MS-900 Multiple Select — 20 Questions

Question 1

A project manager wants to automate the process of sending a welcome email to new team members when they are added to a SharePoint site. Which two Microsoft 365 technologies should they use? (Choose two.)

Accepted Answer

Microsoft Power Automate. Microsoft Power Automate is correct because it provides the workflow automation capabilities needed to trigger a welcome email when a new member is added to a SharePoint site. It integrates directly with SharePoint's 'When an item is created or modified' trigger to initiate the automated email action.

Answer

Microsoft Power Apps

Answer

Microsoft Outlook

Question 2

A security team wants Microsoft 365 access to be allowed only when a user's device is marked compliant by management policy. Which two capabilities are normally combined? (Choose two.)

Accepted Answer

Microsoft Intune compliance policies. Microsoft Intune compliance policies define the rules that a device must meet (e.g., encryption, OS version, threat level) to be considered compliant. Conditional Access enforces access decisions based on signals like device compliance status, blocking or granting access to Microsoft 365 services. Together, they ensure only compliant devices can access corporate resources.

Answer

Microsoft Stream

Answer

Microsoft Forms

Question 3

A multinational corporation must comply with GDPR. They need to ensure that personal data of EU residents is retained for a specific period and then securely deleted. Additionally, they must be able to respond to data subject access requests (DSARs) within 30 days by finding and exporting relevant data. Which two Microsoft Purview solutions should they use together? (Choose two.)

Accepted Answer

Retention policies. Retention policies (A) are correct because they allow organizations to define rules that retain personal data for a specific period and then automatically delete it, meeting GDPR retention and secure deletion requirements. eDiscovery (Premium) (C) is correct because it enables searching, collecting, and exporting data from various Microsoft 365 workloads to fulfill data subject access requests (DSARs) within the 30-day regulatory timeframe.

Answer

Data Lifecycle Management (via sensitivity labels)

Answer

Audit (Standard)

Question 4

A company uses a cloud service where they pay only for the compute hours their virtual machines run. They can increase or decrease the number of VMs instantly based on demand. Which two cloud computing characteristics are demonstrated? (Choose two.)

Accepted Answer

Rapid elasticity. B is correct because rapid elasticity allows the company to instantly increase or decrease the number of virtual machines based on demand, scaling resources up or down automatically. C is correct because measured service ensures that the company pays only for the compute hours their VMs run, with usage metered and billed accordingly.

Answer

On-demand self-service

Answer

Resource pooling

Question 5

An organization wants to retain mailbox content for legal investigation. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

eDiscovery and retention capabilities in Microsoft Purview. Security and compliance controls should be selected by risk scenario and tested before tenant-wide enforcement.

Answer

It requires every document to be made public

Answer

It replaces the need for identity and access management

Question 6

Which two statements correctly describe SaaS in a cloud computing model? (Choose 2.)

Accepted Answer

Users access a complete application provided by the cloud service provider.. Option A is correct because in the SaaS model, users access a complete application—such as Microsoft 365—that is hosted and managed entirely by the cloud service provider. The provider handles all aspects of the application, including availability, performance, and security, while the user simply consumes the software via a web browser or client. This aligns with the NIST definition of SaaS, where the consumer does not manage or control the underlying cloud infrastructure or even individual application capabilities.

Answer

Customers manage the operating system patching.

Answer

Customers deploy their own runtime environment.

Question 7

Which four of the following are key components of the Microsoft 365 defense-in-depth security strategy? (Choose all that apply. There are four correct answers.)

Accepted Answer

Advanced Threat Protection (ATP) for email, SharePoint, and Teams, including anti-malware and anti-phishing.. The Microsoft 365 defense-in-depth strategy relies on multiple layers of security controls. Physical security of datacenters (biometric access, 24/7 monitoring) is the foundational layer. User identity protection via Azure AD MFA and Conditional Access secures the authentication layer. Data encryption at rest (BitLocker) and in transit (TLS) protects data confidentiality. Advanced Threat Protection (ATP) for email, SharePoint, and Teams defends against malware and phishing at the workload layer. These four components collectively implement a layered security model.

Answer

Unrestricted access for Microsoft engineers to all customer data for continuous security scanning.

Answer

Automated rollback of all user changes to previous versions within 24 hours.

Question 8

An e-commerce company hosts its website on a public cloud IaaS platform. The site experiences varying traffic throughout the year. The cloud provider automatically adds more virtual servers during peak traffic and removes them when demand drops. The company only pays for the resources used during each period. Which two cloud characteristics are demonstrated? (Choose two.)

Accepted Answer

Rapid elasticity. Rapid elasticity is demonstrated because the cloud provider automatically scales virtual servers up or down in response to varying traffic, which is a key characteristic of cloud computing where resources can be provisioned and released elastically to match demand. Measured service is demonstrated because the company only pays for the resources used during each period, meaning the provider meters resource usage (e.g., CPU hours, memory, bandwidth) and bills accordingly, which is a core attribute of cloud services.

Answer

On-demand self-service

Answer

Resource pooling

Question 9

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

Threat Explorer in Microsoft Defender for Office 365. Threat Explorer in Microsoft Defender for Office 365 is a powerful tool for investigating phishing campaigns. It allows security analysts to view and filter email threat data, including malware, phishing, and spam, in near real-time. This enables the organization to identify, analyze, and remediate malicious emails that are part of a phishing campaign, making option A correct.

Answer

It replaces the need for identity and access management

Answer

It requires every document to be made public

Question 10

Which three of the following correctly describe the shared responsibility model in Microsoft 365? (Choose three.)

Accepted Answer

Microsoft is responsible for maintaining the underlying network infrastructure.. The shared responsibility model delineates security and compliance obligations between Microsoft and the customer. Microsoft is responsible for the physical security of its datacenters, including access controls, surveillance, and environmental protections. The customer is responsible for managing user identities and access, such as configuring Azure Active Directory, enforcing multi-factor authentication, and controlling permissions. Microsoft is responsible for maintaining the underlying network infrastructure, including the physical network hardware, routing, and connectivity within its datacenters and between regions.

Answer

The customer is responsible for physical security of client devices used to access Microsoft 365.

Answer

Microsoft is responsible for ensuring customer data is backed up in all scenarios.

Answer

The customer is responsible for patching the operating system of Exchange Online servers.

Question 11

Which three of the following are core components of Microsoft’s Zero Trust security model as implemented in Microsoft 365? (Choose three.)

Accepted Answer

Assume breach. The Zero Trust security model is built on three foundational principles: verify explicitly, use least privileged access, and assume breach. In Microsoft 365, 'verify explicitly' means authenticating and authorizing every access request based on all available data points (user identity, device health, location, etc.). 'Use least privileged access' limits user permissions to only what is necessary, enforced through tools like Privileged Identity Management (PIM) and Conditional Access. 'Assume breach' designs the environment to minimize blast radius and segment access, assuming an attacker is already present, which drives practices like micro-segmentation and continuous monitoring.

Answer

Deploy a single firewall for all traffic

Answer

Encrypt all data at rest only

Answer

Require on-premises identity provider

Question 12

An organisation wants to identify documents containing credit card numbers and prevent users from sharing them externally from SharePoint Online and Exchange Online. Which two Microsoft Purview capabilities are most relevant? (Choose 2.)

Accepted Answer

Sensitive information types.. Sensitive information types (A) are predefined or custom patterns that detect sensitive data like credit card numbers using regex and checksum validation. Data Loss Prevention policies (B) use these sensitive information types to enforce rules that block external sharing of documents containing credit card numbers in SharePoint Online and Exchange Online. Together, they identify the sensitive content and prevent its unauthorized external distribution.

Answer

Microsoft Bookings.

Answer

Windows Autopilot.

Question 13

Which three options are valid support options available to Microsoft 365 subscribers? (Choose three.)

Accepted Answer

Self-help resources including online documentation and guided troubleshooting.. Community forums monitored by Microsoft experts and MVPs are a valid support option for Microsoft 365 subscribers, providing peer-to-peer assistance with expert oversight. Self-help resources, including online documentation and guided troubleshooting, are available to all subscribers as a first-line support channel. Administrative support via the Microsoft 365 admin center is included for all paying subscribers, allowing them to create service requests for billing, account, and technical issues.

Answer

In-person on-site support included with every Business Premium subscription.

Answer

Unlimited access to premier support engineers for all plans.

Answer

Dedicated phone support available 24/7 for all subscription plans.

Question 14

A team is working on a project proposal that requires simultaneous input from multiple team members. They need to see each other's changes in real time and have a full revision history. Which two Microsoft 365 applications support this capability? (Choose two.)

