MS-900 Describe security, compliance, privacy, and trust in Microsoft 365 — Timed 25 Questions

Question 1

An organization is concerned about data leakage from sensitive emails. They want to enforce encryption on emails containing financial information automatically. Which Microsoft 365 solution should they configure?

25 minute time limit — choose an answer to begin.

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (Option B) is the correct solution because it enables organizations to send and receive encrypted email messages, and it can be configured with mail flow rules to automatically encrypt emails containing sensitive financial information. This service leverages Azure Rights Management (Azure RMS) to provide persistent protection that follows the email, ensuring only authorized recipients can decrypt and read the content.

Answer

Data Loss Prevention (DLP) policies

Answer

Microsoft Purview Information Protection (Microsoft Purview Information Protection)

Answer

Exchange Online Protection (EOP)

Question 2

A company needs to ensure that all email and document content is preserved for legal purposes, even if users permanently delete items. This requirement demands that content be kept indefinitely until the legal hold is released. Which Microsoft 365 feature should they enable?

Accepted Answer

eDiscovery. eDiscovery allows you to place an eDiscovery hold on all content locations, including Exchange mailboxes and SharePoint/OneDrive sites, preserving all items indefinitely until the hold is removed. Litigation hold is limited to mailboxes. Retention policies can also preserve content but are not specifically designed for legal hold with manual release.

Answer

Retention policy

Answer

Litigation hold

Answer

Data Loss Prevention (DLP)

Question 3

A healthcare organization must protect patient health information (PHI) from being accidentally shared externally via email. They need to automatically block emails containing medical record numbers from being sent outside the organization and also encrypt any email that does contain PHI when it is allowed. Which two Microsoft Purview solutions should they combine? (Choose two.)

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) detects sensitive data such as medical record numbers and can apply actions to block external transmission when needed. For cases where PHI is allowed to be sent, DLP can enforce encryption by integrating with Microsoft Purview Message Encryption, which secures the email for external recipients. Therefore, both DLP and Message Encryption are required: DLP for detection and policy enforcement, and Message Encryption for the actual encryption of allowed emails.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit (Standard)

Question 4

A company wants to ensure that only IT administrators can install browser extensions in Microsoft Edge. Which Microsoft 365 security feature should be used?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct choice because it provides mobile device management (MDM) and mobile application management (MAM) capabilities that allow administrators to configure Microsoft Edge settings via configuration profiles. Specifically, Intune can enforce the 'Installation of browser extensions' policy to restrict extension installation to IT administrators only, using the Administrative Templates for Edge within the Settings Catalog.

Answer

Conditional Access

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID Identity Protection

Question 5

A compliance officer wants to ensure that all data in Microsoft 365 is encrypted using a key that the organization manages and stores in their own Azure Key Vault. Microsoft will not have access to the key. Which solution should they implement?

Accepted Answer

Double Key Encryption (DKE). Double Key Encryption (DKE) protects specific files using two keys: one in Azure Key Vault and one managed by Microsoft. It is not a tenant-wide encryption solution. For encrypting all Microsoft 365 data with a key that Microsoft cannot access, Microsoft 365 Customer Key is the appropriate feature, but it is not among the options.

Answer

Customer Lockbox

Answer

Information Rights Management (IRM)

Answer

Microsoft Purview Data Lifecycle Management

Question 6

A security administrator needs to ensure that all users accessing Microsoft 365 resources from unmanaged devices are prompted to sign in using multi-factor authentication (MFA) and are blocked from downloading sensitive files. Which conditional access policy should be configured?

Accepted Answer

Conditional Access policy with device compliance and session controls. A Conditional Access policy with device compliance and session controls allows the administrator to require MFA for sign-ins from unmanaged devices and use session controls (e.g., Microsoft Defender for Cloud Apps session policies) to block downloading sensitive files. This policy targets specific conditions (unmanaged devices) and applies granular access controls, meeting both requirements precisely.

