MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 9 — 15 Questions

Question 1

A compliance administrator needs to investigate emails that may be part of a phishing campaign. Which Microsoft 365 capability is the best fit?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 is the correct tool because it provides security teams with a powerful, real-time investigation interface to search, filter, and analyze email threats, including phishing campaigns. It allows administrators to view detailed email metadata, delivery actions, and threat types (e.g., phishing, malware) across the organization, making it the best fit for investigating suspected phishing emails.

Answer

Microsoft Bookings

Answer

Microsoft Teams live events

Answer

OneDrive sync client

Question 2

A compliance administrator needs to assess compliance posture against standards and improvement actions. Which Microsoft 365 capability is the best fit?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct choice because it provides a comprehensive dashboard for assessing an organization's compliance posture against standards like ISO 27001, NIST, and GDPR, and it offers actionable improvement actions with step-by-step guidance. It automatically tracks controls, assigns scores, and integrates with Microsoft Secure Score to help administrators prioritize remediation efforts.

Answer

OneDrive sync client

Answer

Microsoft Teams live events

Answer

Microsoft Bookings

Question 3

An organization wants to retain mailbox content for legal investigation. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

eDiscovery and retention capabilities in Microsoft Purview. Security and compliance controls should be selected by risk scenario and tested before tenant-wide enforcement.

Answer

It requires every document to be made public

Answer

It replaces the need for identity and access management

Question 4

A compliance administrator needs to manage user sign-in risk and require MFA for risky sign-ins. Which Microsoft 365 capability is the best fit?

Accepted Answer

Microsoft Entra ID Protection with Conditional Access. Microsoft Entra ID Protection (formerly Azure AD Identity Protection) detects sign-in risks such as anonymous IP addresses, atypical travel, or leaked credentials. When combined with Conditional Access policies, it can automatically require MFA for risky sign-ins, giving the compliance administrator precise control over user authentication based on real-time risk signals.

Answer

OneDrive sync client

Answer

Microsoft Bookings

Answer

Microsoft Teams live events

Question 5

A compliance administrator needs to block sharing of documents containing credit card numbers. Which Microsoft 365 capability is the best fit?

Accepted Answer

Data Loss Prevention policies. Data Loss Prevention (DLP) policies in Microsoft 365 are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers—across Exchange Online, SharePoint, OneDrive, and Teams. By configuring a DLP policy with a built-in sensitive info type for credit card numbers, the administrator can block users from sharing documents containing that data, either by preventing the action or triggering a notification. This directly addresses the compliance requirement to block sharing of documents with credit card numbers.

Answer

Microsoft Teams live events

Answer

Microsoft Bookings

Answer

OneDrive sync client

Question 6

A compliance administrator needs to apply encryption and usage restrictions to confidential documents. Which Microsoft 365 capability is the best fit? The design must avoid adding custom operational scripts.

Accepted Answer

Sensitivity labels. Sensitivity labels are the correct choice because they allow the compliance administrator to apply encryption and usage restrictions (such as 'Do Not Forward' or 'View Only') directly to confidential documents without writing any custom scripts. This capability is built into Microsoft 365 and integrates with Azure Information Protection to enforce protection policies at the file level, meeting the requirement for a no-code solution.

Answer

OneDrive sync client

Answer

Microsoft Bookings

Answer

Microsoft Teams live events

Question 7

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 is a powerful tool for investigating phishing campaigns. It allows security analysts to view and filter email threat data, including malware, phishing, and spam, in near real-time. This enables the organization to identify, analyze, and remediate malicious emails that are part of a phishing campaign, making option A correct.

Answer

It replaces the need for identity and access management

Answer

It requires every document to be made public

Question 8

A compliance administrator needs to assess compliance posture against standards and improvement actions. Which Microsoft 365 capability is the best fit? The design must avoid adding custom operational scripts.

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct choice because it provides a built-in, no-code solution for assessing compliance posture against standards (e.g., ISO 27001, NIST) and generates actionable improvement actions. It eliminates the need for custom operational scripts by offering pre-configured assessments and automated tracking of controls.

