MS-900 Describe Microsoft 365 apps and services Practice Test 16 — 15 Questions

Question 1

A company uses Microsoft 365 Business Premium and wants to enable secure remote access for employees using personal devices. Which Microsoft 365 app should they configure to enforce conditional access policies based on device compliance?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct answer because it is the Microsoft 365 app that provides mobile device management (MDM) and mobile application management (MAM). It allows administrators to define device compliance policies (e.g., requiring encryption, PIN, or a minimum OS version) and integrate those policies with Microsoft Entra ID (formerly Azure AD) Conditional Access. When a user attempts to access corporate resources from a personal device, Conditional Access checks the device's compliance status reported by Intune before granting access.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 2

An organization wants to use Microsoft 365 to automatically classify and protect sensitive data in emails and documents. Which service should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) is the correct service because it provides data classification, labeling, and protection capabilities directly within Microsoft 365. It uses sensitivity labels to automatically classify emails and documents based on conditions like content patterns or custom keywords, and then applies encryption, rights management, or visual markings (e.g., headers/footers) to protect sensitive data both at rest and in transit.

Answer

Microsoft Intune

Answer

Microsoft Defender for Office 365

Answer

Microsoft Entra ID

Question 3

A company is deploying Microsoft 365 Copilot and wants to ensure that prompts and responses are not used to train the underlying AI models. Which setting must be configured?

Accepted Answer

Configure data boundary for Copilot to 'No training'. Option A is correct because the 'Data boundary for Copilot' setting, when configured to 'No training', explicitly prevents Microsoft from using prompts and responses from Microsoft 365 Copilot to train or improve its underlying AI models. This setting ensures that organizational data remains within the tenant's data boundary and is not used for model retraining, addressing data privacy and compliance requirements.

Answer

Enable Customer Key for Copilot

Answer

Assign Copilot licenses to users

Answer

Enable audit logging for Copilot interactions

Question 4

An organization uses Microsoft Teams and wants to ensure that external users from partner companies can access only specific channels and cannot initiate private chats with internal users. Which Microsoft 365 feature should they configure?

Accepted Answer

Teams External Access (Federation). B is correct because Teams External Access (Federation) allows external users from partner organizations to be added to specific channels without granting them full tenant access. It uses the Session Initiation Protocol (SIP) federation model to enable limited collaboration, and administrators can control whether federated users can initiate private chats by disabling the 'External users can contact me' policy in the Teams admin center. This meets the requirement of restricting external users to only designated channels and preventing private chat initiation.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Entra B2B collaboration

Answer

Teams Guest Access

Question 5

A user reports that they cannot access their Microsoft 365 email on their mobile device. The user can access Outlook on the web. Which Microsoft 365 app should the administrator check to verify the user's mobile device is compliant?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct answer because it is the mobile device management (MDM) and mobile application management (MAM) component within Microsoft 365. When a user cannot access email on a mobile device but can via Outlook on the web, the issue is likely a device compliance policy blocking access. Intune enforces conditional access policies by checking device compliance (e.g., encryption, jailbreak status, minimum OS version) before allowing Exchange Online connectivity.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Entra ID

Answer

Microsoft Purview

Question 6

A company uses Microsoft 365 E5 and wants to implement a solution that automatically detects and remediates security incidents across endpoints, email, and identities. Which service should they use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security solution that automatically detects, investigates, and remediates threats across endpoints, email, and identities. It leverages AI and automation to correlate signals from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity, enabling coordinated incident response without manual intervention.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 7

An organization wants to provide employees with a personalized news feed and learning resources within Microsoft 365. Which app should they use?

Accepted Answer

Microsoft Viva. Microsoft Viva is the correct app because it is an employee experience platform that integrates with Microsoft 365 to deliver personalized news feeds via Viva Connections and curated learning resources through Viva Learning. Unlike other apps, Viva is specifically designed to aggregate content from across the organization and external sources into a single, tailored dashboard.

Answer

Microsoft Teams

Answer

Microsoft Stream

Answer

Microsoft SharePoint

Question 8

A company needs to ensure that sensitive documents stored in SharePoint Online are automatically encrypted and cannot be shared with external users. Which Microsoft Purview feature should they use?

