MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. The exhibit shows an auto-labeling policy configuration. What will happen when a document labeled 'EU PII' is shared externally via SharePoint?

Accepted Answer

The document will be encrypted before sharing.. The auto-labeling policy encrypts documents labeled 'EU PII' when they are shared externally. Option A is incorrect because the policy does not change the sensitivity label to 'Confidential'; it encrypts the document. Option B is incorrect because encryption is applied, so the document is not shared without encryption. Option C is incorrect because the policy does not block sharing; it allows sharing with encryption.

Answer

The document will be automatically labeled as confidential.

Answer

The document will be shared without encryption.

Answer

The document will be blocked from sharing.

Question 2

Refer to the exhibit. The exhibit shows an anti-phishing policy in Microsoft Defender for Office 365. Which users receive the highest level of protection?

Accepted Answer

The CEO and CFO specifically.. The anti-phishing policy specifies 'Targeted user protection' for the CEO and CFO, meaning they receive the highest level of protection beyond the standard policy applied to all users. Option A is incorrect because while the policy applies to all users, targeted users get additional protection. Option B is incorrect because the quarantine list is unrelated to protection levels. Option D is incorrect because the phishing threshold level applies to the policy settings, not to who gets the highest protection.

Answer

All users in the organization.

Answer

Only users in the quarantine list.

Answer

Users with phishing threshold level 2.

Question 3

Which THREE statements about the Microsoft Service Trust Portal are true?

Accepted Answer

It includes the Compliance Manager tool.. Options A, B, and C are correct: The Service Trust Portal provides the Compliance Manager tool, is accessible to authenticated users with an Azure AD account, and offers independent audit reports and compliance documentation. Option D is incorrect because it does not allow real-time tracking of data location; data residency information is available through other tools. Option E is incorrect because it does not provide downloads of Microsoft software patches; the portal only offers compliance-related documents.

Answer

It allows real-time tracking of data location.

Answer

It provides downloads of Microsoft software patches.

Question 4

Your organization wants to ensure that users can only access Microsoft 365 resources from compliant devices. Which security feature should you implement?

Accepted Answer

Microsoft Entra Conditional Access. Conditional Access in Microsoft Entra ID allows you to enforce policies that require devices to be compliant (e.g., managed by Microsoft Intune) before granting access to Microsoft 365 resources. Option A: Microsoft Entra Conditional Access is the correct feature. Option B: Microsoft Purview Data Loss Prevention is for preventing data leaks, not device compliance. Option C: Microsoft Defender for Cloud Apps is for cloud app security and access control, but not primarily for device compliance enforcement. Option D: Microsoft Intune is a device management tool that helps enforce compliance, but Conditional Access is the policy mechanism that uses Intune compliance data to block or allow access.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 5

A company is subject to GDPR and needs to respond to a data subject request to delete a user's personal data from Microsoft 365. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management provides capabilities to manage data subject requests (DSRs) under GDPR, including the ability to delete personal data. Option B is correct. Options A, C, and D are not designed for DSR management.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 6

Your organization has a Microsoft 365 E5 subscription and wants to centrally manage security incidents across identities, endpoints, and cloud apps. Which Microsoft solution provides this capability?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (formerly Microsoft 365 Defender) centrally correlates security signals across identities, endpoints, cloud apps, and email to provide a unified incident management experience. Option A (Microsoft Entra ID Protection) focuses only on identity risks. Option B (Microsoft Sentinel) is a SIEM/SOAR solution that ingests logs from many sources but is not the primary tool for cross-domain incident management within Microsoft 365. Option D (Microsoft Defender for Endpoint) is limited to endpoint detection and response. Therefore, option C is the correct answer.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 7

Refer to the exhibit. You are reviewing a Conditional Access policy configuration. What is the effect of this policy on a user who signs in from a known device but with medium sign-in risk?

Accepted Answer

The user is prompted for multifactor authentication.. The policy requires MFA when the sign-in risk level is medium or higher. Since the condition is met (medium risk), the user will be prompted for MFA. Option D is correct.

Answer

The user is required to reset their password.

Answer

The user is blocked from signing in.

Answer

The user is allowed without any additional prompts because the device is known.