Answer

Require MFA for all users

Answer

Block access from unknown locations

Answer

App protection policies

Question 7

A security administrator needs to ensure that all guest users who access Microsoft Teams are required to accept a terms of use agreement before accessing any company resources. Which Microsoft 365 identity protection feature should they configure?

Accepted Answer

Terms of Use in Microsoft Entra ID. Microsoft Entra ID Terms of Use is the specific feature designed to present a terms-of-use agreement to users before they can access resources. When combined with a Conditional Access policy that targets guest users and requires acceptance of the terms, it ensures that guests must accept the agreement before accessing Microsoft Teams or any other company resource.

Answer

Conditional Access policy with session control

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management

Question 8

A company wants to ensure that all administrative actions in Microsoft 365 are logged and that any changes to roles and permissions are reviewed on a monthly basis. Which Microsoft Purview solution should the compliance team use?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is the correct solution because it provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions. PIM also generates audit logs for role activations and changes, and supports periodic access reviews (e.g., monthly reviews of role assignments) through Microsoft Entra ID access reviews, directly meeting the requirement to review changes to roles and permissions on a monthly basis.

Answer

Audit (Standard)

Answer

Audit (Premium)

Answer

Privileged Access Management

Question 9

A multinational corporation must ensure that all Microsoft 365 admin actions—such as adding a new user or changing a role—are recorded and searchable for at least 90 days. They also need to create custom alert rules to notify the security team when critical events occur, like disabling multi-factor authentication. Which Microsoft Purview solution should they use to meet both requirements?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides 1-year default retention and includes high-value events such as disabling MFA, which are not recorded in Standard. While Standard retains logs for 90 days, it does not capture the critical event mentioned, so it fails the requirement. Custom alert policies are available in both Standard and Premium, but Premium is needed for alerts on high-value events.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft 365 Defender portal

Question 10

A security analyst receives an alert about a user who downloaded a large number of files from a SharePoint document library in a short period. The analyst needs to investigate the user's activities across Exchange, SharePoint, and Teams to determine if data exfiltration is occurring. Which Microsoft Purview solution should the analyst use to review detailed activity logs?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) provides detailed, searchable activity logs for user actions across Exchange, SharePoint, and Teams, including file downloads, access events, and admin operations. The analyst can use the Audit log search to filter by user, date range, and activity type (e.g., 'FileDownloaded') to identify potential data exfiltration patterns. Audit (Premium) also offers longer retention (up to 1 year by default, extendable to 10 years) and higher-bandwidth APIs for large-scale investigations.

Answer

Microsoft Purview eDiscovery (Premium)

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention (DLP)

Question 11

A security administrator needs to review all sign-in attempts and identify suspicious login patterns for the past 30 days. Which Microsoft 365 portal should they use to access this information?

Accepted Answer

Microsoft Entra ID sign-in logs. Microsoft Entra ID sign-in logs provide a detailed record of all sign-in attempts, including successful and failed logins, IP addresses, applications used, and risk detections. This data can be filtered and analyzed to identify suspicious patterns such as multiple failed attempts or sign-ins from unusual locations over the past 30 days, making it the correct choice for a security administrator.

Answer

Microsoft Purview compliance portal

Answer

Microsoft 365 admin center

Answer

Microsoft Defender for Cloud Apps

Question 12

A security team needs to monitor all administrative activities in Microsoft 365, including creating users, resetting passwords, and modifying policies. They require that logs be retained for at least 90 days and want to create custom alerts for suspicious admin actions (e.g., multiple password resets in a short time). Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides extended log retention of up to one year (or more with add-ons), which meets the 90-day requirement, and it supports custom alert policies via the Microsoft 365 Defender portal to detect suspicious admin activities like multiple password resets. Standard Audit only retains logs for 90 days but lacks the advanced alerting and investigation capabilities needed for custom alerts on admin actions.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID reporting

Question 13

A help desk lead is documenting the correct Microsoft 365 approach to require users to approve sign-ins with a mobile app after entering a password. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Multifactor authentication (MFA). Multifactor authentication (MFA) is the correct capability because it requires users to provide a second form of verification—such as approving a sign-in via the Microsoft Authenticator mobile app—after entering their password. This aligns with the security best practice of 'something you know' (password) plus 'something you have' (mobile device approval), which is a core MFA scenario in Microsoft Entra ID (formerly Azure AD).

