Microsoft 365 Fundamentals MS-900 MS-900 Questions 151–225 | Page 3/14

151

Multi-Selectmedium

Which three options are valid support options available to Microsoft 365 subscribers? (Choose three.)

Select 3 answers

.Community forums monitored by Microsoft experts and MVPs.

.Dedicated phone support available 24/7 for all subscription plans.

.Unlimited access to premier support engineers for all plans.

.Administrative support via the Microsoft 365 admin center for all paying subscribers.

.Self-help resources including online documentation and guided troubleshooting.

.In-person on-site support included with every Business Premium subscription.

Why this answer

Community forums monitored by Microsoft experts and MVPs are a valid support option for Microsoft 365 subscribers, providing peer-to-peer assistance with expert oversight. Self-help resources, including online documentation and guided troubleshooting, are available to all subscribers as a first-line support channel. Administrative support via the Microsoft 365 admin center is included for all paying subscribers, allowing them to create service requests for billing, account, and technical issues.

Exam trap

The trap here is that candidates often assume phone support is universally available 24/7 for all plans, but Microsoft restricts phone support to higher-tier subscriptions and imposes call-back scheduling for lower tiers.

Full explanation →

152

MCQmedium

A sales representative needs to quickly create a professional-looking price quote that includes dynamic pricing from a company database and send it as a PDF to a customer. Which Microsoft 365 app is best suited for this?

A.Microsoft Word

B.Microsoft Excel

C.Microsoft Sway

D.Microsoft SharePoint Online

AnswerA

Word provides advanced formatting, tables, and the ability to incorporate dynamic data through connections to databases or Excel. It can be easily saved and shared as a professional PDF.

Why this answer

Microsoft Word is best suited because it supports mail merge and dynamic content from external data sources like a company database. Using Word's 'Insert Quick Parts' or mail merge features, a sales rep can pull live pricing data into a professional quote template and then export the document as a PDF directly from Word.

Exam trap

The trap here is that candidates often confuse Excel's data calculation capabilities with document creation, assuming a spreadsheet can produce a professional quote, but Word is the correct app for formatted, PDF-ready documents with dynamic content.

How to eliminate wrong answers

Option B is wrong because Microsoft Excel is a spreadsheet app optimized for data analysis and calculations, not for creating professional-looking documents with dynamic text and images; it lacks the rich layout and PDF export capabilities needed for a polished quote. Option C is wrong because Microsoft Sway is a presentation and storytelling app for interactive web-based content, not for generating static PDF documents with dynamic database-driven pricing. Option D is wrong because Microsoft SharePoint Online is a collaboration and document management platform, not a content creation app; it cannot directly create a formatted quote with dynamic pricing from a database.

Full explanation →

153

MCQmedium

A department head asks which Microsoft 365 option should be used to delegate Teams policy and meeting administration. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Whiteboard

B.Microsoft Stream

C.Microsoft Forms

D.Teams Administrator

AnswerD

Teams Administrator manages Teams configuration without full tenant control.

Why this answer

The Teams Administrator role in Microsoft 365 provides the specific permissions needed to manage Teams policies, including meeting policies, and to administer Teams settings. This role is part of the Azure AD administrative roles and is the correct delegation option for a department head looking to assign Teams policy and meeting administration without granting broader administrative access.

Exam trap

The trap here is that candidates may confuse collaboration tools (Whiteboard, Stream, Forms) with administrative roles, mistakenly thinking a feature product can handle delegation instead of recognizing that administrative delegation requires a specific Azure AD role like Teams Administrator.

How to eliminate wrong answers

Option A is wrong because Microsoft Whiteboard is a digital canvas collaboration tool, not an administrative role or licensing concept for delegating Teams policy management. Option B is wrong because Microsoft Stream is a video service for recording and sharing videos, unrelated to administrative delegation of Teams policies. Option C is wrong because Microsoft Forms is a survey and quiz creation tool, not an administrative role or licensing concept for managing Teams policies.

Full explanation →

154

Multi-Selecteasy

Which TWO of the following support options are available for Microsoft 365?

Select 2 answers

A.On-site support

B.Phone support

C.Chat support

D.Online support via the Microsoft 365 admin center

E.Email support

AnswersB, D

Phone support is available for some Microsoft 365 plans.

