MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 — Timed 15 Questions

Question 1

An organization is concerned about data leakage from sensitive emails. They want to enforce encryption on emails containing financial information automatically. Which Microsoft 365 solution should they configure?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (Option B) is the correct solution because it enables organizations to send and receive encrypted email messages, and it can be configured with mail flow rules to automatically encrypt emails containing sensitive financial information. This service leverages Azure Rights Management (Azure RMS) to provide persistent protection that follows the email, ensuring only authorized recipients can decrypt and read the content.

Answer

Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Information Protection (Microsoft Purview Information Protection)

Answer

Exchange Online Protection (EOP)

Question 2

A financial services company must prevent users from accidentally sharing sensitive customer data externally. They want to block sharing of any document containing a credit card number via email or SharePoint. What combination of Microsoft 365 compliance solutions should they use?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and block the sharing of sensitive information, such as credit card numbers, across email (Exchange Online) and SharePoint. By scanning content for predefined sensitive info types (e.g., credit card numbers using regex patterns from the DLP engine), DLP can automatically block or warn users before external sharing occurs, meeting the company's requirement.

Answer

Sensitivity labels and Microsoft Purview Information Protection (Microsoft Purview Information Protection)

Answer

Microsoft Purview Compliance Manager

Answer

Exchange Online Protection (EOP) and Microsoft Defender for Microsoft 365

Question 3

A company needs to ensure that all email and document content is preserved for legal purposes, even if users permanently delete items. This requirement demands that content be kept indefinitely until the legal hold is released. Which Microsoft 365 feature should they enable?

Accepted Answer

Litigation hold. Litigation hold is the correct feature because it preserves all mailbox and document content in its original state indefinitely until the hold is explicitly released. Unlike a retention policy, which can delete content after a specified period, Litigation hold ensures that even permanently deleted items are retained in the Recoverable Items folder, meeting the legal preservation requirement.

Answer

Retention policy

Answer

eDiscovery

Answer

Data Loss Prevention (DLP)

Question 4

A healthcare organization must protect patient health information (PHI) from being accidentally shared externally via email. They need to automatically block emails containing medical record numbers from being sent outside the organization and also encrypt any email that does contain PHI when it is allowed. Which two Microsoft Purview solutions should they combine? (Choose two.)

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is correct because it can automatically detect sensitive data, such as medical record numbers (PHI), in emails and apply policy actions like blocking external transmission. This directly addresses the requirement to prevent accidental sharing of PHI via email.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit (Standard)

Question 5

A healthcare organization stores patient records in SharePoint Online. They need to ensure that the data is encrypted at rest and in transit. Which statement is true regarding Microsoft 365 encryption?

Accepted Answer

Microsoft provides default encryption for data at rest and in transit.. Microsoft 365 provides default encryption for data at rest and in transit across all workloads, including SharePoint Online, Exchange Online, and OneDrive for Business. For data at rest, Microsoft uses BitLocker Drive Encryption and service-side encryption with per-file keys, while data in transit is secured using TLS 1.2+ and IPSec. This means the healthcare organization's patient records in SharePoint Online are automatically encrypted without any manual configuration.

Answer

Customers must enable encryption at rest manually for each workload.

Answer

Encryption only applies to Exchange Online, not SharePoint or OneDrive.

Answer

Encryption is optional and can be turned off if a customer chooses.

Question 6

A company uses Microsoft Purview to monitor for potential data security incidents. They want to automatically detect and remediate activities like downloading large amounts of data to a personal device. Which solution should they configure?

Accepted Answer

Insider Risk Management. Insider Risk Management is the correct solution because it is specifically designed to detect and remediate risky user activities that could lead to data security incidents, such as downloading large amounts of data to a personal device. It uses machine learning and behavioral analytics to identify anomalous patterns and can trigger automated remediation actions like blocking the activity or notifying the user.

Answer

Data Loss Prevention (DLP)

Answer

Audit

Answer

eDiscovery

Question 7

A company wants to ensure that only IT administrators can install browser extensions in Microsoft Edge. Which Microsoft 365 security feature should be used?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct choice because it provides mobile device management (MDM) and mobile application management (MAM) capabilities that allow administrators to configure Microsoft Edge settings via configuration profiles. Specifically, Intune can enforce the 'Installation of browser extensions' policy to restrict extension installation to IT administrators only, using the Administrative Templates for Edge within the Settings Catalog.

Answer

Conditional Access

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID Identity Protection

Question 8

An administrator needs to monitor and investigate potential data breaches by reviewing detailed records of file access and sharing activities across Microsoft 365. They require a centralized report showing who accessed what, from where, and any unusual patterns. Which tool should they use?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) is the correct tool because it provides a centralized, searchable log of all file access and sharing activities across Microsoft 365 services, including who accessed what, from which IP address, and when. This allows administrators to detect and investigate unusual patterns indicative of data breaches by reviewing detailed audit records.

