MS-900 Hard Questions — 25 Difficult Questions

Question 1

A multinational organization with 5,000 users currently has Microsoft 365 E3 licenses. They need to meet a regulatory requirement that all user activity logs must be retained for 7 years. They also require the ability to place litigation holds on all mailboxes. Which licensing approach meets the compliance requirements at the lowest additional cost?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add Microsoft 365 E5 Compliance add-on for all users. The Microsoft 365 E5 Compliance add-on provides the required 7-year audit log retention (via Unified Audit Log retention policies) and litigation hold capabilities for mailboxes, without upgrading the entire license to E5. This add-on is the most cost-effective way to meet these specific compliance needs for all 5,000 users while retaining their existing E3 base licenses. Option C is incorrect because the Microsoft 365 E5 eDiscovery and Audit add-on does not include the required 7-year audit log retention and litigation hold; these are provided by the E5 Compliance add-on.

Answer

Upgrade all users to Microsoft 365 E5

Answer

Add Microsoft 365 E5 eDiscovery and Audit add-on for all users

Answer

Add Microsoft 365 Communications Compliance add-on for all users

Question 2

A company is deploying Microsoft 365 Copilot and wants to ensure that only users with the appropriate sensitivity labels can access Copilot-generated content. What should the administrator configure to enforce this requirement?

Accepted Answer

Enable auto-labeling for sensitivity labels in Microsoft Purview Information Protection. Auto-labeling for sensitivity labels in Microsoft Purview Information Protection can automatically apply sensitivity labels based on content classification, and Copilot-generated content will respect these labels, ensuring only authorized users can access it. Option A is wrong because retention labels manage data retention, not access control. Option B is wrong because Conditional Access policies control access to apps and resources but do not automatically label content. Option C is wrong because DLP policies prevent data sharing but do not enforce sensitivity labeling on content.

Answer

Create a retention label policy in Microsoft Purview

Answer

Create a Conditional Access policy in Microsoft Entra ID

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview

Question 3

Your organization has a Microsoft 365 E5 subscription and wants to centrally manage security incidents across identities, endpoints, and cloud apps. Which Microsoft solution provides this capability?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (formerly Microsoft 365 Defender) centrally correlates security signals across identities, endpoints, cloud apps, and email to provide a unified incident management experience. Option A (Microsoft Entra ID Protection) focuses only on identity risks. Option B (Microsoft Sentinel) is a SIEM/SOAR solution that ingests logs from many sources but is not the primary tool for cross-domain incident management within Microsoft 365. Option D (Microsoft Defender for Endpoint) is limited to endpoint detection and response. Therefore, option C is the correct answer.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 4

Which THREE capabilities are provided by Microsoft Purview Information Protection? (Choose three.)

Accepted Answer

Auto-classify content based on sensitive data types. Auto-classification based on sensitive data types (A), applying sensitivity labels to documents and emails (B), and encrypting documents and controlling access using labels (C) are the three core capabilities of Microsoft Purview Information Protection. Option D (blocking sharing) is part of Data Loss Prevention (DLP), and option E (retention policies) is part of Purview Records Management.

Answer

Block sharing of sensitive data via email

Answer

Define retention policies for mailboxes

Question 5

You are the security administrator for Contoso, a global consulting firm with 10,000 employees. Contoso uses Microsoft 365 E5 and Microsoft Entra ID P2. The company has a strict policy that all sensitive client data must be encrypted at rest and in transit. Additionally, the legal team requires that any document labeled as 'Highly Confidential' must be automatically encrypted and cannot be printed or forwarded. You have created a sensitivity label called 'Highly Confidential' with encryption and a protection setting that restricts actions like printing. However, you notice that users are still able to print documents that have the label applied. After investigation, you find that the label is correctly configured but users are manually applying the label. What should you do to ensure the label is consistently applied and printing is blocked?

Accepted Answer

Create an auto-labeling policy that automatically applies the 'Highly Confidential' label to documents that contain certain sensitive information types, and ensure the label's protection settings block printing.. Auto-labeling policies automatically apply the 'Highly Confidential' label to documents containing specified sensitive information types, ensuring consistent labeling. Once applied, the label's built-in protection settings block printing. Option A is incorrect because DLP policies can block printing but do not apply sensitivity labels. Option B is incorrect because Conditional Access controls access to resources, not document-level actions like printing. Option C is incorrect because the label already has encryption; the issue is manual application, not encryption settings.

Answer

Create a Data Loss Prevention (DLP) policy that blocks printing of documents with the 'Highly Confidential' label.

Answer

Configure a Conditional Access policy that blocks printing for users accessing documents from unmanaged devices.

Answer

Modify the sensitivity label's encryption settings to require user authentication before printing.

Question 6

Which THREE statements about Microsoft Purview Audit (Standard) are true? (Choose three.)

