device must meet (e.g., encryption, OS version, threat level) to be considered compliant. Conditional Access enforces access decisions based on signals like device compliance status, blocking or granting access to Microsoft 365 services. Together, they ensure only compliant devices can access corporate resources.

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 3

An administrator is reviewing a request from users who need to analyze attachments in a protected environment before delivery. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Safe Attachments. Safe Attachments is the correct Microsoft 365 Defender capability that detonates email attachments in a virtual, protected environment before delivery. It uses behavioral analysis and machine learning to detect malicious content, ensuring that only safe attachments reach the user's inbox. This directly addresses the requirement to analyze attachments in a protected environment.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 4

During a Microsoft 365 planning workshop, allow access to Exchange Online only from compliant devices. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Intune compliance policies with Conditional Access. Microsoft Intune compliance policies define the security requirements (e.g., device encryption, jailbreak detection, minimum OS version) that a device must meet. When combined with Conditional Access in Microsoft Entra ID, you can create a policy that blocks access to Exchange Online unless the device is marked as compliant by Intune. This ensures only compliant devices can connect, directly meeting the requirement.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 5

A tenant administrator is advising a department that wants to let users sign in once and access connected Microsoft 365 and SaaS apps. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Single sign-on (SSO). Single sign-on (SSO) enables users to authenticate once and gain access to multiple applications, including Microsoft 365 and third-party SaaS apps, without re-entering credentials. This is achieved through federation protocols such as SAML 2.0 or OpenID Connect, which allow the identity provider (Microsoft Entra ID) to issue security tokens to relying party applications. SSO is the correct Microsoft security and identity capability for this requirement.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 6

A business stakeholder asks how Microsoft 365 can help them periodically review group memberships and application access. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Access reviews. Access reviews in Microsoft Entra ID (formerly Azure AD) allow administrators to periodically review and certify group memberships and application access. This capability directly addresses the stakeholder's requirement by automating recurring attestation workflows, ensuring that only authorized users retain access. It is part of Microsoft's identity governance framework, not a general productivity or media tool.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 7

While preparing a Microsoft 365 adoption plan, a consultant is asked to give external partners controlled access to Teams and SharePoint resources. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra External ID / B2B collaboration. Microsoft Entra External ID (formerly Azure AD B2B collaboration) is the correct capability because it enables organizations to securely share Teams and SharePoint resources with external partners by inviting them as guest users. This feature uses identity federation to allow partners to authenticate with their own credentials, while enforcing conditional access policies and compliance controls. It directly addresses the requirement for controlled, compliant external access without exposing internal directories or requiring additional licenses for partners.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 8

A service owner is comparing Microsoft 365 capabilities and needs to detect exact customer records rather than only generic data patterns. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Exact Data Match sensitive information type. Exact Data Match (EDM) sensitive information types allow a service owner to define custom sensitive information types based on exact database records, such as customer names or account numbers, rather than relying on generic pattern matching like regular expressions. This capability is part of Microsoft Purview compliance and enables precise detection of specific customer data in Microsoft 365 environments.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 9

During requirements gathering, an IT manager says the organization must discover where sensitive information is stored across Microsoft 365. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Data classification / Content explorer. Data classification and Content explorer in Microsoft 365 Purview allow organizations to discover, classify, and monitor sensitive information across Exchange, SharePoint, OneDrive, and Teams. This capability uses trainable classifiers and sensitive information types to identify data like credit card numbers or PII, providing a unified view in Content explorer for compliance administrators. It directly meets the requirement to discover where sensitive information is stored.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 10

A help desk lead is documenting the correct Microsoft 365 approach to allow browser access to SharePoint from unmanaged devices but restrict downloads. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Conditional Access access/session controls. Conditional Access access/session controls allow administrators to enforce granular restrictions on browser access to SharePoint from unmanaged devices, such as blocking download of sensitive content while still permitting view-only access. This is achieved through session policies that integrate with Microsoft Defender for Cloud Apps (formerly Cloud App Security) to apply real-time controls at the protocol level, without requiring device enrollment or compliance.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 11

A compliance-aware administrator is selecting the right Microsoft 365 capability to encrypt email messages sent to internal or external recipients. Microsoft security, identity, or compliance capability should it use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Records Management. Records Management in Microsoft 365 (part of Microsoft Purview) is specifically designed to manage formal records by applying retention labels that enforce retention and disposition policies. It allows administrators to declare records, lock them against modification or deletion, and trigger disposal actions based on regulatory or organizational requirements. This directly addresses the need to retain and dispose of records according to policy.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 12

A department head asks which Microsoft 365 option should be used to search, review, and export content for a legal investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery is the correct choice because it is the dedicated Microsoft 365 compliance solution for searching, reviewing, and exporting content in legal investigations. It provides advanced search capabilities across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams, and supports legal hold, review sets, and export workflows to meet eDiscovery requirements.

Answer

Microsoft Forms

Answer

Microsoft Stream

Answer

Microsoft Planner

Question 13

An administrator is reviewing a request from users who need to discover cloud apps being used by employees and assess their risk. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is the correct choice because it is a Cloud Access Security Broker (CASB) that provides visibility into cloud app usage, shadow IT discovery, and risk assessment. It integrates with Microsoft 365 to monitor user activities and apply data loss prevention (DLP) policies across sanctioned and unsanctioned cloud apps.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 14

During a Microsoft 365 planning workshop, show security recommendations and a score for Microsoft 365 posture. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Secure Score. Microsoft Secure Score is the correct tool because it provides a numerical score and actionable security recommendations based on your tenant's security posture. It analyzes configurations across Microsoft 365 services (e.g., Exchange Online, Microsoft Entra ID, Intune) and suggests improvements to reduce risk, directly matching the workshop requirement for showing recommendations and a score.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 15

A tenant administrator is advising a department that wants to automatically apply a label when sensitive customer identifiers are detected. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Auto-labeling for sensitivity labels. Auto-labeling for sensitivity labels in Microsoft Purview (formerly Microsoft 365 Compliance) can automatically apply a sensitivity label when sensitive customer identifiers are detected. It uses trainable classifiers or sensitive information types to identify content and then applies the label based on policies. This helps organizations protect data without manual intervention.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream