MS-900 Hard Questions — 25 Difficult Questions

Question 1

During requirements gathering, an IT manager says the organization must compare service models and identify where the customer manages the most layers. Cloud concept or benefit best matches this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Infrastructure as a Service (IaaS). The IT manager's requirement is to identify the service model where the customer manages the most layers. In Infrastructure as a Service (IaaS), the cloud provider manages only the physical infrastructure (servers, storage, networking), while the customer is responsible for managing the operating system, middleware, runtime, data, and applications. This gives the customer the highest degree of control and management responsibility compared to PaaS or SaaS.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

Hybrid cloud

Question 2

Your organization uses Microsoft 365 and wants to ensure that only managed devices can access corporate email in Exchange Online. Which conditional access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy integrates with Microsoft Intune to enforce that only devices meeting compliance policies (e.g., encryption, OS version, jailbreak detection) can access Exchange Online. This ensures corporate email is accessible only from managed, trusted devices, directly addressing the requirement.

Answer

Require approved client app

Answer

Require device to be joined to Azure AD

Answer

Require multi-factor authentication

Question 3

A healthcare provider must ensure that patient health information (PHI) is not accidentally shared outside the organization. They want to automatically detect if an email contains PHI (such as diagnosis codes) and block it from being sent externally. Additionally, the sender should receive a notification explaining the block. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive information—such as patient health information (PHI) with diagnosis codes—in emails and automatically block external transmission while sending a notification to the sender. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) and rules to enforce actions like blocking and policy tips.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Audit

Question 4

A company uses Microsoft 365 (a SaaS offering). A security incident occurs where an employee's account is compromised because the employee reused their corporate password on a personal website. According to the shared responsibility model, who is primarily responsible for this security failure?

Accepted Answer

The customer (the company using Microsoft 365). In the Microsoft 365 shared responsibility model, the customer is responsible for securing user identities, including password hygiene and multi-factor authentication (MFA). Since the employee reused their corporate password on a personal website, this is a customer-side identity management failure, not a platform vulnerability. Microsoft secures the SaaS infrastructure, but customer-managed credentials fall under the customer's responsibility.

Answer

Microsoft, because they provide the SaaS platform

Answer

Both Microsoft and the customer share equal responsibility

Answer

It depends on the contract terms with Microsoft

Question 5

A sales team uses Microsoft Lists to track leads. They want to create a real-time dashboard that shows the number of leads by stage, the total deal value, and the win rate. The dashboard must update automatically when the list is changed. Which Microsoft 365 app should they use to build this dashboard?

Accepted Answer

Microsoft Power BI. Microsoft Power BI is the correct choice because it is designed to create real-time, interactive dashboards that can connect directly to Microsoft Lists via the Power BI service or Power BI Desktop. It supports automatic data refresh when the underlying list changes, enabling live tracking of leads by stage, total deal value, and win rate without manual intervention.

Answer

Microsoft Excel

Answer

Microsoft SharePoint

Answer

Microsoft Power Automate

Question 6

Which THREE are key characteristics of cloud computing as defined by NIST?

Accepted Answer

Broad network access. The NIST SP 800-145 definition of cloud computing lists five essential characteristics, and three of them appear here: Broad network access (B), Resource pooling (C), and On-demand self-service (D). Broad network access (B) is correct because cloud capabilities must be available over the network through standard mechanisms that promote use by heterogeneous thin or thick client platforms such as mobile phones, laptops, and PDAs. Resource pooling (C) is correct because the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to demand. On-demand self-service (D) is correct because a consumer can unilaterally provision computing capabilities, such as server time and network storage, automatically without requiring human interaction with each service provider. The other two NIST characteristics not listed among the options are rapid elasticity and measured service. High availability (A) is a desirable quality attribute but is not one of the five NIST essential characteristics, and reserved capacity (E) describes a purchasing or pricing model rather than a defining characteristic of cloud computing.

Answer

High availability

Answer

Reserved capacity

Question 7

A global organization uses Microsoft 365 E5 and needs to securely share sensitive documents with external partners. The compliance officer requires that external users can view but not edit, print, or forward the documents, and access must expire after 30 days. Which combination of services should the admin use?

Accepted Answer

Microsoft Purview Information Protection with sensitivity labels and SharePoint Online. Microsoft Purview Information Protection with sensitivity labels can enforce 'View Only' permissions that prevent editing, printing, and forwarding, while SharePoint Online allows setting an expiration date for external access via sharing links. Together, they meet the compliance officer's requirements for granular document-level restrictions and time-bound access.

Answer

SharePoint Online External Sharing and Microsoft Entra B2B

Answer

Microsoft Entra B2B collaboration with Conditional Access

Answer

Microsoft Teams with guest access and sharing permissions

Question 8

Refer to the exhibit. An admin creates a Microsoft Purview Data Loss Prevention (DLP) policy rule as shown. When will the rule block access?

