MS-900 Timed Practice Test 2 — 10 Questions

Question 1

A company runs its customer relationship management (CRM) system using a cloud provider's SaaS offering. They also use virtual machines (IaaS) from the same provider to host a legacy application. In this scenario, who is responsible for patching the operating system of the virtual machines?

10 minute time limit — choose an answer to begin.

Accepted Answer

The customer is responsible for patching the operating system of the virtual machines.. In an IaaS model, the cloud provider is responsible for the security of the physical infrastructure, hypervisor, and network, but the customer retains responsibility for the guest operating system and applications. Since the virtual machines are IaaS resources, the customer must manage OS patches, updates, and configuration. This follows the shared responsibility model, where the customer is accountable for anything they configure or deploy within the virtual machine.

Answer

The cloud provider is fully responsible for patching all components.

Answer

The cloud provider patches the OS for all services equally.

Answer

No patching is needed because the cloud handles everything.

Question 2

A sales team needs a centralized repository for customer proposals that multiple team members can edit simultaneously and that maintains version history. Which Microsoft 365 service should they use?

Accepted Answer

SharePoint Online. SharePoint Online is the correct choice because it provides a centralized document library where multiple users can co-author documents simultaneously, with built-in version history to track changes over time. This aligns directly with the requirement for a shared repository with real-time collaboration and versioning, which OneDrive for Business lacks for team-wide access.

Answer

OneDrive for Business

Answer

Microsoft Teams

Answer

Exchange Online

Question 3

A business stakeholder asks how Microsoft 365 can help them desktop Office apps plus business email and collaboration services without advanced security management. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Microsoft 365 Business Standard. Microsoft 365 Business Standard is the correct licensing plan because it includes desktop versions of Office apps (e.g., Word, Excel, PowerPoint), business-class email via Exchange Online, and collaboration services like Microsoft Teams and SharePoint—all without requiring advanced security management features such as Microsoft Defender for Office 365 or Azure Information Protection. This plan is designed for businesses that need core productivity and communication tools without the complexity of enterprise-grade security controls.

Answer

Microsoft Stream

Answer

Microsoft Forms

Answer

Microsoft Whiteboard

Question 4

A growing company with 120 users currently holds Microsoft 365 Business Basic licenses. They need to add endpoint management (Microsoft Intune) and advanced threat protection (Microsoft Defender for Office 365 Plan 1). They also want to keep their existing Business Basic subscriptions. What is the most cost-effective way to add these capabilities?

Accepted Answer

Purchase add-on subscriptions for Microsoft Intune Plan 1 and Microsoft Defender for Office 365 Plan 1. Microsoft 365 Business Basic supports add-on subscriptions for Microsoft Intune Plan 1 and Microsoft Defender for Office 365 Plan 1, allowing the company to retain their existing licenses while adding endpoint management and advanced threat protection. This is the most cost-effective approach as it avoids the higher per-user cost of upgrading to Business Premium or switching to E3, which would include unnecessary features like desktop Office apps.

Answer

Upgrade all users to Microsoft 365 Business Premium

Answer

Add Microsoft 365 Business Premium licenses as a standalone for all users

Answer

Switch to Microsoft 365 E3 and drop Business Basic

Question 5

A startup with 25 employees needs business-grade email (50 GB mailbox per user), web versions of Office apps, and 1 TB of cloud storage per user. They do not need the desktop versions of Office or advanced security features. Which Microsoft 365 plan is the most cost-effective choice?

Accepted Answer

Microsoft 365 Business Basic. Microsoft 365 Business Basic provides business-grade email with 50 GB mailboxes, web versions of Office apps (Word, Excel, PowerPoint, etc.), and 1 TB of cloud storage per user via OneDrive for Business. Since the startup does not need desktop Office apps or advanced security features, this plan meets all stated requirements at the lowest cost.

Answer

Microsoft 365 Business Standard

Answer

Microsoft 365 Business Premium

Answer

Microsoft 365 Apps for business

Question 6

A company wants to provide its employees with access to email, calendar, and document editing tools through a web browser without installing any software. The provider manages all maintenance, updates, and security of the applications. Which cloud service model best describes this scenario?

Accepted Answer

Software as a Service (SaaS). This scenario describes Software as a Service (SaaS) because the provider delivers fully functional applications—such as email, calendar, and document editing—over the web, with no local installation required. The provider handles all maintenance, updates, and security, which is the defining characteristic of SaaS. Examples include Microsoft 365 (Exchange Online, Outlook, Word Online) and Google Workspace.

Answer

Infrastructure as a Service (IaaS)

Answer

Platform as a Service (PaaS)

Answer

Desktop as a Service (DaaS)

Question 7

A healthcare provider must ensure that patient health information (PHI) is not accidentally shared outside the organization. They want to automatically detect if an email contains PHI (such as diagnosis codes) and block it from being sent externally. Additionally, the sender should receive a notification explaining the block. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive information—such as patient health information (PHI) with diagnosis codes—in emails and automatically block external transmission while sending a notification to the sender. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) and rules to enforce actions like blocking and policy tips.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Audit

Question 8

While preparing a Microsoft 365 adoption plan, a consultant is asked to desktop Office apps plus Intune and enhanced security capabilities for a small or medium business. Microsoft 365 licensing, admin, or support concept is most relevant?

Accepted Answer

Microsoft 365 Business Premium. Microsoft 365 Business Premium is the correct answer because it bundles desktop Office apps, Microsoft Intune for mobile device management, and advanced security features like Microsoft Defender for Business and Microsoft Entra ID Plan 1. This plan is specifically designed for small and medium businesses needing comprehensive productivity, management, and security capabilities under a single subscription.

Answer

Microsoft Stream

Answer

Microsoft Whiteboard

Answer

Microsoft Forms

Question 9

A company uses Microsoft 365 (a SaaS offering). A security incident occurs where an employee's account is compromised because the employee reused their corporate password on a personal website. According to the shared responsibility model, who is primarily responsible for this security failure?

Accepted Answer

The customer (the company using Microsoft 365). In the Microsoft 365 shared responsibility model, the customer is responsible for securing user identities, including password hygiene and multi-factor authentication (MFA). Since the employee reused their corporate password on a personal website, this is a customer-side identity management failure, not a platform vulnerability. Microsoft secures the SaaS infrastructure, but customer-managed credentials fall under the customer's responsibility.

Answer

Microsoft, because they provide the SaaS platform

Answer

Both Microsoft and the customer share equal responsibility

Answer

It depends on the contract terms with Microsoft

Question 10

A company uses a cloud service that provides virtual machines. The company manages the operating system, middleware, and applications, while the cloud provider manages the physical hardware, networking, and data center security. Which cloud service model does this represent?

Accepted Answer

Infrastructure as a Service (IaaS). This scenario describes Infrastructure as a Service (IaaS) because the customer manages the operating system, middleware, and applications, while the cloud provider is responsible for the physical hardware, networking, and data center security. In IaaS, the provider delivers virtualized computing resources over the internet, and the customer retains control over the guest OS, storage, and deployed applications, which matches the division of responsibilities given.

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Answer

Desktop as a Service (DaaS)