MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 Practice Test 9 — 15 Questions

Question 1

A business stakeholder asks how Microsoft 365 can help them allow sign-in using biometrics or FIDO2 security keys. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID passwordless authentication. Microsoft Entra ID passwordless authentication (Option B) is the correct capability because it directly supports sign-in using biometrics (Windows Hello, Microsoft Authenticator) and FIDO2 security keys. This feature eliminates the need for passwords by leveraging public-key cryptography and the WebAuthn standard, aligning with the stakeholder's request for passwordless sign-in methods.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 2

While preparing a Microsoft 365 adoption plan, a consultant is asked to let users report suspicious phishing messages from Outlook for investigation. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Defender for Office 365 user submissions. Microsoft Defender for Office 365 user submissions (Option A) is the correct capability because it allows users to report suspicious phishing messages directly from Outlook, which are then routed to the Microsoft 365 Defender portal for investigation and analysis. This feature integrates with the built-in Report Message or Report Phishing add-ins, enabling security teams to review and act on user-reported threats within the unified security operations framework.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 3

A service owner is comparing Microsoft 365 capabilities and needs to make sign-in decisions based on risk, location, and device compliance. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Conditional Access policy. Conditional Access policy is the correct answer because it is the Microsoft Entra ID (formerly Azure AD) feature that enforces sign-in decisions based on risk, location, and device compliance. It allows administrators to create policies that require multi-factor authentication, block access from untrusted locations, or require compliant devices before granting access to Microsoft 365 resources.

Answer

Microsoft Forms

Answer

Microsoft Planner

Answer

Microsoft Stream

Question 4

During requirements gathering, an IT manager says the organization must make document protection persist after a file is downloaded or emailed. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption (via Microsoft Purview Information Protection) apply persistent protection that travels with the file — even after download or email — because the encryption and usage rights are embedded in the document itself. This ensures that protection persists regardless of where the file goes, satisfying the requirement.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 5

A help desk lead is documenting the correct Microsoft 365 approach to preserve relevant mailboxes and SharePoint content during a legal case. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Purview eDiscovery hold. Microsoft Purview eDiscovery hold is the correct capability because it allows organizations to place legal holds on mailboxes, SharePoint sites, and other content sources to preserve data relevant to a legal case. This ensures that content cannot be altered or deleted until the hold is released, meeting compliance and eDiscovery requirements.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Planner

Question 6

A compliance officer wants to proactively prevent users from sending emails that contain sensitive personal data (e.g., credit card numbers) to external recipients. When a user attempts to send such an email, they should see a policy tip explaining the restriction and be blocked from sending. Which Microsoft Purview feature should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policy is the correct feature because it is specifically designed to detect sensitive data (e.g., credit card numbers) in transit and enforce actions such as showing a policy tip and blocking the email. DLP policies use sensitive information types (e.g., Credit Card Number) and conditions to inspect email content in Exchange Online, triggering a block action with an end-user notification when a match occurs.

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Communication Compliance

Question 7

A compliance officer needs to ensure that all user activities related to sensitive data in Microsoft 365 are recorded and available for forensic investigation. They require detailed logs of who accessed specific files in SharePoint Online, including attempts to access files that were blocked by DLP policies. Which solution should they enable?

Accepted Answer

Microsoft 365 Audit Log. Microsoft 365 Audit Log (Unified Audit Log) is the correct solution because it captures detailed records of user activities, including file access in SharePoint Online and blocked DLP policy actions. These logs are retained for forensic investigation and can be searched via the Microsoft 365 Purview compliance portal or accessed programmatically.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Activity Explorer

Answer

Microsoft 365 Defender

Question 8

An organization needs to automatically delete Microsoft Teams chat messages after 90 days to comply with a data minimization policy. Which Microsoft Purview feature should they use?

Accepted Answer

Retention policies. Retention policies in Microsoft Purview are designed to either retain data for a specified period, delete it after that period, or both. For Microsoft Teams chat messages, a retention policy can be configured to automatically delete messages after 90 days, directly supporting a data minimization policy. This is the correct feature because it provides time-based deletion for compliance requirements.

Answer

Data Loss Prevention (DLP)

Answer

Communication Compliance

Answer

Information Barriers

Question 9

A company must comply with a regulation that requires all data stored in Microsoft 365 to remain within the European Union. Which Microsoft 365 feature should an administrator configure to enforce this geographic restriction?

Accepted Answer

Data Residency policies. Data Residency policies in Microsoft 365 allow administrators to define the geographic location where data at rest is stored. By configuring a Data Residency policy for the European Union, the administrator ensures that all data remains within EU data centers, meeting regulatory requirements.