Why this answer

Phone support (B) is a standard support channel for Microsoft 365, available to all subscribers with a qualifying support plan, allowing users to call Microsoft directly for technical assistance. Online support via the Microsoft 365 admin center (D) is the primary self-service and ticket-based support portal where administrators can submit service requests, access health dashboards, and manage support cases.

Exam trap

The trap here is that candidates often confuse chat support (C) as a standard Microsoft 365 support option, but it is not explicitly listed in the official support channels, which are limited to phone and online via the admin center.

Full explanation →

155

MCQhard

Refer to the exhibit. The exhibit shows a Conditional Access policy. Which requirement does this policy enforce?

A.Users from trusted IPs are blocked.

B.Users must provide MFA only.

C.Users must provide MFA and use a compliant device.

D.Users must provide MFA or use a compliant device.

AnswerC

Grant controls include MFA and compliant device with AND operator.

Why this answer

Option B is correct because the policy requires both MFA and compliant device (AND operator). Option A is incorrect because it requires both, not either. Option C is incorrect because it enforces both controls.

Option D is incorrect because it includes all locations except Trusted IPs, but Trusted IPs are excluded, so the policy does not apply to them; it does not block access.

Full explanation →

156

Multi-Selectmedium

Which TWO support plans provide access to Microsoft 365 technical support via phone and email with a guaranteed response time?

Select 2 answers

A.Microsoft Developer Support

B.Microsoft Unified Support

C.Microsoft 365 Business Support

D.Microsoft Premier Support

E.Microsoft Community Support

AnswersB, C

Enterprise-level support with phone/email and SLAs.

Why this answer

Microsoft Unified Support (B) and Microsoft 365 Business Support (C) are the only plans that include phone and email technical support with guaranteed response times based on severity. Microsoft 365 Business Support is designed for organizations with fewer than 300 users, while Unified Support is an enterprise-grade plan that offers proactive services and faster SLAs. Both plans explicitly list phone and email as supported channels with defined response time commitments in their service descriptions.

Exam trap

The trap here is that candidates often confuse Microsoft Premier Support (a legacy plan) with Unified Support, or assume that Developer Support includes phone support for administrative issues, but the exam specifically tests that only Unified Support and Microsoft 365 Business Support offer phone and email with guaranteed response times.

Full explanation →

157

Multi-Selecteasy

Which TWO Microsoft 365 services can be used to create and manage custom forms for data collection and surveys?

Select 2 answers

A.Microsoft Lists

B.Microsoft Forms

C.Excel Online

D.Power Apps

E.SharePoint Lists

AnswersB, D

Forms is designed for creating surveys and quizzes.

Why this answer

Microsoft Forms is purpose-built for creating custom forms, surveys, and quizzes with automatic data collection into Excel Online. It provides a simple interface for designing forms, distributing them, and analyzing responses in real time, making it the primary tool for this task in Microsoft 365.

Exam trap

The trap here is that candidates often confuse Microsoft Lists or SharePoint Lists with form creation tools because they can display data in a form-like view, but they lack the native survey and data collection functionality that Microsoft Forms provides.

Full explanation →

158

MCQmedium

A company wants monthly billing based on the number of Microsoft 365 users assigned licenses. Which cloud characteristic does this represent?

A.Fault tolerance

B.Resource pooling

C.Measured service

D.Rapid elasticity

AnswerC

Measured service means usage can be metered, monitored, and billed based on consumption or assigned service usage.

Why this answer

Measured service is a cloud characteristic where usage is metered and billed based on consumption. In this scenario, the company is billed monthly based on the number of Microsoft 365 users assigned licenses, which directly reflects metered usage of the service. This aligns with the pay-per-use model defined by NIST SP 800-145 for cloud computing.

Exam trap

The trap here is that candidates confuse 'measured service' with 'rapid elasticity' because both involve dynamic changes, but measured service is specifically about metering and billing, not about scaling resources.

How to eliminate wrong answers

Option A is wrong because fault tolerance refers to a system's ability to continue operating after a component failure, not to billing or usage metering. Option B is wrong because resource pooling describes the provider's multi-tenant model where physical and virtual resources are dynamically assigned to multiple customers, not the billing mechanism. Option D is wrong because rapid elasticity involves the ability to quickly scale resources up or down based on demand, which is unrelated to how usage is measured and billed.