Accepted Answer

Users must be assigned an appropriate license to view audit logs. Audit (Standard) retains logs for 90 days (B), includes Exchange admin actions (E), and requires appropriate permissions (A). Option D (180 days) is for Audit (Premium). Option C (all SharePoint events) is also Premium.

Answer

All SharePoint and OneDrive events are audited by default

Answer

Audit records are retained for 180 days by default

Question 7

A company is deploying Microsoft 365 Copilot and wants to ensure that prompts and responses are not used to train the underlying AI models. Which setting must be configured?

Accepted Answer

Configure data boundary for Copilot to 'No training'. The 'Data boundary for Copilot' setting, when configured to 'No training', explicitly prevents Microsoft from using prompts and responses from Microsoft 365 Copilot to train or improve its underlying AI models. This setting ensures that organizational data remains within the tenant's data boundary and is not used for model retraining, addressing data privacy and compliance requirements.

Answer

Enable Customer Key for Copilot

Answer

Assign Copilot licenses to users

Answer

Enable audit logging for Copilot interactions

Question 8

Which THREE of the following are benefits of the Microsoft 365 E5 license compared to E3?

Accepted Answer

Power BI Pro. Power BI Pro is included with Microsoft 365 E5 but not with E3, enabling advanced data visualization and analytics capabilities. This is a key differentiator for organizations requiring self-service business intelligence tools integrated with Microsoft 365.

Answer

Exchange Online

Answer

Microsoft Entra ID P1

Question 9

A company uses Microsoft 365 E5 and wants to implement a zero-trust security model. They need to ensure that all external file sharing requires multi-factor authentication (MFA) and that sensitive documents are automatically labeled. Which combination of services should they use?

Accepted Answer

Microsoft Entra Conditional Access and Microsoft Purview Information Protection. Microsoft Entra Conditional Access can enforce MFA for external file sharing by requiring MFA as a condition for accessing SharePoint/OneDrive resources. Microsoft Purview Information Protection provides automatic sensitivity labeling for documents based on content or context, ensuring sensitive data is labeled without manual intervention. Together, these services directly address the zero-trust requirements of MFA for external sharing and automatic document labeling.

Answer

Microsoft Defender XDR and Microsoft Purview Audit

Answer

Microsoft Intune and Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Cloud Apps and Microsoft Purview Data Lifecycle Management

Question 10

Your organization uses Microsoft 365 and wants to ensure that only managed devices can access corporate email in Exchange Online. Which conditional access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy integrates with Microsoft Intune to enforce that only devices meeting compliance policies (e.g., encryption, OS version, jailbreak detection) can access Exchange Online. This ensures corporate email is accessible only from managed, trusted devices, directly addressing the requirement.

Answer

Require approved client app

Answer

Require device to be joined to Azure AD

Answer

Require multi-factor authentication

Question 11

A company uses Microsoft Forms to collect customer feedback. They want to automatically analyze sentiment from the responses using AI. Which Microsoft 365 service can integrate with Forms for this purpose?

Accepted Answer

Power Automate. Power Automate (D) is the correct service because it can connect Microsoft Forms to Azure AI services (e.g., Azure Cognitive Services Text Analytics) to automatically analyze sentiment from form responses. When a new response is submitted, a Power Automate flow triggers, sends the response text to the AI sentiment analysis API, and stores or reports the result—all without manual intervention.

Answer

Power BI

Answer

SharePoint Online

Answer

Azure Logic Apps

Question 12

A healthcare provider must ensure that patient health information (PHI) is not accidentally shared outside the organization. They want to automatically detect if an email contains PHI (such as diagnosis codes) and block it from being sent externally. Additionally, the sender should receive a notification explaining the block. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive information—such as patient health information (PHI) with diagnosis codes—in emails and automatically block external transmission while sending a notification to the sender. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) and rules to enforce actions like blocking and policy tips.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Audit

Question 13

A company uses Microsoft 365 (a SaaS offering). A security incident occurs where an employee's account is compromised because the employee reused their corporate password on a personal website. According to the shared responsibility model, who is primarily responsible for this security failure?

Accepted Answer

The customer (the company using Microsoft 365). In the Microsoft 365 shared responsibility model, the customer is responsible for securing user identities, including password hygiene and multi-factor authentication (MFA). Since the employee reused their corporate password on a personal website, this is a customer-side identity management failure, not a platform vulnerability. Microsoft secures the SaaS infrastructure, but customer-managed credentials fall under the customer's responsibility.

Answer

Microsoft, because they provide the SaaS platform

Answer

Both Microsoft and the customer share equal responsibility

Answer

It depends on the contract terms with Microsoft

Question 14

An organization needs to enforce that all external emails are automatically encrypted before delivery to recipients. Which feature should they configure in Microsoft 365?

