MS-900 Hard Questions — 25 Difficult Questions

Question 1

A security administrator needs to automatically restrict access to documents labeled as 'Highly Confidential' when accessed from devices that are not joined to the domain. The restriction should block editing and printing, and apply encryption. Which combination of Microsoft 365 solutions should the administrator use?

Accepted Answer

Microsoft Purview Information Protection + Microsoft Entra ID Conditional Access. Option A is correct because Microsoft Purview Information Protection (MIP) allows you to create sensitivity labels that apply encryption, restrict editing, and block printing on documents. Microsoft Entra ID Conditional Access can then enforce that these labels are automatically applied based on device compliance (e.g., devices not joined to the domain). Together, they provide the automated, policy-driven restriction described.

Answer

Microsoft Purview Data Loss Prevention + Microsoft Entra ID Identity Protection

Answer

Microsoft Defender for Office 365 + Microsoft 365 Business Premium

Answer

Microsoft Purview Audit + Microsoft Entra ID Privileged Identity Management

Question 2

A security administrator needs to audit all activities related to a specific user in Exchange Online, SharePoint Online, and Microsoft Entra ID for the past 90 days. They also need to export the audit log as a CSV file. Which Microsoft Purview solution provides this capability without additional licensing beyond Microsoft 365 E3?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) is included with Microsoft 365 E3 and provides the ability to search and export audit logs for user activities across Exchange Online, SharePoint Online, and Microsoft Entra ID for up to 90 days. This meets the administrator's requirement without needing additional licensing.

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Content Search

Question 3

A global company needs to ensure that only employees in the 'HR' security group can access a specific set of HR documents stored in SharePoint. If a user outside the group attempts to view or copy the content, it must be blocked. The protection must persist even if someone downloads the files and shares them externally, or if the files are saved to a personal device. Which Microsoft Purview solution should be used?

Accepted Answer

Sensitivity labels with encryption and permission settings. Sensitivity labels with encryption and permission settings are the correct solution because they allow you to apply persistent protection that travels with the file, regardless of where it is stored or shared. By configuring a sensitivity label to restrict access to only members of the 'HR' security group and enabling encryption, the protection remains intact even if the file is downloaded, saved to a personal device, or shared externally. This meets the requirement for persistent access control that blocks unauthorized viewing or copying.

Answer

Data Loss Prevention (DLP) policy

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Defender for Cloud Apps session policy

Question 4

A financial services company must prevent users from accidentally sharing sensitive customer data externally. They want to block sharing of any document containing a credit card number via email or SharePoint. What combination of Microsoft 365 compliance solutions should they use?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and block the sharing of sensitive information, such as credit card numbers, across email (Exchange Online) and SharePoint. By scanning content for predefined sensitive info types (e.g., credit card numbers using regex patterns from the DLP engine), DLP can automatically block or warn users before external sharing occurs, meeting the company's requirement.

Answer

Sensitivity labels and Microsoft Purview Information Protection (Microsoft Purview Information Protection)

Answer

Microsoft Purview Compliance Manager

Answer

Exchange Online Protection (EOP) and Microsoft Defender for Microsoft 365

Question 5

A multinational corporation must comply with GDPR. They need to ensure that personal data of EU residents is retained for a specific period and then securely deleted. Additionally, they must be able to respond to data subject access requests (DSARs) within 30 days by finding and exporting relevant data. Which two Microsoft Purview solutions should they use together? (Choose two.)

Accepted Answer

Retention policies. Retention policies (A) are correct because they allow organizations to define rules that retain personal data for a specific period and then automatically delete it, meeting GDPR retention and secure deletion requirements. eDiscovery (Premium) (C) is correct because it enables searching, collecting, and exporting data from various Microsoft 365 workloads to fulfill data subject access requests (DSARs) within the 30-day regulatory timeframe.

Answer

Data Lifecycle Management (via sensitivity labels)

Answer

Audit (Standard)

Question 6

A security administrator needs to automatically restrict access to documents that contain 'PII' (personally identifiable information) so that only employees in the 'Data Privacy' security group can view them. Additionally, editing and printing of these documents must be disabled. Which combination of Microsoft Purview features should be used?

Accepted Answer

Sensitivity labels with auto-labeling and encryption that restricts permissions to the 'Data Privacy' group. Option A is correct because sensitivity labels in Microsoft Purview can be configured with auto-labeling to automatically detect and classify documents containing PII, and then apply encryption that restricts access to only the 'Data Privacy' security group. Additionally, the label can enforce usage rights such as 'View Only' to disable editing and printing, meeting all requirements.

Answer

Data Loss Prevention (DLP) policy with a block action

Answer

Retention policy with a restrict action

Answer

Privileged Identity Management (PIM)

Question 7

A compliance officer wants to proactively prevent users from sending emails that contain sensitive personal data (e.g., credit card numbers) to external recipients. When a user attempts to send such an email, they should see a policy tip explaining the restriction and be blocked from sending. Which Microsoft Purview feature should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policy is the correct feature because it is specifically designed to detect sensitive data (e.g., credit card numbers) in transit and enforce actions such as showing a policy tip and blocking the email. DLP policies use sensitive information types (e.g., Credit Card Number) and conditions to inspect email content in Exchange Online, triggering a block action with an end-user notification when a match occurs.