Answer

Microsoft 365 Defender

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Secure Score

Question 9

A compliance officer wants to ensure that all data in Microsoft 365 is encrypted using a key that the organization manages and stores in their own Azure Key Vault. Microsoft will not have access to the key. Which solution should they implement?

Accepted Answer

Double Key Encryption (DKE). Double Key Encryption (DKE) is the correct solution because it allows an organization to use their own key stored in Azure Key Vault for encrypting sensitive Microsoft 365 data, while ensuring that Microsoft cannot access the key. With DKE, the encryption key is split into two parts: one managed by Microsoft and one managed by the customer in their own Azure Key Vault, so both parties must be compromised to decrypt the data. This meets the compliance officer's requirement for exclusive control over the encryption key.

Answer

Customer Lockbox

Answer

Information Rights Management (IRM)

Answer

Microsoft Purview Data Lifecycle Management

Question 10

A security administrator needs to ensure that all users accessing Microsoft 365 resources from unmanaged devices are prompted to sign in using multi-factor authentication (MFA) and are blocked from downloading sensitive files. Which conditional access policy should be configured?

Accepted Answer

Conditional Access policy with device compliance and session controls. Option D is correct because a Conditional Access policy with device compliance and session controls allows the administrator to require MFA for sign-ins from unmanaged devices and use session controls (e.g., Microsoft Defender for Cloud Apps session policies) to block downloading sensitive files. This policy targets specific conditions (unmanaged devices) and applies granular access controls, meeting both requirements precisely.

Answer

Require MFA for all users

Answer

Block access from unknown locations

Answer

App protection policies

Question 11

A security administrator needs to ensure that all guest users who access Microsoft Teams are required to accept a terms of use agreement before accessing any company resources. Which Microsoft 365 identity protection feature should they configure?

Accepted Answer

Terms of Use in Microsoft Entra ID. Option C is correct because Microsoft Entra ID Terms of Use is the specific feature designed to present a terms-of-use agreement to users before they can access resources. When combined with a Conditional Access policy that targets guest users and requires acceptance of the terms, it ensures that guests must accept the agreement before accessing Microsoft Teams or any other company resource.

Answer

Conditional Access policy with session control

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management

Question 12

A company wants to ensure that all administrative actions in Microsoft 365 are logged and that any changes to roles and permissions are reviewed on a monthly basis. Which Microsoft Purview solution should the compliance team use?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is the correct solution because it provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions. PIM also generates audit logs for role activations and changes, and supports periodic access reviews (e.g., monthly reviews of role assignments) through Microsoft Entra ID access reviews, directly meeting the requirement to review changes to roles and permissions on a monthly basis.

Answer

Audit (Standard)

Answer

Audit (Premium)

Answer

Privileged Access Management

Question 13

A security administrator needs to audit all activities related to a specific user in Exchange Online, SharePoint Online, and Microsoft Entra ID for the past 90 days. They also need to export the audit log as a CSV file. Which Microsoft Purview solution provides this capability without additional licensing beyond Microsoft 365 E3?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) is included with Microsoft 365 E3 and provides the ability to search and export audit logs for user activities across Exchange Online, SharePoint Online, and Microsoft Entra ID for up to 90 days. This meets the administrator's requirement without needing additional licensing.

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Content Search

Question 14

A multinational corporation must ensure that all Microsoft 365 admin actions—such as adding a new user or changing a role—are recorded and searchable for at least 90 days. They also need to create custom alert rules to notify the security team when critical events occur, like disabling multi-factor authentication. Which Microsoft Purview solution should they use to meet both requirements?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides 1-year default retention of audit logs (extendable to 10 years) and supports custom alert policies that trigger notifications when specific events occur, such as disabling multi-factor authentication. Standard Audit only retains logs for 90 days and lacks the ability to create custom alert rules, making Premium the only option that satisfies both requirements.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft 365 Defender portal

Question 15

A company uses Microsoft 365 (a SaaS offering). A security incident occurs where an employee's account is compromised because the employee reused their corporate password on a personal website. According to the shared responsibility model, who is primarily responsible for this security failure?

Accepted Answer

The customer (the company using Microsoft 365). In the Microsoft 365 shared responsibility model, the customer is responsible for securing user identities, including password hygiene and multi-factor authentication (MFA). Since the employee reused their corporate password on a personal website, this is a customer-side identity management failure, not a platform vulnerability. Microsoft secures the SaaS infrastructure, but customer-managed credentials fall under the customer's responsibility.

Answer

Microsoft, because they provide the SaaS platform

Answer

Both Microsoft and the customer share equal responsibility

Answer

It depends on the contract terms with Microsoft