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 14

A compliance-aware administrator is selecting the right Microsoft 365 capability to require MFA only for sign-ins from outside trusted locations. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Conditional Access. Conditional Access is the correct Microsoft 365 capability because it allows administrators to create policies that enforce MFA based on specific conditions, such as sign-in location. By configuring a Conditional Access policy with a 'location' condition that includes trusted IP ranges (defined via named locations), you can require MFA only when users sign in from outside those trusted locations. This directly addresses the requirement for location-aware MFA enforcement without affecting sign-ins from trusted networks.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 15

A department head asks which Microsoft 365 option should be used to provide a cloud identity platform for Microsoft 365 and approved SaaS applications. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure Active Directory) is the correct choice because it is the cloud-based identity and access management service that provides authentication, single sign-on (SSO), and conditional access for Microsoft 365 and thousands of pre-integrated SaaS applications. It acts as the identity platform, managing user identities and controlling access to resources, which directly aligns with the department head's requirement for a cloud identity platform.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 16

An administrator is reviewing a request from users who need to detect risky users and suspicious sign-ins. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection is the correct choice because it is specifically designed to detect risky users and suspicious sign-ins by analyzing signals such as leaked credentials, anonymous IP addresses, and atypical travel patterns. It uses risk-based conditional access policies to automatically block or require multi-factor authentication for high-risk sign-ins, directly addressing the administrator's requirement.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 17

During a Microsoft 365 planning workshop, let users reset forgotten passwords without calling the help desk. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Self-service password reset (SSPR). Self-service password reset (SSPR) is the correct Microsoft 365 capability because it allows users to reset their own forgotten passwords without requiring help desk intervention. SSPR is part of Microsoft Entra ID (formerly Azure Active Directory) and enforces security through multi-factor authentication verification before allowing a password change. This directly addresses the requirement to reduce help desk calls while maintaining identity security.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 18

A business stakeholder asks how Microsoft 365 can help them manage laptops and mobile devices with compliance policies and app protection. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct answer because it is a cloud-based endpoint management solution that provides mobile device management (MDM) and mobile application management (MAM) capabilities. It allows administrators to enforce compliance policies (e.g., require PIN, encrypt device) and app protection policies (e.g., restrict copy/paste, prevent data leakage) on laptops and mobile devices, directly addressing the stakeholder's request.

Answer

Microsoft Stream

Answer

Microsoft Planner

Answer

Microsoft Forms

Question 19

While preparing a Microsoft 365 adoption plan, a consultant is asked to protect corporate data inside mobile apps without enrolling the whole personal device. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

App protection policies / Mobile Application Management (MAM). App protection policies (APP), also known as Mobile Application Management (MAM), allow administrators to protect corporate data within mobile apps—such as enforcing encryption, preventing copy/paste, or requiring PIN—without enrolling the entire personal device into management. This is the correct capability because it separates data-level controls from device-level management, meeting the requirement to protect corporate data without full device enrollment.

Answer

Microsoft Planner

Answer

Microsoft Forms

Answer

Microsoft Stream

Question 20

A service owner is comparing Microsoft 365 capabilities and needs to block emails containing credit card numbers from being sent externally. Microsoft security, identity, or compliance capability should it use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft 365 is the correct capability because it is specifically designed to detect and protect sensitive information, such as credit card numbers, by scanning email content and attachments. DLP policies can be configured to block external transmission of emails containing sensitive data, using built-in sensitive information types like the Credit Card Number rule that matches patterns based on Luhn checksum validation. This directly addresses the service owner's requirement to prevent credit card numbers from being sent externally.

Answer

Microsoft Planner

Answer

Microsoft Stream

Answer

Microsoft Forms