MS-900 Multiple Select — 10 Questions

Question 1

A project manager wants to automate the process of sending a welcome email to new team members when they are added to a SharePoint site. Which two Microsoft 365 technologies should they use? (Choose two.)

Accepted Answer

Microsoft Power Automate. Microsoft Power Automate is correct because it provides the workflow automation capabilities needed to trigger a welcome email when a new member is added to a SharePoint site. It integrates directly with SharePoint's 'When an item is created or modified' trigger to initiate the automated email action.

Answer

Microsoft Power Apps

Answer

Microsoft Outlook

Question 2

A security team wants Microsoft 365 access to be allowed only when a user's device is marked compliant by management policy. Which two capabilities are normally combined? (Choose two.)

Accepted Answer

Microsoft Intune compliance policies. Microsoft Intune compliance policies define the rules that a device must meet (e.g., encryption, OS version, threat level) to be considered compliant. Conditional Access enforces access decisions based on signals like device compliance status, blocking or granting access to Microsoft 365 services. Together, they ensure only compliant devices can access corporate resources.

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 3

A multinational corporation must comply with GDPR. They need to ensure that personal data of EU residents is retained for a specific period and then securely deleted. Additionally, they must be able to respond to data subject access requests (DSARs) within 30 days by finding and exporting relevant data. Which two Microsoft Purview solutions should they use together? (Choose two.)

Accepted Answer

Retention policies. Retention policies (A) are correct because they allow organizations to define rules that retain personal data for a specific period and then automatically delete it, meeting GDPR retention and secure deletion requirements. eDiscovery (Premium) (C) is correct because it enables searching, collecting, and exporting data from various Microsoft 365 workloads to fulfill data subject access requests (DSARs) within the 30-day regulatory timeframe.

Answer

Data Lifecycle Management (via sensitivity labels)

Answer

Audit (Standard)

Question 4

A company uses a cloud service where they pay only for the compute hours their virtual machines run. They can increase or decrease the number of VMs instantly based on demand. Which two cloud computing characteristics are demonstrated? (Choose two.)

Accepted Answer

Rapid elasticity. B is correct because rapid elasticity allows the company to instantly increase or decrease the number of virtual machines based on demand, scaling resources up or down automatically. C is correct because measured service ensures that the company pays only for the compute hours their VMs run, with usage metered and billed accordingly.

Answer

On-demand self-service

Answer

Resource pooling

Question 5

An organization wants to retain mailbox content for legal investigation. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

eDiscovery and retention capabilities in Microsoft Purview. Security and compliance controls should be selected by risk scenario and tested before tenant-wide enforcement.

Answer

It requires every document to be made public

Answer

It replaces the need for identity and access management

Question 6

Which two statements correctly describe SaaS in a cloud computing model? (Choose 2.)

Accepted Answer

Users access a complete application provided by the cloud service provider.. Option A is correct because in the SaaS model, users access a complete application—such as Microsoft 365—that is hosted and managed entirely by the cloud service provider. The provider handles all aspects of the application, including availability, performance, and security, while the user simply consumes the software via a web browser or client. This aligns with the NIST definition of SaaS, where the consumer does not manage or control the underlying cloud infrastructure or even individual application capabilities.

Answer

Customers manage the operating system patching.

Answer

Customers deploy their own runtime environment.

Question 7

Which four of the following are key components of the Microsoft 365 defense-in-depth security strategy? (Choose all that apply. There are four correct answers.)

Accepted Answer

Advanced Threat Protection (ATP) for email, SharePoint, and Teams, including anti-malware and anti-phishing.. The Microsoft 365 defense-in-depth strategy relies on multiple layers of security controls. Physical security of datacenters (biometric access, 24/7 monitoring) is the foundational layer. User identity protection via Azure AD MFA and Conditional Access secures the authentication layer. Data encryption at rest (BitLocker) and in transit (TLS) protects data confidentiality. Advanced Threat Protection (ATP) for email, SharePoint, and Teams defends against malware and phishing at the workload layer. These four components collectively implement a layered security model.

Answer

Unrestricted access for Microsoft engineers to all customer data for continuous security scanning.

Answer

Automated rollback of all user changes to previous versions within 24 hours.

Question 8

An e-commerce company hosts its website on a public cloud IaaS platform. The site experiences varying traffic throughout the year. The cloud provider automatically adds more virtual servers during peak traffic and removes them when demand drops. The company only pays for the resources used during each period. Which two cloud characteristics are demonstrated? (Choose two.)

Accepted Answer

Rapid elasticity. Rapid elasticity is demonstrated because the cloud provider automatically scales virtual servers up or down in response to varying traffic, which is a key characteristic of cloud computing where resources can be provisioned and released elastically to match demand. Measured service is demonstrated because the company only pays for the resources used during each period, meaning the provider meters resource usage (e.g., CPU hours, memory, bandwidth) and bills accordingly, which is a core attribute of cloud services.

Answer

On-demand self-service

Answer

Resource pooling

Question 9

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 is a powerful tool for investigating phishing campaigns. It allows security analysts to view and filter email threat data, including malware, phishing, and spam, in near real-time. This enables the organization to identify, analyze, and remediate malicious emails that are part of a phishing campaign, making option A correct.

Answer

It replaces the need for identity and access management

Answer

It requires every document to be made public

Question 10

Which three of the following correctly describe the shared responsibility model in Microsoft 365? (Choose three.)

Accepted Answer

Microsoft is responsible for the physical security of its datacenters.. The shared responsibility model delineates security and compliance obligations between Microsoft and the customer. Microsoft is responsible for the physical security of its datacenters, including access controls, surveillance, and environmental protections. The customer is responsible for managing user identities and access, such as configuring Azure Active Directory, enforcing multi-factor authentication, and controlling permissions. Microsoft is responsible for maintaining the underlying network infrastructure, including the physical network hardware, routing, and connectivity within its datacenters and between regions.

Answer

The customer is responsible for physical security of client devices used to access Microsoft 365.

Answer

Microsoft is responsible for ensuring customer data is backed up in all scenarios.

Answer

The customer is responsible for patching the operating system of Exchange Online servers.