MS-900 Describe Microsoft 365 apps and services Practice Test 13 — 15 Questions

Question 1

A company deploys Microsoft 365 Business Premium. The IT team wants to enable employees to sign in using a mobile app without passwords. Which app should they configure?

Accepted Answer

Microsoft Authenticator. Microsoft Authenticator is the correct app because it enables passwordless sign-in for Microsoft 365 Business Premium users via FIDO2-based phone sign-in or number matching. It allows employees to authenticate using biometrics or a PIN, eliminating the need for a password during sign-in.

Answer

Microsoft Intune

Answer

Microsoft Entra ID

Answer

Microsoft Copilot

Question 2

A hospital uses Microsoft 365 E5. They need to archive patient emails for 7 years and enable legal hold for ongoing litigation. Which two Microsoft Purview features should they use? (Select TWO.)

Accepted Answer

Retention policies. Retention policies (B) are correct because they allow the organization to define rules that preserve patient emails for a specific duration, such as 7 years, to meet regulatory compliance requirements. Litigation hold (C) is correct because it preserves all mailbox content, including deleted items, in its original state for the duration of ongoing litigation, preventing any alteration or deletion.

Answer

Sensitivity labels

Answer

Data Lifecycle Management

Answer

eDiscovery

Question 3

A user receives a phishing email that bypasses the spam filter. The security team wants to report the email to Microsoft for analysis. Which Microsoft 365 Defender portal should they use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the correct destination for submitting user-reported phishing emails for analysis. It provides the Submissions page under Email & collaboration, where security teams can send suspicious messages directly to Microsoft for review, bypassing the spam filter's failure. This portal consolidates threat intelligence and automated investigation capabilities for email threats.

Answer

Exchange admin center

Answer

Azure portal

Answer

Microsoft Purview compliance portal

Question 4

A sales team uses Microsoft Teams for collaboration. They need to securely share large files (up to 15 GB) with external partners without requiring the partners to sign in. Which Microsoft 365 service should they use?

Accepted Answer

OneDrive for Business. OneDrive for Business allows users to share files with external partners via a secure link that does not require the partner to sign in, and supports file sizes up to 250 GB (including the 15 GB requirement). This meets the need for large file sharing without authentication, leveraging OneDrive's external sharing capabilities with anonymous guest links.

Answer

Microsoft Lists

Answer

Microsoft Stream

Answer

SharePoint Online

Question 5

A company uses Microsoft 365 E5. They want to automatically retain all documents containing credit card numbers for 3 years and then delete them. Which THREE Microsoft Purview features should they use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (A) are correct because they can automatically apply sensitivity labels to documents containing sensitive information types like credit card numbers, based on conditions defined in the policy. This enables the automatic classification of content, which is a prerequisite for applying retention labels that enforce the 3-year retention and deletion rule.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery

Question 6

An employee uses Microsoft 365 Business Basic. They need to schedule a meeting with external clients who have Gmail accounts. Which Microsoft 365 app should they use?

Accepted Answer

Outlook on the web. Outlook on the web (OWA) is the correct choice because it includes a full-featured calendar that supports scheduling meetings with external participants, including those with Gmail accounts, via standard iCalendar invitations. OWA sends an .ics file attachment in the email invitation, which Gmail can parse and add to the recipient's Google Calendar, enabling the external client to accept the meeting regardless of their email provider.

Answer

Microsoft Teams

Answer

Microsoft Bookings

Answer

Microsoft To Do

Question 7

A company uses Microsoft 365 E5. The security team wants to automatically investigate and remediate advanced threats across email, endpoints, and identities. Which Microsoft 365 Defender workload should they enable?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (option D) is the correct answer because it is the unified, cross-domain security solution that correlates signals across email, endpoints, identities, and cloud apps to automatically investigate and remediate advanced threats. Unlike the individual Defender workloads, Defender XDR provides integrated incident response and automated actions across all these domains, which directly matches the requirement for automatic investigation and remediation across email, endpoints, and identities.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Question 8

A multinational corporation uses Microsoft 365 E5. They need to enforce that all documents marked as 'Confidential' are encrypted and cannot be printed or forwarded. Which Microsoft Purview Information Protection capability should they configure?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption are the correct choice because they allow you to classify and protect documents at the file level, applying encryption that restricts actions such as printing and forwarding. This is a core capability of Microsoft Purview Information Protection, enabling persistent protection that travels with the document regardless of where it is stored or shared.

Answer

Data Loss Prevention (DLP) policies

Answer

Retention policies

Answer

Azure Information Protection (AIP) client

Question 9

A small business uses Microsoft 365 Business Premium. They want to ensure that company data on lost or stolen mobile devices is automatically removed. Which Microsoft Intune policy should they configure?

