MS-900 Describe Microsoft 365 apps and services Practice Test 10 — 15 Questions

Question 1

Which TWO Microsoft 365 apps are included in the Microsoft 365 Business Basic subscription?

Accepted Answer

Microsoft Teams. Microsoft 365 Business Basic is a cloud-only subscription that includes web and mobile versions of Office apps, not desktop installations. Microsoft Teams is included as the core collaboration hub for chat, meetings, and file sharing. Microsoft Outlook (web) is also included, providing email, calendar, and contacts via a browser interface.

Answer

Microsoft Power BI Pro

Answer

Microsoft Word (desktop app)

Answer

Microsoft Purview Compliance Portal

Question 2

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud Apps access policy configuration. What does this policy do?

Accepted Answer

Blocks access from the specified IP range to the SharePoint site and prevents downloads. This policy is configured with an action of 'Block' and a 'Download (including printing)' control set to 'Block' for the specified IP range. When both access and download are blocked, the result is that users from that IP range are completely denied access to the SharePoint site and cannot download any files. Option C correctly describes this combined blocking behavior.

Answer

Allows access but prevents downloads from the specified IP range

Answer

Allows access to the SharePoint site only from the specified IP range

Answer

Disables the policy for the SharePoint site

Question 3

Refer to the exhibit. You are reviewing a role definition in Microsoft Purview compliance portal. Which actions can a user assigned this role perform?

Accepted Answer

Manage compliance and data governance tasks in Microsoft Purview. The question refers to a role definition in the Microsoft Purview compliance portal. The Compliance Administrator role (or a custom role with equivalent permissions) is designed specifically to manage compliance and data governance tasks, such as data classification, data loss prevention (DLP), eDiscovery, and retention policies. Option A correctly identifies this scope, as Purview roles do not extend to identity management or security operations in other portals.

Answer

Manage user accounts in Microsoft Entra ID

Answer

Manage security settings in Microsoft Defender XDR

Answer

View only compliance reports without making changes

Question 4

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. What will this policy do?

Accepted Answer

Blocks access to Office 365 apps when the sign-in risk is high. The exhibit shows a Conditional Access policy configured with the condition 'Sign-in risk: High' and the control 'Block access'. This combination means that when Microsoft Entra ID detects a high-risk sign-in (e.g., from an anonymous IP address or compromised credentials), access to the targeted cloud apps is denied. The policy specifically targets Office 365 apps (as indicated in the 'Cloud apps or actions' assignment), so it blocks access to those apps when the sign-in risk is high.

Answer

Allows access but logs the sign-in risk

Answer

Requires multi-factor authentication for high-risk sign-ins

Answer

Blocks access to all cloud apps when sign-in risk is high

Question 5

A hospital uses Microsoft 365 E5. They need to archive patient emails for 7 years and enable legal hold for ongoing litigation. Which two Microsoft Purview features should they use? (Select TWO.)

Accepted Answer

Retention policies. Retention policies (B) are correct because they allow the organization to define rules that preserve patient emails for a specific duration, such as 7 years, to meet regulatory compliance requirements. Litigation hold (C) is correct because it preserves all mailbox content, including deleted items, in its original state for the duration of ongoing litigation, preventing any alteration or deletion.

Answer

Sensitivity labels

Answer

Data Lifecycle Management

Answer

eDiscovery

Question 6

A user receives a phishing email that bypasses the spam filter. The security team wants to report the email to Microsoft for analysis. Which Microsoft 365 Defender portal should they use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the correct destination for submitting user-reported phishing emails for analysis. It provides the Submissions page under Email & collaboration, where security teams can send suspicious messages directly to Microsoft for review, bypassing the spam filter's failure. This portal consolidates threat intelligence and automated investigation capabilities for email threats.

Answer

Exchange admin center

Answer

Azure portal

Answer

Microsoft Purview compliance portal

Question 7

A sales team uses Microsoft Teams for collaboration. They need to securely share large files (up to 15 GB) with external partners without requiring the partners to sign in. Which Microsoft 365 service should they use?

Accepted Answer

OneDrive for Business. OneDrive for Business allows users to share files with external partners via a secure link that does not require the partner to sign in, and supports file sizes up to 250 GB (including the 15 GB requirement). This meets the need for large file sharing without authentication, leveraging OneDrive's external sharing capabilities with anonymous guest links.

Answer

Microsoft Lists

Answer

Microsoft Stream

Answer

SharePoint Online

Question 8

A company uses Microsoft 365 E5. They want to automatically retain all documents containing credit card numbers for 3 years and then delete them. Which THREE Microsoft Purview features should they use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (A) are correct because they can automatically apply sensitivity labels to documents containing sensitive information types like credit card numbers, based on conditions defined in the policy. This enables the automatic classification of content, which is a prerequisite for applying retention labels that enforce the 3-year retention and deletion rule.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery

Question 9

An employee uses Microsoft 365 Business Basic. They need to schedule a meeting with external clients who have Gmail accounts. Which Microsoft 365 app should they use?

