MS-900 Describe Microsoft 365 apps and services Practice Test 13 — 15 Questions

Question 1

An administrator runs the above PowerShell command and receives output of '14'. What does this value indicate?

Accepted Answer

Items in the Deleted Items folder are permanently deleted after 14 days.. The value '14' indicates that the retention policy for the Deleted Items folder permanently deletes items after 14 days. This is a common retention setting applied to the Deleted Items folder.

Answer

Inbox rules are retained for 14 days after deletion.

Answer

The mailbox has a litigation hold for 14 days.

Answer

Calendar items are retained for 14 days after the meeting end.

Question 2

An administrator creates a new team using the above JSON template via Microsoft Graph. Which statement accurately describes the team?

Accepted Answer

Only team owners can add new members to the team.. The JSON template used to create the team via Microsoft Graph includes the 'isMembershipLimitedToOwners' property set to true, which explicitly restricts the ability to add new members to team owners only. This overrides the default behavior where members could add others, making A accurate.

Answer

The team is a specialized team for sales data analysis.

Answer

The team's classification is automatically applied based on content.

Answer

The team is public and anyone in the organization can join.

Question 3

A company uses Microsoft 365 Business Premium and wants to enable secure remote access for employees using personal devices. Which Microsoft 365 app should they configure to enforce conditional access policies based on device compliance?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct answer because it is the Microsoft 365 app that provides mobile device management (MDM) and mobile application management (MAM). It allows administrators to define device compliance policies (e.g., requiring encryption, PIN, or a minimum OS version) and integrate those policies with Microsoft Entra ID (formerly Azure AD) Conditional Access. When a user attempts to access corporate resources from a personal device, Conditional Access checks the device's compliance status reported by Intune before granting access.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 4

An organization wants to use Microsoft 365 to automatically classify and protect sensitive data in emails and documents. Which service should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) is the correct service because it provides data classification, labeling, and protection capabilities directly within Microsoft 365. It uses sensitivity labels to automatically classify emails and documents based on conditions like content patterns or custom keywords, and then applies encryption, rights management, or visual markings (e.g., headers/footers) to protect sensitive data both at rest and in transit.

Answer

Microsoft Intune

Answer

Microsoft Defender for Office 365

Answer

Microsoft Entra ID

Question 5

A company is deploying Microsoft 365 Copilot and wants to ensure that prompts and responses are not used to train the underlying AI models. Which setting must be configured?

Accepted Answer

Configure data boundary for Copilot to 'No training'. The 'Data boundary for Copilot' setting, when configured to 'No training', explicitly prevents Microsoft from using prompts and responses from Microsoft 365 Copilot to train or improve its underlying AI models. This setting ensures that organizational data remains within the tenant's data boundary and is not used for model retraining, addressing data privacy and compliance requirements.

Answer

Enable Customer Key for Copilot

Answer

Assign Copilot licenses to users

Answer

Enable audit logging for Copilot interactions

Question 6

An organization uses Microsoft Teams and wants to ensure that external users from partner companies can access only specific channels and cannot initiate private chats with internal users. Which Microsoft 365 feature should they configure?

Accepted Answer

Teams Guest Access. D is correct because Teams Guest Access allows external users to be invited as guests in a tenant, granting them access to specific channels and teams. Guest access policies can be configured to prevent guests from initiating private chats with internal users, meeting both requirements. External Access (Federation) only controls chat and calling between federated domains and does not provide access to channels, making option B incorrect.

Answer

Microsoft Purview Communication Compliance

Answer

Teams External Access (Federation)

Answer

Microsoft Entra B2B collaboration

Question 7

A user reports that they cannot access their Microsoft 365 email on their mobile device. The user can access Outlook on the web. Which Microsoft 365 app should the administrator check to verify the user's mobile device is compliant?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct answer because it is the mobile device management (MDM) and mobile application management (MAM) component within Microsoft 365. When a user cannot access email on a mobile device but can via Outlook on the web, the issue is likely a device compliance policy blocking access. Intune enforces conditional access policies by checking device compliance (e.g., encryption, jailbreak status, minimum OS version) before allowing Exchange Online connectivity.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Entra ID

Answer

Microsoft Purview

Question 8

A company uses Microsoft 365 E5 and wants to implement a solution that automatically detects and remediates security incidents across endpoints, email, and identities. Which service should they use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security solution that automatically detects, investigates, and remediates threats across endpoints, email, and identities. It leverages AI and automation to correlate signals from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity, enabling coordinated incident response without manual intervention.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 9

An organization wants to provide employees with a personalized news feed and learning resources within Microsoft 365. Which app should they use?

