MS-900 Describe Microsoft 365 apps and services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Microsoft Intune App Protection Policies

  Why this is correct

  Intune App Protection Policies (APP) are the correct choice because they provide mobile application management (MAM) capabilities that do not require device enrollment or full device management. APP applies policy directly to managed apps, allowing control over corporate data via features like preventing copy/paste, restricting save-as, enforcing app-level encryption, and enabling selective wipe of corporate data without removing personal data from a BYOD device. This gives protection of corporate data within apps on unmanaged personal devices, which is exactly what is needed for employees working from home on personal devices.

• ✗

  Microsoft Defender for Endpoint

  Why it's wrong here

  Microsoft Defender for Endpoint is an endpoint detection and response (EDR) solution focused on threat detection, vulnerability management, and remediating malware or suspicious activity on devices. It requires devices to be onboarded or enrolled into the service, which is problematic for personal BYOD devices that should not be managed by the organization. Even if installed, Defender for Endpoint protects the device from threats but does not restrict or contain the corporate data inside individual apps, nor does it provide app-level data-loss features such as selective wipe or copy/paste restrictions.

• ✗

  Microsoft Entra Conditional Access

  Why it's wrong here

  Microsoft Entra Conditional Access is an identity-driven access control mechanism that uses signals like user, location, device health, and risk to grant or block access to cloud applications. It is excellent for controlling whether and how a user can access resources, but it only operates at the authentication or session level—it does not protect data within those applications after access is granted. For example, Conditional Access cannot prevent a user from copying sensitive data from a corporate app to a personal app on an unmanaged device, so it does not address the requirement to protect data within apps on personal devices.

• ✗

  Microsoft Purview Data Loss Prevention

  Why it's wrong here

  Microsoft Purview Data Loss Prevention (DLP) is designed to identify, monitor, and protect sensitive data across locations like Exchange, SharePoint, and endpoints by applying policies that block or alert on risky sharing of data. DLP typically operates at the file or message level, scanning content for sensitive information types, but it does not apply application-level controls to mobile apps on personal devices. On a lost or unmanaged device, DLP cannot selectively remove corporate data from an app or enforce an app PIN/policy, making it ineffective for the scenario of protecting corporate data on personal, often unmanaged, devices.

Go deeper

Related to this question