Accepted Answer

Word for the web. Word for the web and Excel for the web support real-time co-authoring, allowing multiple users to edit the same document simultaneously with changes visible to all collaborators within seconds. They also maintain a full revision history via versioning, enabling users to view, restore, or compare previous versions. This capability is built on the Office Online Server infrastructure and uses WebSocket-based synchronization for low-latency updates.

Answer

Outlook on the web

Answer

OneNote for Windows 10

Question 15

A business wants to use a cloud solution where they can scale computing resources up or down automatically based on demand and only pay for what they use. The cloud provider manages the underlying hardware. Which two cloud characteristics are being described? (Choose two.)

Accepted Answer

Elasticity. Elasticity is correct because it describes the ability to automatically scale computing resources up or down based on demand, which is a key characteristic of cloud computing. The scenario explicitly states that resources scale automatically, which aligns with elasticity rather than just the ability to scale (scalability). Measured service is correct because the business pays only for what they use, which is the pay-per-use billing model enabled by metering resource consumption.

Answer

Scalability

Answer

High availability

Question 16

Which three factors should a customer consider when estimating the total cost of ownership (TCO) for Microsoft 365 compared to on-premises solutions? (Choose three.)

Accepted Answer

Subscription licensing fees are typically predictable monthly or annual costs.. Subscription licensing fees for Microsoft 365 are predictable monthly or annual costs, which simplifies budgeting compared to the variable costs of on-premises solutions. Cloud solutions eliminate the need for hardware procurement and maintenance, as Microsoft manages the underlying infrastructure. IT staff time for patching and updates is reduced with Microsoft 365 because Microsoft handles these tasks, freeing up IT resources for other priorities.

Answer

On-premises solutions generally have lower security compliance costs than cloud subscriptions.

Answer

Migration costs for moving existing data to the cloud are always included in the subscription price.

Answer

Microsoft 365 always offers a lower TCO than any on-premises deployment.

Question 17

An organization wants to block sharing of documents containing credit card numbers. Which two statements are accurate about the Microsoft 365 capability involved?

Accepted Answer

Data Loss Prevention policies. Data Loss Prevention (DLP) policies in Microsoft 365 are specifically designed to detect and block the sharing of sensitive information, such as credit card numbers, by scanning content for predefined or custom sensitive information types. When a match is found, DLP can enforce actions like blocking the share or sending a notification, directly addressing the organization's requirement. This capability operates across Exchange Online, SharePoint, OneDrive, and Teams, providing comprehensive protection against accidental or malicious data leaks.

Answer

It replaces the need for identity and access management

Answer

It requires every document to be made public

Question 18

Which three options describe key capabilities of Microsoft Purview that help organizations manage compliance and data governance in Microsoft 365? (Choose three.)

Accepted Answer

Apply retention policies and labels to preserve or delete content based on legal requirements. Microsoft Purview provides integrated data governance and compliance capabilities across Microsoft 365. It automatically classifies and labels sensitive data using trainable classifiers and exact data match, applies retention policies and labels to meet legal and regulatory requirements, and enables eDiscovery searches with legal hold to preserve content for litigation. These three capabilities directly address data classification, lifecycle management, and legal discovery.

Answer

Manage user passwords and enforce multi-factor authentication

Answer

Monitor network traffic to prevent DDoS attacks

Answer

Provide anti-malware and phishing protection in email

Question 19

A healthcare organization must encrypt outbound email automatically when a message contains passport numbers. Which two Microsoft Purview capabilities are commonly combined? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct answer because it provides the policy engine that detects sensitive information, such as passport numbers, in outbound email. When a DLP rule matches, it can trigger automatic encryption of the message using Microsoft Purview Message Encryption, ensuring the email is protected before leaving the organization.

Answer

Microsoft Planner

Answer

Microsoft Viva Engage

Question 20

A healthcare organization must protect patient health information (PHI) from being accidentally shared externally via email. They need to automatically block emails containing medical record numbers from being sent outside the organization and also encrypt any email that does contain PHI when it is allowed. Which two Microsoft Purview solutions should they combine? (Choose two.)

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is correct because it can automatically detect sensitive data, such as medical record numbers (PHI), in emails and apply policy actions like blocking external transmission. This directly addresses the requirement to prevent accidental sharing of PHI via email.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit (Standard)