Accepted Answer

When a credit card number is detected with high confidence. The rule is configured with a condition that triggers when a credit card number is detected with a confidence level of 'high'. The action 'Block access' is set to execute when this condition is met. Therefore, the rule blocks access specifically when a credit card number is detected with high confidence, making option A correct.

Answer

When the document is shared externally

Answer

When any sensitive information type is detected

Answer

Never, because the rule is not applied to any location

Question 9

A multinational organization uses Microsoft 365 and wants to comply with data residency requirements. They need to ensure that data for European users stays within the European Union. Which Microsoft 365 feature should they configure?

Accepted Answer

Configure multi-geo capabilities in SharePoint Online and OneDrive.. Multi-Geo capabilities in SharePoint Online and OneDrive allow organizations to provision and store data at rest in specific geographic locations, such as the European Union, to meet data residency requirements. This feature enables tenant administrators to define a preferred data location for users, ensuring their content remains within the EU boundary.

Answer

Create retention policies for EU users.

Answer

Set conditional access policies to restrict access from outside EU.

Answer

Use data loss prevention policies to block data movement.

Question 10

A non-profit organization with 15 employees needs business-grade email, desktop versions of Office apps, and 1 TB of cloud storage per user. They are eligible for Microsoft's non-profit program. Which plan provides these features at the lowest cost?

Accepted Answer

Microsoft 365 Business Standard for Nonprofits. Microsoft 365 Business Standard for Nonprofits is the correct choice because it includes business-grade email (Exchange Online), desktop versions of Office apps (Word, Excel, PowerPoint, etc.), and 1 TB of OneDrive cloud storage per user, all at a significantly reduced cost (or free for qualifying organizations) under the nonprofit program. Business Basic only provides web and mobile Office apps, not desktop versions, and E3/Enterprise plans are more expensive and include advanced security and compliance features not required by this 15-employee organization.

Answer

Microsoft 365 Business Basic for Nonprofits

Answer

Microsoft 365 E3 for Nonprofits

Answer

Microsoft 365 Enterprise for Nonprofits

Question 11

An organization uses Microsoft 365 E5 licenses. Users report that Microsoft 365 Apps for enterprise (e.g., Word, Excel) are slow to open. The IT team considers deploying a cloud-based solution to improve performance. Which cloud service model should they use?

Accepted Answer

Software as a Service (SaaS). The organization is already using Microsoft 365 Apps for enterprise, which are delivered as a SaaS offering. To improve performance for slow-opening desktop apps, deploying a cloud-based solution means leveraging the same SaaS model—Microsoft 365 Apps are already SaaS. The issue is likely related to local installation or network latency, and using the web-based versions (also SaaS) or optimizing the existing SaaS delivery can help. Option B is correct because SaaS provides ready-to-use applications like Word and Excel via the cloud, eliminating local installation overhead.

Answer

Platform as a Service (PaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Function as a Service (FaaS)

Question 12

Your organization has a Microsoft 365 E5 subscription and wants to centrally manage security incidents across identities, endpoints, and cloud apps. Which Microsoft solution provides this capability?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (formerly Microsoft 365 Defender) is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications. It integrates signals from Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps into a single portal. This provides centralized security incident management across the specified domains.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 13

An organization needs to prevent users from sharing documents that contain credit card numbers via email and Microsoft Teams. When a user attempts to share such a document, they should see a policy tip explaining the restriction. Which Microsoft Purview solution should the compliance team configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive information types—such as credit card numbers—in documents and communications. DLP policies can be configured to block or warn users via policy tips when they attempt to share such content through email or Microsoft Teams, enforcing compliance without disrupting legitimate work.

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Retention Policies

Answer

Microsoft Purview Sensitivity Labels

Question 14

An organization with 150 users currently uses Microsoft 365 Business Standard. They need advanced compliance features (litigation hold and eDiscovery Standard) for all users, and Microsoft Defender for Office 365 Plan 1 for the 50 users in the finance department. What is the most cost-effective licensing approach?

Accepted Answer

Upgrade all users to Microsoft 365 Business Premium. Upgrade all users to Microsoft 365 Business Premium. This plan includes the required advanced compliance features (litigation hold and eDiscovery Standard) for every user, as well as Microsoft Defender for Office 365 Plan 1. The per-user cost of Business Premium is lower than E3, and unlike E3 it does not require an additional Defender for Office 365 Plan 1 add-on, making it the most cost-effective choice that meets all stated requirements.

Answer

Upgrade all users to Microsoft 365 E3 and add Microsoft Defender for Office 365 Plan 1 for the finance department

Answer

Purchase Microsoft 365 E5 for all users

Answer

Keep Business Standard and purchase Microsoft 365 E5 Compliance add-on for all users plus Exchange Online Protection for finance

Question 15

A healthcare organization must protect patient health information (PHI) from being accidentally shared externally via email. They need to automatically block emails containing medical record numbers from being sent outside the organization and also encrypt any email that does contain PHI when it is allowed. Which two Microsoft Purview solutions should they combine? (Choose two.)