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Communication Compliance

Question 8

A healthcare organization must ensure that all outgoing emails containing protected health information (PHI) are automatically encrypted. External recipients must be able to read the encrypted messages without installing any software or signing up for a service. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Message Encryption. Microsoft Purview Message Encryption (C) is the correct solution because it enables automatic encryption of outgoing emails based on rules (e.g., detecting PHI) and allows external recipients to read encrypted messages via a secure web portal or inline rendering in supported email clients, without requiring any software installation or account sign-up. This directly meets the requirement for seamless, no-friction decryption by external parties.

Answer

Data Loss Prevention (DLP)

Answer

Sensitivity labels

Answer

Information protection policies

Question 9

A legal team needs to place a hold on all data belonging to a specific user who is involved in a lawsuit. The hold must preserve Exchange Online email, SharePoint sites, and Teams chat messages. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) is the correct solution because it allows legal teams to place a hold on a specific user's data across Exchange Online, SharePoint, and Teams. This hold preserves all content, including email, documents, and chat messages, ensuring that data cannot be altered or deleted during litigation. eDiscovery (Standard) is designed for legal holds and integrates with Microsoft Purview to manage custodians and preserve data.

Answer

Data Lifecycle Management (retention policies)

Answer

Communication Compliance

Answer

Audit log

Question 10

A legal team at a company needs to preserve all data belonging to a user who is involved in litigation. The preservation must cover Exchange Online email, SharePoint sites, OneDrive for Business files, and Teams chat messages. They also need to be able to search the preserved content and export it. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Standard) case hold. eDiscovery (Standard) allows you to create a case, place a hold on user mailboxes, SharePoint sites, OneDrive accounts, and Teams chat messages to preserve content relevant to litigation. It also provides built-in search and export capabilities, making it the correct solution for the legal team's requirements.

Answer

Litigation Hold

Answer

Auto-apply retention labels

Answer

Data Loss Prevention (DLP) policy

Question 11

A legal firm needs to automatically encrypt and apply access restrictions to all documents that contain case numbers considered highly confidential. The protection must remain enforced even if the document is emailed to external parties or saved to a personal device. Which Microsoft Purview solution should be configured?

Accepted Answer

Sensitivity Labels with encryption. Sensitivity Labels with encryption are the correct solution because they allow the legal firm to classify documents containing confidential case numbers and enforce persistent protection (encryption and access restrictions) that travels with the document, even when emailed externally or saved to a personal device. This is achieved by applying Azure Rights Management (Azure RMS) encryption directly to the file, ensuring the protection is embedded in the document itself, not just at the network or service boundary.

Answer

Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Answer

Customer Lockbox

Question 12

A compliance team needs to implement a Data Loss Prevention (DLP) policy to protect credit card information. What is the correct order of steps for a successful implementation?

Accepted Answer

Identify locations, Create policy, Deploy in production, Monitor alerts and refine. Best practice for DLP implementation: first identify where sensitive data resides (locations), then create the DLP policy with conditions and actions, test the policy in simulation mode before deploying to production, and finally monitor alerts and refine the policy. The option starting with 'Identify locations' followed by 'Create policy', 'Deploy in production', and 'Monitor' matches this sequence.

Answer

Create policy, Identify locations, Deploy in production, Monitor alerts and refine

Answer

Deploy in production, Monitor alerts and refine, Identify locations, Create policy

Answer

Identify locations, Deploy in production, Create policy, Monitor alerts and refine

Question 13

A security team needs to ensure that all Microsoft 365 administrative actions—such as creating user accounts or resetting passwords—are logged and searchable for at least 90 days. They also need to create custom alert rules for suspicious admin activity. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) logs and retains all administrative actions (e.g., creating users, resetting passwords) for 90 days by default, meeting the retention requirement. It also supports creating custom alert rules for suspicious admin activity via the Microsoft 365 Defender portal, which queries the audit log. This makes it the correct solution for both logging and alerting on admin actions.

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Entra ID sign-in logs

Answer

Microsoft Defender for Cloud Apps

Question 14

An organization wants to prevent employees from sharing sensitive files with external users via SharePoint Online, but they need to allow sharing with a specific external partner for a single project. What is the most efficient configuration?

Accepted Answer

Disable external sharing at the tenant level and enable it only for the specific project site. Option A is correct because it allows the organization to disable external sharing globally at the tenant level via the SharePoint admin center, which prevents all users from sharing with external users by default. Then, by enabling external sharing only for the specific project site (site-level override), the organization can grant the necessary access to the external partner while maintaining the broad restriction. This is the most efficient approach because it uses a single configuration change at the tenant level and a targeted exception at the site level, avoiding complex policies or labels.