Accepted Answer

Outlook on the web. Outlook on the web (OWA) is the correct choice because it includes a full-featured calendar that supports scheduling meetings with external participants, including those with Gmail accounts, via standard iCalendar invitations. OWA sends an .ics file attachment in the email invitation, which Gmail can parse and add to the recipient's Google Calendar, enabling the external client to accept the meeting regardless of their email provider.

Answer

Microsoft Teams

Answer

Microsoft Bookings

Answer

Microsoft To Do

Question 10

A company uses Microsoft 365 E5. The security team wants to automatically investigate and remediate advanced threats across email, endpoints, and identities. Which Microsoft 365 Defender workload should they enable?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (option D) is the correct answer because it is the unified, cross-domain security solution that correlates signals across email, endpoints, identities, and cloud apps to automatically investigate and remediate advanced threats. Unlike the individual Defender workloads, Defender XDR provides integrated incident response and automated actions across all these domains, which directly matches the requirement for automatic investigation and remediation across email, endpoints, and identities.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Question 11

A multinational corporation uses Microsoft 365 E5. They need to enforce that all documents marked as 'Confidential' are encrypted and cannot be printed or forwarded. Which Microsoft Purview Information Protection capability should they configure?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption are the correct choice because they allow you to classify and protect documents at the file level, applying encryption that restricts actions such as printing and forwarding. This is a core capability of Microsoft Purview Information Protection, enabling persistent protection that travels with the document regardless of where it is stored or shared.

Answer

Data Loss Prevention (DLP) policies

Answer

Retention policies

Answer

Azure Information Protection (AIP) client

Question 12

A small business uses Microsoft 365 Business Premium. They want to ensure that company data on lost or stolen mobile devices is automatically removed. Which Microsoft Intune policy should they configure?

Accepted Answer

Remote wipe. Remote wipe (option B) is the correct Intune policy for automatically removing company data from lost or stolen mobile devices. When configured, Remote wipe sends a command to the device that performs a factory reset, erasing all data including corporate information. This is specifically designed for device-level data removal scenarios, unlike other policies that manage access or app-level data.

Answer

Conditional Access

Answer

App protection policies

Answer

Compliance policies

Question 13

A tenant administrator sees the above JSON snippet for a Copilot for Microsoft 365 license assignment. What is the result of this configuration?

Accepted Answer

The user receives Copilot for Microsoft 365 but cannot use Bing Chat Enterprise or Teams meeting recordings.. It describes the typical result when a Copilot for Microsoft 365 license is assigned with certain service plans disabled, such as Bing Chat Enterprise and Teams meeting recordings. The JSON assignment method allows administrators to disable specific service plans by setting their status to 'Disabled'. In this scenario, the user receives the Copilot license but without the disabled features. The other options are incorrect: Option A is wrong because not all features are enabled if any service plans are disabled. Option B is wrong because JSON can be used to assign licenses via Graph API. Option D is wrong because the JSON snippet specifies a Copilot license, not an E5 license.

Answer

The user receives Copilot for Microsoft 365 with all features enabled.

Answer

The license assignment is invalid because Copilot for Microsoft 365 cannot be assigned via JSON.

Answer

The user is assigned a Microsoft 365 E5 license instead.

Question 14

A company uses Microsoft 365 Business Premium. They want to deploy a cloud-based phone system for their employees. Which TWO services should they use?

Accepted Answer

Calling Plan. Microsoft Teams Phone System (formerly Cloud PBX) provides the core PBX functionality—call control, voicemail, and auto attendants—while a Calling Plan (Microsoft's first-party PSTN connectivity) supplies the phone numbers and minutes to make/receive external calls. Together they form a complete cloud phone system without any on-premises infrastructure.

Answer

Teams Audio Conferencing

Answer

Direct Routing

Answer

Microsoft Bookings

Question 15

A security analyst runs the above KQL query in Microsoft 365 Defender. What is the primary purpose of this query?

Accepted Answer

Count emails that failed SPF/DKIM/DMARC.. The KQL query uses `EmailEvents` with a filter on `EmailAuthenticationResult` for failed authentication (e.g., `where AuthenticationResult == 'Fail'`), then summarizes by `SenderMailFromDomain`, counts, sorts descending, and takes the top 10. The `where Timestamp > ago(7d)` restricts to the last week. Thus, the query identifies the top 10 sender domains that failed SPF/DKIM/DMARC in the last week.

Answer

Show the number of phishing clicks per user.

Answer

Identify the top 10 sender domains that were blocked in the last week.

Answer

List all emails that were allowed despite containing malware.