Accepted Answer

Exchange Online mail flow rules. Exchange Online mail flow rules (also known as transport rules) can be configured to automatically encrypt all external emails by applying Office 365 Message Encryption (OME) based on conditions such as recipient domain or sender address. This allows the organization to enforce encryption for all outbound messages without requiring user intervention, meeting the stated requirement.

Answer

S/MIME

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview sensitivity labels

Question 15

A company runs a legacy application that requires a fixed amount of dedicated hardware resources for compliance reasons. However, they want to benefit from cloud-based backup and disaster recovery to reduce on-premises hardware costs. Which cloud deployment model best aligns with this requirement?

Accepted Answer

Hybrid cloud. Hybrid cloud is correct because it allows the company to keep the legacy application on dedicated on-premises hardware for compliance, while leveraging cloud-based backup and disaster recovery services (e.g., Azure Backup and Azure Site Recovery) to reduce on-premises hardware costs. This model combines private cloud (or on-premises infrastructure) with public cloud resources, enabling data replication and failover to the cloud without migrating the application itself.

Answer

Public cloud

Answer

Private cloud

Answer

Community cloud

Question 16

A sales team uses SharePoint Online to store contract templates. When a new contract is added to a specific library, a notification should be sent to a Microsoft Teams channel with a direct link to the document. Additionally, the contract owner must receive a custom approval request via email before the document is shared externally. Which Microsoft 365 services must be combined to achieve this?

Accepted Answer

Microsoft Power Automate and Microsoft Teams. Microsoft Power Automate can trigger a flow when a new contract is added to a SharePoint Online library, sending a notification with a direct link to a Microsoft Teams channel. Additionally, Power Automate can initiate a custom approval request via email to the contract owner before external sharing is allowed. This combination directly addresses both requirements without needing additional services.

Answer

Microsoft Teams and Microsoft Power Apps

Answer

Microsoft Forms and Microsoft Teams

Answer

Microsoft Power BI and Microsoft Teams

Question 17

A multinational organization with 5,000 users currently has Microsoft 365 E3 licenses. They need to meet a regulatory requirement that all user activity logs must be retained for 7 years. They also require the ability to place litigation holds on all mailboxes. Which licensing approach meets the compliance requirements at the lowest additional cost?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft 365 E5 Compliance add-on. Microsoft 365 E5 Compliance add-on provides the required 7-year retention via retention policies and advanced eDiscovery (including predictive coding) without upgrading the entire E3 suite. This add-on is the most cost-effective way to meet regulatory retention and advanced search needs while keeping the existing E3 licensing.

Answer

Exchange Online Archiving for Exchange Online Plan 2

Answer

Microsoft 365 E5 (full suite upgrade)

Answer

Microsoft Purview Audit (Standard) add-on

Question 18

Which TWO Microsoft 365 compliance features are available in Microsoft Purview to help organizations manage and protect sensitive data?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (B) is correct because it enables organizations to govern their data through retention policies and retention labels, automatically retaining or deleting content based on regulatory requirements. Data Loss Prevention (DLP) (E) is correct because it identifies, monitors, and protects sensitive data across Microsoft 365 services (Exchange, SharePoint, OneDrive, Teams) by applying policies that prevent unauthorized sharing or leakage.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID Protection

Answer

Microsoft Defender XDR

Question 19

Which THREE Microsoft 365 services can be used to enforce data classification and protection?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (A) is correct because it acts as a Cloud Access Security Broker (CASB) that can enforce data classification and protection by applying policies to control data in transit and at rest across cloud applications. It can automatically classify sensitive data using built-in DLP engines and enforce actions like blocking downloads or applying encryption based on content inspection.

Answer

Microsoft Intune

Answer

Microsoft Entra ID

Question 20

A global organization with 20,000 users is running Microsoft 365 E5 licenses. Due to budget cuts, the CIO wants to reduce licensing costs by 20% while ensuring that all users still have access to Exchange Online, SharePoint, Teams, and OneDrive. The organization also needs to maintain compliance with industry regulations that require eDiscovery and retention policies. The security team is willing to give up advanced threat protection features like Microsoft Defender for Office 365 P2 and Microsoft Purview Data Loss Prevention. Which licensing strategy should the organization adopt?

Accepted Answer

Downgrade all users to Microsoft 365 E3. Microsoft 365 E3 includes Exchange Online, SharePoint, Teams, and OneDrive, and provides eDiscovery and retention policies via Microsoft Purview compliance features. Downgrading from E5 to E3 reduces licensing costs by approximately 20-30% per user while retaining the required core productivity and compliance capabilities, and removes advanced threat protection (Defender for Office 365 P2, DLP) that the security team is willing to give up.

Answer

Switch to Microsoft 365 F3 for all users

Answer

Keep E5 but remove all add-on licenses

Answer

Switch to Microsoft 365 Business Premium for all users