Full explanation →

159

MCQeasy

A company wants to migrate their on-premises file servers to Microsoft 365. Which cloud service model describes this approach?

A.Platform as a Service (PaaS)

B.Software as a Service (SaaS)

C.Desktop as a Service (DaaS)

D.Infrastructure as a Service (IaaS)

AnswerD

IaaS provides virtualized computing resources like VMs and storage, suitable for migrating on-premises servers.

Why this answer

Option A is correct because IaaS provides virtualized computing resources over the internet, such as virtual machines and storage. Moving file servers to IaaS means they are still managed by the customer but hosted in the cloud. Option B (PaaS) is for application development and deployment without managing infrastructure, not file servers.

Option C (SaaS) provides ready-to-use software like Microsoft 365 apps, not infrastructure. Option D (DaaS) delivers virtual desktops, not file servers.

Full explanation →

160

MCQmedium

A department head asks which Microsoft 365 option should be used to find Microsoft 365 training and adoption guidance. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Learn and adoption resources

B.Microsoft Stream

C.Microsoft Forms

D.Microsoft Whiteboard

AnswerA

Microsoft provides documentation, training, and adoption resources.

Why this answer

Option A is correct because Microsoft Learn and adoption resources are specifically designed to provide training, documentation, and adoption guidance for Microsoft 365. This includes step-by-step learning paths, interactive modules, and deployment guides that help organizations plan and execute user adoption strategies, directly matching the department head's request.

Exam trap

The trap here is that candidates may confuse general productivity tools (like Stream, Forms, or Whiteboard) with dedicated training and adoption platforms, overlooking that Microsoft Learn and adoption resources are the official, centralized sources for guidance.

How to eliminate wrong answers

Option B is wrong because Microsoft Stream is a video service for recording, sharing, and managing videos within an organization, not a platform for training or adoption guidance. Option C is wrong because Microsoft Forms is a survey and quiz creation tool used for collecting data, not for delivering training or adoption resources. Option D is wrong because Microsoft Whiteboard is a digital canvas for real-time collaboration and brainstorming, not a repository for training or adoption content.

Full explanation →

161

MCQeasy

A tenant administrator applies the above configuration for Microsoft 365 Copilot. What is the result of this configuration?

A.Copilot will be enabled but will only use data from SharePoint and OneDrive; Exchange and Teams data are excluded.

B.Copilot will be enabled for all users and will access data from all Microsoft 365 services.

C.Copilot will be disabled because GraphConnectors is empty.

D.Copilot will only work for users in the European Union.

AnswerA

The configuration restricts content sources to SharePoint and OneDrive.

Why this answer

Option A is correct because the configuration shows that the 'Copilot' toggle is enabled, but the 'Data sources' section explicitly lists only SharePoint and OneDrive, with Exchange and Teams unchecked. This means Copilot will be active for users but will only index and retrieve data from SharePoint and OneDrive, excluding emails and Teams messages. The empty GraphConnectors list further confirms no external data sources are connected, but this does not disable Copilot itself.

Exam trap

The trap here is that candidates often assume an empty GraphConnectors list disables Copilot entirely, but in reality, Copilot remains enabled and functional with the internal Microsoft 365 data sources that are explicitly selected.

How to eliminate wrong answers

Option B is wrong because the configuration does not enable all data sources; Exchange and Teams are explicitly excluded, so Copilot will not access data from those services. Option C is wrong because an empty GraphConnectors list only means no external (third-party) data sources are connected; it does not disable Copilot, which still works with the selected Microsoft 365 data sources (SharePoint and OneDrive). Option D is wrong because there is no indication of any geographic restriction in the configuration; Copilot's availability is determined by licensing and tenant settings, not by a region-specific toggle in this UI.

Full explanation →

162

MCQeasy

A company uses cloud resources and notices that their monthly bill is based on the exact amount of storage and compute hours they consumed. They did not pay for any fixed, unused capacity. Which cloud characteristic does this describe?

A.Rapid elasticity

B.Resource pooling

C.On-demand self-service

D.Measured service

AnswerD

Measured service enables the provider to track usage and bill customers based on consumption.