Answer

Change the default sharing link type to 'Specific people' and add the partner's domain to an allow list

Answer

Apply sensitivity labels with encryption to all files

Answer

Configure a DLP policy to block external sharing except for the partner domain

Question 15

An organization with 2,000 users currently has Microsoft 365 E3 licenses. They need to implement a policy that automatically deletes all Microsoft Teams chat messages older than 90 days. They also need to retain all Yammer messages for 10 years for legal purposes. Which licensing add-ons are minimally required to achieve both requirements?

Accepted Answer

Microsoft 365 E5 Compliance add-on for all users. Option A is correct because the Microsoft 365 E5 Compliance add-on includes both Microsoft Purview Communication Compliance for Teams chat retention policies and the necessary data lifecycle management capabilities to retain Yammer messages for 10 years. This add-on provides the required features without needing additional licenses, making it the minimal licensing solution for both requirements.

Answer

Microsoft 365 E5 Information Protection and Governance add-on

Answer

Microsoft 365 E5 eDiscovery and Audit add-on

Answer

Microsoft 365 E5 Compliance add-on for all users and E5 eDiscovery add-on for a subset

Question 16

A charitable organization with 50 employees wants to use Microsoft 365 for business‑grade email, calendar, and online versions of Office apps. Their budget is extremely limited. What should they do first to obtain licenses at a reduced cost?

Accepted Answer

Apply for Microsoft 365 Nonprofit eligibility and then purchase discounted or donated plans. Microsoft offers discounted and donated plans specifically for eligible nonprofit organizations. By first applying for Microsoft 365 Nonprofit eligibility, the charitable organization can access Business Basic licenses at a significantly reduced cost or even receive donated subscriptions, aligning with their extremely limited budget while still obtaining business-grade email, calendar, and online Office apps.

Answer

Purchase Microsoft 365 Business Basic licenses through a volume licensing program

Answer

Use free consumer accounts like Outlook.com and Office Online

Answer

Sign up for a Microsoft 365 Business Premium trial and rely on extensions

Question 17

A security team needs to monitor all administrative activities in Microsoft 365, including creating users, resetting passwords, and modifying policies. They require that logs be retained for at least 90 days and want to create custom alerts for suspicious admin actions (e.g., multiple password resets in a short time). Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides extended log retention of up to one year (or more with add-ons), which meets the 90-day requirement, and it supports custom alert policies via the Microsoft 365 Defender portal to detect suspicious admin activities like multiple password resets. Standard Audit only retains logs for 90 days but lacks the advanced alerting and investigation capabilities needed for custom alerts on admin actions.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID reporting

Question 18

A company wants to ensure that all Microsoft 365 admin actions are recorded and searchable for at least 180 days. They also need to create custom alert rules to notify the security team when critical events occur, such as a user being added to the Global Admin role. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) is the correct solution because it records all admin actions from Microsoft 365 services into the unified audit log, retains those logs for at least 180 days (Audit Standard) or up to 10 years (Audit Premium), and allows you to create custom alert policies that trigger notifications when specific events like 'Added member to role' (e.g., Global Admin) occur. This directly meets the requirement for recording, searchability, and custom alerting on critical admin events.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview eDiscovery

Question 19

A company uses Microsoft 365 (a SaaS offering). A security incident occurs where an employee's account is compromised because the employee reused their corporate password on a personal website. According to the shared responsibility model, who is primarily responsible for this security failure?

Accepted Answer

The customer (the company using Microsoft 365). In the Microsoft 365 shared responsibility model, the customer is responsible for securing user identities, including password hygiene and multi-factor authentication (MFA). Since the employee reused their corporate password on a personal website, this is a customer-side identity management failure, not a platform vulnerability. Microsoft secures the SaaS infrastructure, but customer-managed credentials fall under the customer's responsibility.

Answer

Microsoft, because they provide the SaaS platform

Answer

Both Microsoft and the customer share equal responsibility

Answer

It depends on the contract terms with Microsoft

Question 20

A company with 100 Microsoft 365 Business Premium users needs to add advanced compliance features: eDiscovery (Premium) and Communication Compliance. They want to keep their existing Business Premium subscriptions to retain current capabilities. What is the most cost-effective licensing approach?

Accepted Answer

Purchase Microsoft 365 E5 Compliance add-on for all 100 users. Option B is correct because Microsoft 365 Business Premium already includes the base compliance features, and the Microsoft 365 E5 Compliance add-on provides the advanced capabilities (eDiscovery Premium and Communication Compliance) without requiring a full license upgrade. This add-on is the most cost-effective approach as it adds only the needed compliance features to existing Business Premium subscriptions.

Answer

Upgrade all 100 users from Business Premium to Microsoft 365 E5

Answer

Purchase Microsoft 365 E5 eDiscovery and Audit add-on

Answer

Purchase Microsoft 365 E5 Compliance and Information Protection add-on