Accepted Answer

Sensitivity labels. Sensitivity labels are the correct choice because they enforce encryption and access restrictions directly on documents, including blocking external sharing. Unlike DLP policies, which detect and prevent sharing after the fact, sensitivity labels apply persistent protection that travels with the file, ensuring it remains encrypted even if downloaded or shared outside SharePoint Online.

Answer

Communication compliance

Answer

Data Loss Prevention (DLP) policies

Answer

Retention labels

Question 9

An administrator needs to restrict access to Microsoft 365 admin centers based on user location. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to enforce policies that grant or block access to Microsoft 365 admin centers based on conditions such as user location (IP address ranges or countries). By configuring a Conditional Access policy with a location condition, you can restrict access to sensitive admin portals like the Microsoft 365 admin center or Exchange admin center to trusted networks only.

Answer

Identity Protection

Answer

Entra ID Governance

Answer

Privileged Identity Management (PIM)

Question 10

Which TWO Microsoft 365 services are specifically designed to help organizations manage and monitor data compliance?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview (A) provides data governance and compliance solutions. Microsoft Purview Communication Compliance (C) monitors communications for policy violations. Microsoft Defender for Office 365 (B) is for threat protection. Microsoft Intune (D) is for device management. Microsoft Sentinel (E) is a SIEM.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 11

Which THREE Microsoft 365 apps are part of the Microsoft Viva employee experience platform?

Accepted Answer

Viva Insights. Viva Insights is correct because it is a core module of the Microsoft Viva employee experience platform that provides data-driven, privacy-protected insights to help individuals and managers improve productivity, wellbeing, and work-life balance. It leverages Microsoft Graph data to analyze collaboration patterns and deliver actionable recommendations directly within Microsoft Teams and the Viva Insights app.

Answer

Viva Engage

Answer

Microsoft Teams

Question 12

Which TWO Microsoft 365 services provide capabilities for insider risk management?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management (option B) is a dedicated service that uses machine learning and behavioral analytics to detect, investigate, and respond to risky user activities such as data theft, policy violations, or unauthorized access. It correlates signals from Microsoft 365 logs, HR data, and user behavior to identify potential insider threats, making it the primary tool for insider risk management.

Answer

Microsoft Entra ID

Answer

Microsoft Intune

Answer

Microsoft Defender XDR

Question 13

Refer to the exhibit. The JSON shows a device compliance policy assignment in Microsoft Intune. Based on the exhibit, what is the current compliance status of the devices in the target group?

Accepted Answer

Not compliant, because the encryption setting is not compliant. The exhibit shows a device compliance policy in Microsoft Intune with two settings: 'require device encryption' set to 'Required' and 'minimum password length' set to '6'. The compliance status for the target group is 'Not compliant, because the encryption setting is not compliant'. This is because the JSON indicates that the encryption requirement is not being met by the devices in the group, likely due to BitLocker or device encryption not being enabled. The password setting alone does not override the encryption non-compliance, as all required settings must be satisfied for a device to be marked compliant.

Answer

Not compliant, only because the password setting is missing

Answer

Compliant, because both settings are compliant

Answer

Compliant, because the password setting is compliant

Question 14

Refer to the exhibit. The JSON shows Microsoft Entra ID role assignments using Privileged Identity Management (PIM). Which statement about user2@contoso.com is correct?

Accepted Answer

user2 must activate the Global Administrator role before using it. Option C is correct because the JSON shows that user2@contoso.com has an eligible assignment for the Global Administrator role via Microsoft Entra ID PIM. In PIM, an eligible assignment means the user must activate the role (e.g., through the PIM portal or API) before gaining administrative privileges. The JSON snippet includes a property like "assignmentType": "Eligible" (implied by the context), which requires activation to elevate permissions temporarily.

Answer

user2 is not assigned any administrative role

Answer

user2 cannot access any administrative features

Answer

user2 is permanently assigned the Global Administrator role

Question 15

Refer to the exhibit. The PowerShell script retrieves compliance tags from Microsoft Purview. What does the script do?

Accepted Answer

Outputs the name and retention duration for compliance tags that delete data. The script uses Get-ComplianceTag to retrieve all compliance tags, then filters with Where-Object to select only those where the RetentionAction property equals 'Delete'. For each matching tag, it outputs the Name and RetentionDuration. This directly matches option C: it outputs the name and retention duration for compliance tags that delete data.

Answer

Changes the retention action from Delete to Archive

Answer

Deletes compliance tags that have a Delete retention action

Answer

Lists all compliance tags and their retention actions