Answer

Data Loss Prevention (DLP)

Answer

Information Rights Management (IRM)

Answer

Customer Lockbox

Question 10

A compliance officer wants to automatically encrypt outgoing emails containing credit card numbers and also prevent recipients from forwarding or copying the content. Which Microsoft Purview solution should be applied?

Accepted Answer

Sensitivity label with encryption and rights management. Sensitivity labels with encryption and rights management (Azure Rights Management) allow you to apply persistent protection that encrypts the email and restricts actions like forwarding, copying, or printing. This meets both requirements: automatic detection of credit card numbers via auto-labeling policies and enforcement of usage restrictions through Rights Management templates (e.g., Do Not Forward).

Answer

Data Loss Prevention (DLP) policy with encryption

Answer

Microsoft Information Bar

Answer

Azure Information Protection unified labeling client

Question 11

An organization wants to prevent employees from sharing sensitive files with external users via SharePoint Online, but they need to allow sharing with a specific external partner for a single project. What is the most efficient configuration?

Accepted Answer

Disable external sharing at the tenant level and enable it only for the specific project site. It allows the organization to disable external sharing globally at the tenant level via the SharePoint admin center, which prevents all users from sharing with external users by default. Then, by enabling external sharing only for the specific project site (site-level override), the organization can grant the necessary access to the external partner while maintaining the broad restriction. This is the most efficient approach because it uses a single configuration change at the tenant level and a targeted exception at the site level, avoiding complex policies or labels.

Answer

Change the default sharing link type to 'Specific people' and add the partner's domain to an allow list

Answer

Apply sensitivity labels with encryption to all files

Answer

Configure a DLP policy to block external sharing except for the partner domain

Question 12

A compliance officer needs to set up a policy that automatically monitors and detects activities related to accessing sensitive data from outside the corporate network. When a user from a foreign country accesses a confidential file, the policy should trigger an alert and require additional authentication. Which combination of Microsoft 365 solutions achieves this?

Accepted Answer

Microsoft Purview Data Loss Prevention and Conditional Access. Microsoft Purview Data Loss Prevention (DLP) monitors and detects sensitive data access from outside the corporate network, while Conditional Access enforces additional authentication (e.g., MFA) when such access is detected. Together, they meet the requirement for automatic alerting and step-up authentication based on location and data sensitivity.

Answer

Microsoft Purview Audit (Standard) and Microsoft Entra ID Identity Protection

Answer

Microsoft Purview Insider Risk Management and Microsoft Cloud App Security

Answer

Microsoft Purview eDiscovery and Privileged Identity Management

Question 13

A company wants to ensure that all outgoing emails containing sensitive financial data are encrypted automatically. The encryption should require the recipient to authenticate to read the message. Which Microsoft 365 solution should the administrator configure?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (MPME) is the correct solution because it allows organizations to send encrypted emails that require recipients to authenticate (via a Microsoft account or a one-time passcode) before they can read the message. This directly meets the requirement for automatic encryption of outgoing emails with sensitive financial data and recipient authentication.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Insider Risk Management

Question 14

A compliance officer needs to automatically detect when employees share customers' personal data (e.g., social security numbers) via email and block such sharing. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to identify, monitor, and automatically protect sensitive data—such as social security numbers—across Microsoft 365 services, including Exchange Online. DLP policies can be configured with conditions that detect sensitive information types (e.g., U.S. Social Security Number) in email messages and apply actions like blocking the email from being sent. This directly meets the compliance officer's requirement to automatically detect and block sharing of customers' personal data via email.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 15

A security administrator needs to automatically restrict access to documents labeled as 'Highly Confidential' when accessed from devices that are not joined to the domain. The restriction should block editing and printing, and apply encryption. Which combination of Microsoft 365 solutions should the administrator use?

Accepted Answer

Microsoft Purview Information Protection + Microsoft Entra ID Conditional Access. Microsoft Purview Information Protection (MIP) allows you to create sensitivity labels that apply encryption, restrict editing, and block printing on documents. Microsoft Entra ID Conditional Access can then enforce that these labels are automatically applied based on device compliance (e.g., devices not joined to the domain). Together, they provide the automated, policy-driven restriction described.

Answer

Microsoft Purview Data Loss Prevention + Microsoft Entra ID Identity Protection

Answer

Microsoft Defender for Office 365 + Microsoft 365 Business Premium

Answer

Microsoft Purview Audit + Microsoft Entra ID Privileged Identity Management