Accepted Answer

Microsoft Viva. Microsoft Viva is the correct app because it is an employee experience platform that integrates with Microsoft 365 to deliver personalized news feeds via Viva Connections and curated learning resources through Viva Learning. Unlike other apps, Viva is specifically designed to aggregate content from across the organization and external sources into a single, tailored dashboard.

Answer

Microsoft Teams

Answer

Microsoft Stream

Answer

Microsoft SharePoint

Question 10

A company needs to ensure that sensitive documents stored in SharePoint Online are automatically encrypted and cannot be shared with external users. Which Microsoft Purview feature should they use?

Accepted Answer

Sensitivity labels. Sensitivity labels are the correct choice because they enforce encryption and access restrictions directly on documents, including blocking external sharing. Unlike DLP policies, which detect and prevent sharing after the fact, sensitivity labels apply persistent protection that travels with the file, ensuring it remains encrypted even if downloaded or shared outside SharePoint Online.

Answer

Communication compliance

Answer

Data Loss Prevention (DLP) policies

Answer

Retention labels

Question 11

An administrator needs to restrict access to Microsoft 365 admin centers based on user location. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to enforce policies that grant or block access to Microsoft 365 admin centers based on conditions such as user location (IP address ranges or countries). By configuring a Conditional Access policy with a location condition, you can restrict access to sensitive admin portals like the Microsoft 365 admin center or Exchange admin center to trusted networks only.

Answer

Identity Protection

Answer

Entra ID Governance

Answer

Privileged Identity Management (PIM)

Question 12

Which TWO Microsoft 365 services are specifically designed to help organizations manage and monitor data compliance?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance (option A) helps monitor communications for policy violations, while Microsoft Purview (option E) provides overall data governance and compliance solutions. Both are specifically designed for compliance management. Microsoft Defender for Office 365 (B) is for threat protection, Intune (C) for device management, and Sentinel (D) is a SIEM tool.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 13

Which TWO Microsoft 365 services provide capabilities for insider risk management?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management (option B) is a dedicated service that uses machine learning and behavioral analytics to detect, investigate, and respond to risky user activities such as data theft, policy violations, or unauthorized access. It correlates signals from Microsoft 365 logs, HR data, and user behavior to identify potential insider threats, making it the primary tool for insider risk management.

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Answer

Microsoft Defender XDR

Question 14

Refer to the exhibit. The JSON shows a device compliance policy assignment in Microsoft Intune. Based on the exhibit, what is the current compliance status of the devices in the target group?

Accepted Answer

Not compliant, because the encryption setting is not compliant. The exhibit shows a device compliance policy in Microsoft Intune with two settings: 'require device encryption' set to 'Required' and 'minimum password length' set to '6'. The compliance status for the target group is 'Not compliant, because the encryption setting is not compliant'. This is because the JSON indicates that the encryption requirement is not being met by the devices in the group, likely due to BitLocker or device encryption not being enabled. The password setting alone does not override the encryption non-compliance, as all required settings must be satisfied for a device to be marked compliant.

Answer

Not compliant, only because the password setting is missing

Answer

Compliant, because both settings are compliant

Answer

Compliant, because the password setting is compliant

Question 15

Refer to the exhibit. The JSON shows Microsoft Entra ID role assignments using Privileged Identity Management (PIM). Which statement about user2@contoso.com is correct?

Accepted Answer

user2 must activate the Global Administrator role before using it. The JSON shows that user2@contoso.com has an eligible assignment for the Global Administrator role via Microsoft Entra ID PIM. In PIM, an eligible assignment means the user must activate the role (e.g., through the PIM portal or API) before gaining administrative privileges. The JSON snippet includes a property like "assignmentType": "Eligible" (implied by the context), which requires activation to elevate permissions temporarily.

Answer

user2 is not assigned any administrative role

Answer

user2 cannot access any administrative features

Answer

user2 is permanently assigned the Global Administrator role