Question 8

Refer to the exhibit. An administrator configured a sensitivity label with auto-labeling for credit card numbers. What happens when a user creates a document containing a credit card number and saves it to SharePoint Online?

Accepted Answer

The label is automatically applied, and the document is encrypted.. The auto-labeling rule automatically applies the sensitivity label when a credit card number is detected. The label is configured to enforce encryption via the 'Encrypt document' action, so the document is encrypted upon label application. Therefore, option B is correct.

Answer

The label is applied only when the user manually selects it.

Answer

The document is blocked from being saved.

Answer

The label is applied, but encryption is not enforced because the user can override.

Question 9

Refer to the exhibit. The JSON shows compliance scores from Microsoft Purview Compliance Manager. Which action should the organization prioritize to improve its HIPAA compliance score?

Accepted Answer

Enable multifactor authentication for all users.. The recommended action 'Enable MFA for all users' is marked as high impact and open. Implementing MFA would significantly improve the HIPAA score, as it addresses a common control. Option B is correct.

Answer

Deploy Microsoft Defender for Office 365.

Answer

Implement retention labels for medical records.

Answer

Conduct a data privacy impact assessment.

Question 10

Your organization uses Microsoft 365 Copilot and wants to ensure that sensitive data is not exposed through AI-powered features. Which Microsoft Purview capability should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention policies for Copilot. Microsoft Purview Data Loss Prevention (DLP) policies can be extended to Copilot interactions to prevent sensitive data from being shared. This is the correct capability to configure, making option C the right answer.

Answer

Microsoft Intune app protection policies

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra Conditional Access

Question 11

A healthcare organization must ensure that electronic protected health information (ePHI) in Microsoft 365 is encrypted both at rest and in transit. Which Microsoft 365 feature provides encryption for data in transit?

Accepted Answer

TLS/SSL encryption. Microsoft 365 uses TLS to encrypt data in transit between clients and Microsoft servers. Option B (TLS/SSL encryption) is correct. Azure Information Protection and Microsoft Purview Information Protection are for data classification and protection policies, not encryption in transit. BitLocker encrypts data at rest.

Answer

Azure Information Protection

Answer

BitLocker Drive Encryption

Answer

Microsoft Purview Information Protection

Question 12

Your organization is adopting Microsoft 365 Copilot and wants to prevent the AI from using internal customer data in its training models. Which data protection option should be enabled?

Accepted Answer

Microsoft Commercial Data Protection. Microsoft Commercial Data Protection ensures that Copilot does not use customer data for training models. Option A is correct. Options B, C, and D do not address training data usage.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Audit

Answer

Conditional Access policies

Question 13

Which TWO of the following are key capabilities of Microsoft Purview Communication Compliance? (Choose two.)

Accepted Answer

Detect and respond to inappropriate messages. Microsoft Purview Communication Compliance helps organizations detect and respond to inappropriate messages (option A) and monitor communications for regulatory compliance (option D). Options B and C are incorrect: multifactor authentication is an identity protection feature, and retention labels are for data lifecycle management.

Answer

Enforce multifactor authentication

Answer

Configure retention labels

Answer

Block external email forwarding

Question 14

Which THREE of the following are included in Microsoft 365 E5 compliance features? (Choose three.)

Accepted Answer

Privileged Access Management. Microsoft 365 E5 compliance features include advanced capabilities: Privileged Access Management (A) controls just-in-time access to sensitive data; Customer Key (C) provides tenant-level encryption key management; Communication Compliance (E) helps monitor communications to minimize compliance risks. Options B (Microsoft Intune) is a device management tool, not specifically a compliance feature within E5 compliance. Option D (Basic audit log search) is included in E3, not an E5 advanced feature.

Answer

Microsoft Intune

Answer

Basic audit log search

Question 15

Which TWO of the following are examples of security defaults in Microsoft Entra ID? (Choose two.)

Accepted Answer

Require multifactor authentication for all users. Security defaults enforce basic security policies, including requiring MFA for all users and blocking legacy authentication. Options A and E are correct.

Answer

Allow legacy authentication protocols

Answer

Disable self-service password reset

Answer

Enable guest user access