Answer

OneDrive sync client

Answer

Microsoft Teams live events

Answer

Microsoft Bookings

Question 9

A compliance administrator needs to retain mailbox content for legal investigation. Which Microsoft 365 capability is the best fit?

Accepted Answer

eDiscovery and retention capabilities in Microsoft Purview. eDiscovery and retention capabilities in Microsoft Purview are designed specifically for legal investigations, allowing compliance administrators to preserve mailbox content via legal holds, search across mailboxes, and export data for litigation. This directly meets the requirement to retain mailbox content for legal investigation, unlike the other options which serve unrelated business functions.

Answer

Microsoft Teams live events

Answer

Microsoft Bookings

Answer

OneDrive sync client

Question 10

Which three of the following are core components of Microsoft’s Zero Trust security model as implemented in Microsoft 365? (Choose three.)

Accepted Answer

Verify explicitly. The Zero Trust security model is built on three foundational principles: verify explicitly, use least privileged access, and assume breach. In Microsoft 365, 'verify explicitly' means authenticating and authorizing every access request based on all available data points (user identity, device health, location, etc.). 'Use least privileged access' limits user permissions to only what is necessary, enforced through tools like Privileged Identity Management (PIM) and Conditional Access. 'Assume breach' designs the environment to minimize blast radius and segment access, assuming an attacker is already present, which drives practices like micro-segmentation and continuous monitoring.

Answer

Encrypt all data at rest only

Answer

Deploy a single firewall for all traffic

Answer

Require on-premises identity provider

Question 11

A company is expanding globally and needs to meet data residency and compliance requirements in multiple regions. Which three Microsoft 365 compliance and privacy features should they consider? (Choose three.)

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies help organizations identify, monitor, and protect sensitive data across Microsoft 365 services, ensuring compliance with regional data residency requirements by preventing unauthorized sharing or leakage. Compliance Manager provides a centralized dashboard to assess compliance posture against regulations like GDPR, ISO 27001, and local data residency laws, offering actionable recommendations. Customer Lockbox ensures that Microsoft support engineers cannot access customer data without explicit approval, addressing privacy and data sovereignty concerns in multi-region deployments.

Answer

Azure Active Directory (Azure AD) Connect

Answer

Microsoft 365 Copilot

Answer

Exchange Online archival mailboxes

Question 12

Which three options describe key capabilities of Microsoft Purview that help organizations manage compliance and data governance in Microsoft 365? (Choose three.)

Accepted Answer

Apply retention policies and labels to preserve or delete content based on legal requirements. Microsoft Purview provides integrated data governance and compliance capabilities across Microsoft 365. It automatically classifies and labels sensitive data using trainable classifiers and exact data match, applies retention policies and labels to meet legal and regulatory requirements, and enables eDiscovery searches with legal hold to preserve content for litigation. These three capabilities directly address data classification, lifecycle management, and legal discovery.

Answer

Monitor network traffic to prevent DDoS attacks

Answer

Provide anti-malware and phishing protection in email

Answer

Manage user passwords and enforce multi-factor authentication

Question 13

Which four of the following are key components of the Microsoft 365 defense-in-depth security strategy? (Choose all that apply. There are four correct answers.)

Accepted Answer

Physical security of datacenters, including biometric access controls and 24/7 monitoring.. The Microsoft 365 defense-in-depth strategy relies on multiple layers of security controls. Physical security of datacenters (biometric access, 24/7 monitoring) is the foundational layer. User identity protection via Azure AD MFA and Conditional Access secures the authentication layer. Data encryption at rest (BitLocker) and in transit (TLS) protects data confidentiality. Advanced Threat Protection (ATP) for email, SharePoint, and Teams defends against malware and phishing at the workload layer. These four components collectively implement a layered security model.

Answer

Unrestricted access for Microsoft engineers to all customer data for continuous security scanning.

Answer

Automated rollback of all user changes to previous versions within 24 hours.

Question 14

Drag and drop the steps to deploy Microsoft 365 Apps for enterprise to a Windows device using the Microsoft 365 Apps admin center into the correct order.

Question 15

Drag and drop the steps to configure a data loss prevention (DLP) policy in the Microsoft 365 compliance center into the correct order.