Accepted Answer

Remote wipe. Remote wipe (option B) is the correct Intune policy for automatically removing company data from lost or stolen mobile devices. When configured, Remote wipe sends a command to the device that performs a factory reset, erasing all data including corporate information. This is specifically designed for device-level data removal scenarios, unlike other policies that manage access or app-level data.

Answer

Conditional Access

Answer

App protection policies

Answer

Compliance policies

Question 10

A tenant administrator sees the above JSON snippet for a Copilot for Microsoft 365 license assignment. What is the result of this configuration?

Accepted Answer

The user receives Copilot for Microsoft 365 but cannot use Bing Chat Enterprise or Teams meeting recordings.. Option C is correct because the JSON snippet shows that the 'Bing_Chat_Enterprise' and 'Microsoft_Teams_Meeting_Recording' service plans are disabled (status 'Disabled') for the Copilot for Microsoft 365 license assignment. This means the user receives Copilot but without those specific features. The JSON snippet is a valid way to assign a Copilot license with custom service plan exclusions using Microsoft Graph or PowerShell.

Answer

The user receives Copilot for Microsoft 365 with all features enabled.

Answer

The license assignment is invalid because Copilot for Microsoft 365 cannot be assigned via JSON.

Answer

The user is assigned a Microsoft 365 E5 license instead.

Question 11

A company uses Microsoft 365 Business Premium. They want to deploy a cloud-based phone system for their employees. Which TWO services should they use?

Accepted Answer

Calling Plan. Microsoft Teams Phone System (formerly Cloud PBX) provides the core PBX functionality—call control, voicemail, and auto attendants—while a Calling Plan (Microsoft's first-party PSTN connectivity) supplies the phone numbers and minutes to make/receive external calls. Together they form a complete cloud phone system without any on-premises infrastructure.

Answer

Teams Audio Conferencing

Answer

Direct Routing

Answer

Microsoft Bookings

Question 12

A security analyst runs the above KQL query in Microsoft 365 Defender. What is the primary purpose of this query?

Accepted Answer

Identify the top 10 sender domains that were blocked in the last week.. The KQL query uses `EmailEvents` and summarizes by `SenderMailFromDomain`, then sorts by `Count` descending and takes the top 10. The `where Timestamp > ago(7d)` filters for the last week, and the query does not filter on any action like `Phish` or `Allowed`; it simply counts all email events grouped by sender domain. The primary purpose is to identify the top 10 sender domains that were blocked (or processed) in the last week, as the query counts all events without a specific action filter, but in the context of Microsoft 365 Defender, this is typically used to surface high-volume domains that may be blocked or suspicious.

Answer

Show the number of phishing clicks per user.

Answer

List all emails that were allowed despite containing malware.

Answer

Count emails that failed SPF/DKIM/DMARC.

Question 13

A company uses Microsoft 365 E3. They want to upgrade to include advanced compliance features like communication compliance and insider risk management. Which add-on license do they need?

Accepted Answer

Microsoft 365 E5 Compliance. Microsoft 365 E5 Compliance is the correct add-on license because it includes advanced compliance features such as Communication Compliance (for monitoring and detecting inappropriate messages) and Insider Risk Management (for identifying and mitigating internal data risks). These features are not available in the base Microsoft 365 E3 subscription and require the E5 Compliance SKU to unlock.

Answer

Microsoft 365 E5 Security

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud Apps

Question 14

A company uses Microsoft 365 E5. They want to implement a solution to automatically classify and protect sensitive data in emails and documents. Which THREE Microsoft Purview features should they use?

Accepted Answer

Sensitivity labels. Sensitivity labels are correct because they allow organizations to classify and protect sensitive data by applying encryption, markings, and access restrictions directly to emails and documents. Auto-labeling policies extend this by automatically applying sensitivity labels based on conditions like sensitive information types or patterns, ensuring consistent protection without manual user intervention. Data Loss Prevention (DLP) policies are correct because they detect and prevent accidental sharing of sensitive data by enforcing rules on email and document transmission, such as blocking or warning when sensitive content is detected.

Answer

Retention policies

Answer

eDiscovery

Question 15

A user in your organization receives an email from an unknown sender with a link to a fake login page. The user reports it. You need to analyze the threat and check if other users received similar emails. Which Microsoft 365 Defender feature should you use?

Accepted Answer

Threat Explorer (Explorer). Threat Explorer (Explorer) is the correct tool because it provides a real-time, interactive view of email threats, allowing you to search for and analyze specific messages (like the phishing link) across all users. You can use filters such as sender, recipient, or URL to determine if other users received the same malicious email, enabling rapid threat hunting and response.

Answer

Threat analytics

Answer

Attack simulation training

Answer

Automated investigation and response (AIR)