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) detects sensitive data such as medical record numbers and can apply actions to block external transmission when needed. For cases where PHI is allowed to be sent, DLP can enforce encryption by integrating with Microsoft Purview Message Encryption, which secures the email for external recipients. Therefore, both DLP and Message Encryption are required: DLP for detection and policy enforcement, and Message Encryption for the actual encryption of allowed emails.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit (Standard)

Question 16

A company uses a third-party Human Resources (HR) system. Whenever a new employee is added to the HR system, they want to automatically create a user account in Microsoft 365, assign the appropriate license, and send a welcome email. Which Microsoft 365 service should be used to orchestrate this automation?

Accepted Answer

Microsoft Power Automate. Microsoft Power Automate is the correct service because it provides a low-code workflow automation platform that can trigger actions based on events in external systems (e.g., a new employee record in a third-party HR system) and then orchestrate a sequence of tasks in Microsoft 365, such as creating a user account via the Microsoft Graph API, assigning a license, and sending a welcome email. It integrates seamlessly with hundreds of connectors, including HR systems and Microsoft 365 services, making it the ideal tool for this cross-system automation scenario.

Answer

Microsoft Identity Manager

Answer

Microsoft Entra ID Connect

Answer

Microsoft Graph API

Question 17

A compliance officer wants to ensure that all data in Microsoft 365 is encrypted using a key that the organization manages and stores in their own Azure Key Vault. Microsoft will not have access to the key. Which solution should they implement?

Accepted Answer

Double Key Encryption (DKE). Double Key Encryption (DKE) protects specific files using two keys: one in Azure Key Vault and one managed by Microsoft. It is not a tenant-wide encryption solution. For encrypting all Microsoft 365 data with a key that Microsoft cannot access, Microsoft 365 Customer Key is the appropriate feature, but it is not among the options.

Answer

Customer Lockbox

Answer

Information Rights Management (IRM)

Answer

Microsoft Purview Data Lifecycle Management

Question 18

A legal team needs to preserve all data belonging to a former employee who is involved in litigation. The preservation must cover Exchange Online email, SharePoint sites, Teams messages, and OneDrive files. Which Microsoft Purview solution should they use to enforce the preservation?

Accepted Answer

eDiscovery (Standard) case hold. eDiscovery (Standard) case hold is the correct solution because it allows legal teams to place a legal hold on all data sources associated with a specific user, including Exchange Online mailboxes, SharePoint sites, OneDrive accounts, and Teams messages. This preserves the data in its current state, preventing modification or deletion, which is essential for litigation. Unlike other options, eDiscovery holds are designed specifically for legal preservation scenarios and can target multiple workloads simultaneously.

Answer

Data Lifecycle Management retention policy

Answer

Sensitivity label with retention marking

Answer

Audit log search

Question 19

A healthcare organization must ensure that all outgoing emails containing protected health information (PHI) are automatically encrypted. External recipients must be able to read the encrypted messages without installing any software or signing up for a service. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (C) is the correct solution because it enables automatic encryption of outgoing emails based on rules (e.g., detecting PHI) and allows external recipients to read encrypted messages via a secure web portal or inline rendering in supported email clients, without requiring any software installation or account sign-up. This directly meets the requirement for seamless, no-friction decryption by external parties.

Answer

Data Loss Prevention (DLP)

Answer

Sensitivity labels

Answer

Information protection policies

Question 20

Contoso Ltd. is a global manufacturing company with 10,000 users. They are deploying Microsoft 365 E5 and require: (1) All Microsoft 365 data must be encrypted at rest and in transit using customer-managed keys; (2) Email must be archived for 10 years; (3) Users must be able to access files offline on mobile devices and sync changes when online; (4) The IT team must monitor and respond to threats across email, endpoints, and identities from a single console. You need to recommend the appropriate Microsoft 365 services. Which combination should you choose?

Accepted Answer

Microsoft Purview Customer Key, Exchange Online Archiving, OneDrive, Microsoft Defender XDR. Microsoft Purview Customer Key provides customer-managed encryption keys for data at rest in Microsoft 365, meeting the first requirement. Exchange Online Archiving with a 10-year retention policy satisfies the email archiving requirement. OneDrive enables offline file access on mobile devices with sync capabilities. Microsoft Defender XDR (Extended Detection and Response) offers a unified console to monitor and respond to threats across email, endpoints, and identities.

Answer

Microsoft Purview Double Key Encryption, Exchange Online Archiving, SharePoint Online, Microsoft Sentinel

Answer

Azure Information Protection, Exchange Online Archiving, Windows 365, Microsoft Defender for Endpoint

Answer

Microsoft Purview Customer Key, Exchange Online In-Place Hold, OneDrive, Microsoft 365 Defender for Cloud Apps