MS-900 Describe Microsoft 365 apps and services Practice Test 16 — 15 Questions

Question 1

A hospital uses Microsoft 365 E5. They need to archive patient emails for 7 years and enable legal hold for ongoing litigation. Which two Microsoft Purview features should they use? (Select TWO.)

Accepted Answer

Retention policies. Retention policies (B) are correct because they allow the organization to define rules that preserve patient emails for a specific duration, such as 7 years, to meet regulatory compliance requirements. Litigation hold (C) is correct because it preserves all mailbox content, including deleted items, in its original state for the duration of ongoing litigation, preventing any alteration or deletion.

Answer

Sensitivity labels

Answer

Data Lifecycle Management

Answer

eDiscovery

Question 2

A user receives a phishing email that bypasses the spam filter. The security team wants to report the email to Microsoft for analysis. Which Microsoft 365 Defender portal should they use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (security.microsoft.com) is the correct destination for submitting user-reported phishing emails for analysis. It provides the Submissions page under Email & collaboration, where security teams can send suspicious messages directly to Microsoft for review, bypassing the spam filter's failure. This portal consolidates threat intelligence and automated investigation capabilities for email threats.

Answer

Exchange admin center

Answer

Azure portal

Answer

Microsoft Purview compliance portal

Question 3

A sales team uses Microsoft Teams for collaboration. They need to securely share large files (up to 15 GB) with external partners without requiring the partners to sign in. Which Microsoft 365 service should they use?

Accepted Answer

OneDrive for Business. OneDrive for Business allows users to share files with external partners via a secure link that does not require the partner to sign in, and supports file sizes up to 250 GB (including the 15 GB requirement). This meets the need for large file sharing without authentication, leveraging OneDrive's external sharing capabilities with anonymous guest links.

Answer

Microsoft Lists

Answer

Microsoft Stream

Answer

SharePoint Online

Question 4

A company uses Microsoft 365 E5. The security team wants to automatically investigate and remediate advanced threats across email, endpoints, and identities. Which Microsoft 365 Defender workload should they enable?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (option D) is the correct answer because it is the unified, cross-domain security solution that correlates signals across email, endpoints, identities, and cloud apps to automatically investigate and remediate advanced threats. Unlike the individual Defender workloads, Defender XDR provides integrated incident response and automated actions across all these domains, which directly matches the requirement for automatic investigation and remediation across email, endpoints, and identities.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Question 5

A multinational corporation uses Microsoft 365 E5. They need to enforce that all documents marked as 'Confidential' are encrypted and cannot be printed or forwarded. Which Microsoft Purview Information Protection capability should they configure?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption are the correct choice because they allow you to classify and protect documents at the file level, applying encryption that restricts actions such as printing and forwarding. This is a core capability of Microsoft Purview Information Protection, enabling persistent protection that travels with the document regardless of where it is stored or shared.

Answer

Data Loss Prevention (DLP) policies

Answer

Retention policies

Answer

Azure Information Protection (AIP) client

Question 6

A company uses Microsoft 365 Business Premium. They want to deploy a cloud-based phone system for their employees. Which TWO services should they use?

Accepted Answer

Calling Plan. Microsoft Teams Phone System (formerly Cloud PBX) provides the core PBX functionality—call control, voicemail, and auto attendants—while a Calling Plan (Microsoft's first-party PSTN connectivity) supplies the phone numbers and minutes to make/receive external calls. Together they form a complete cloud phone system without any on-premises infrastructure.

Answer

Teams Audio Conferencing

Answer

Direct Routing

Answer

Microsoft Bookings

Question 7

A company uses Microsoft 365 E3. They want to upgrade to include advanced compliance features like communication compliance and insider risk management. Which add-on license do they need?

Accepted Answer

Microsoft 365 E5 Compliance. Microsoft 365 E5 Compliance is the correct add-on license because it includes advanced compliance features such as Communication Compliance (for monitoring and detecting inappropriate messages) and Insider Risk Management (for identifying and mitigating internal data risks). These features are not available in the base Microsoft 365 E3 subscription and require the E5 Compliance SKU to unlock.

Answer

Microsoft 365 E5 Security

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud Apps

Question 8

A company uses Microsoft 365 E5. They want to implement a solution to automatically classify and protect sensitive data in emails and documents. Which THREE Microsoft Purview features should they use?

Accepted Answer

Sensitivity labels. Sensitivity labels are correct because they allow organizations to classify and protect sensitive data by applying encryption, markings, and access restrictions directly to emails and documents. Auto-labeling policies extend this by automatically applying sensitivity labels based on conditions like sensitive information types or patterns, ensuring consistent protection without manual user intervention. Data Loss Prevention (DLP) policies are correct because they detect and prevent accidental sharing of sensitive data by enforcing rules on email and document transmission, such as blocking or warning when sensitive content is detected.

Answer

Retention policies

Answer

eDiscovery

Question 9

A user in your organization receives an email from an unknown sender with a link to a fake login page. The user reports it. You need to analyze the threat and check if other users received similar emails. Which Microsoft 365 Defender feature should you use?

Accepted Answer

Threat Explorer (Explorer). Threat Explorer (Explorer) is the correct tool because it provides a real-time, interactive view of email threats, allowing you to search for and analyze specific messages (like the phishing link) across all users. You can use filters such as sender, recipient, or URL to determine if other users received the same malicious email, enabling rapid threat hunting and response.

Answer

Threat analytics

Answer

Attack simulation training

Answer

Automated investigation and response (AIR)

Question 10

A marketing team needs to collaborate on a presentation that will be updated frequently by multiple team members, and they want to ensure everyone always has the latest version without manual tracking. Which Microsoft 365 service should they use?

Accepted Answer

SharePoint Online. SharePoint Online is the correct choice because it provides a centralized document library with version history, co-authoring, and metadata management, ensuring all team members always access the latest version without manual tracking. Unlike OneDrive for Business, which is designed for individual use, SharePoint Online supports structured collaboration across a team with granular permissions and automated sync.

Answer

Exchange Online

Answer

Microsoft Teams

Answer

OneDrive for Business

Question 11

A company uses Microsoft 365 E5 and wants to automatically classify sensitive emails containing credit card numbers and then apply encryption. Which solution should they use in combination with Microsoft Purview?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) enables automatic classification of sensitive data, such as credit card numbers, using built-in sensitive information types and exact data match (EDM) classifiers. When combined with sensitivity labels, it can automatically apply encryption (e.g., via Azure Rights Management) to emails containing that data, meeting the requirement without additional services.

Answer

Microsoft 365 Copilot

Answer

Microsoft Intune

Answer

Microsoft Defender for Office 365

Question 12

A sales team uses Microsoft 365 and wants to track customer interactions and manage leads from within Outlook. Which app should they use?

Accepted Answer

Microsoft Dynamics 365 Sales. Microsoft Dynamics 365 Sales is a customer relationship management (CRM) application that integrates directly with Outlook to track customer interactions, manage leads, and automate sales processes. It provides a unified interface within Outlook for viewing contact history, logging emails, and managing opportunities, making it the correct choice for the sales team's requirements.

Answer

Microsoft Lists

Answer

Microsoft Bookings

Answer

Microsoft Forms

Question 13

Which TWO Microsoft 365 services provide real-time co-authoring in documents?

Accepted Answer

SharePoint Online. SharePoint Online is correct because it supports real-time co-authoring in Word, Excel, and PowerPoint documents stored in SharePoint document libraries, leveraging the Office Online server infrastructure and the WebDAV protocol for simultaneous edits by multiple users.

Answer

Microsoft Teams

Answer

Microsoft Lists

Answer

Exchange Online

Question 14

Which THREE Microsoft 365 services are included in Microsoft 365 E3 that are NOT in Microsoft 365 Business Basic?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) is included in Microsoft 365 E3 but not in Microsoft 365 Business Basic. Business Basic only includes Exchange Online, Teams, and web/mobile versions of Office apps, with no data classification or rights management capabilities. E3 adds full Purview features like sensitivity labels and encryption for compliance and data loss prevention.

Answer

Exchange Online

Answer

Microsoft Teams

Question 15

Which TWO Microsoft 365 services are primarily used for business process automation?

Accepted Answer

Power Automate. Power Automate (B) is correct because it is Microsoft's dedicated workflow engine for business process automation, letting you build event-driven flows that connect hundreds of connectors to automate approvals, notifications, data sync, and repetitive tasks. Power Apps (D) is correct because it provides low-code canvas and model-driven apps that digitize and automate business processes such as forms, approvals, and data entry, often triggered or extended by Power Automate flows. Power BI (A) is a business intelligence and reporting tool for visualizing data, not for automating processes. Power Virtual Agents (C) is for building conversational chatbots, which is a narrower automation use case rather than general business process automation. Microsoft Lists (E) is an information-tracking and list-management app, not a process automation service.

Answer

Power BI

Answer

Power Virtual Agents

Answer

Microsoft Lists