Why this answer

Measured service is the cloud characteristic that enables usage-based billing, where customers pay only for the resources they actually consume (e.g., storage GB-hours, compute vCPU-hours) without any upfront or fixed costs for idle capacity. This is implemented through metering capabilities at the hypervisor or resource provider level, which track consumption in granular units and feed into billing systems. The scenario explicitly describes paying for exact consumption, which aligns directly with the pay-per-use model of measured service.

Exam trap

The trap here is that candidates confuse 'measured service' with 'on-demand self-service' because both involve user-driven provisioning, but measured service specifically addresses the metering and billing aspect, not the provisioning mechanism.

How to eliminate wrong answers

Option A is wrong because rapid elasticity refers to the ability to automatically scale resources up or down quickly in response to demand, not to billing based on consumption. Option B is wrong because resource pooling describes the provider's ability to serve multiple tenants from a shared physical infrastructure using multi-tenancy, not the metering or billing mechanism. Option C is wrong because on-demand self-service allows users to provision resources without human interaction via a web portal or API, but it does not inherently describe how those resources are billed or that unused capacity is not charged.

Full explanation →

163

MCQeasy

A non-profit organization uses Microsoft 365 Business Basic. They have 50 staff members who need to collaborate on documents in real time. The executive director wants to set up a centralized repository for all organizational policies that can be accessed by staff both online and offline on their mobile devices. Which solution should the organization use?

A.Create a SharePoint Online document library with versioning and enable offline sync.

B.Store documents in Exchange Online mailboxes as attachments.

C.Create a Microsoft Teams team with a channel for policies and use the Files tab.

D.Use OneDrive for Business shared folders for each policy document.

AnswerA

SharePoint Online is designed for centralized document management with offline access.

Why this answer

SharePoint Online document libraries support versioning, granular permissions, and offline sync via the OneDrive sync client or mobile app, making them ideal for a centralized, always-accessible policy repository. This meets the requirements for real-time collaboration and offline access on mobile devices.

Exam trap

The trap here is that candidates may confuse OneDrive for Business (personal storage) with SharePoint (organizational storage), or assume Teams' Files tab is a separate storage system rather than a SharePoint interface.

How to eliminate wrong answers

Option B is wrong because Exchange Online mailboxes are designed for email and calendar, not document storage; attachments are not versioned, cannot be synced offline, and lack centralized access controls. Option C is wrong because while Teams uses SharePoint for file storage, the Files tab in a channel is a front-end to a SharePoint library; however, the question asks for a centralized repository, and Teams channels are team-specific, not a single repository for all staff. Option D is wrong because OneDrive for Business is intended for individual file storage and sharing, not as a centralized organizational repository; shared folders require manual sharing and lack the governance features of a SharePoint library.

Full explanation →

164

MCQmedium

An enterprise needs advanced analytics, voice, and advanced security/compliance capabilities beyond E3. Which option best matches the requirement?

A.Microsoft 365 E5

B.Microsoft Defender for Cloud only

C.Azure Virtual Desktop only

D.A free personal Microsoft account only

AnswerA

E5 includes advanced security, compliance, analytics, and voice capabilities depending on configuration.

Why this answer

Microsoft 365 E5 is the correct choice because it includes advanced analytics via Power BI Pro, voice capabilities through Phone System and Audio Conferencing, and advanced security/compliance features such as Microsoft Defender for Office 365, Microsoft Purview Information Protection, and Insider Risk Management. These capabilities are not available in E3, which lacks the advanced security, compliance, and voice features required by the enterprise.

Exam trap

The trap here is that candidates may confuse the limited security features in E3 (like basic threat management) with the advanced capabilities in E5, or assume that a standalone service like Defender for Cloud can replace the full suite of analytics, voice, and compliance tools bundled in E5.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Cloud only provides cloud security posture management and workload protection, lacking the advanced analytics, voice, and compliance capabilities required. Option C is wrong because Azure Virtual Desktop only delivers virtualized desktop and app experiences, with no built-in analytics, voice, or advanced security/compliance features. Option D is wrong because a free personal Microsoft account offers only basic consumer services like Outlook.com and OneDrive, with no enterprise-grade analytics, voice, or security/compliance capabilities.

Full explanation →

165

MCQhard

A global company must comply with data sovereignty laws that require customer data to be stored and processed within the country of origin. Which cloud concept should they evaluate?

A.Data classification

B.Data sovereignty

C.Data encryption

D.Data residency

AnswerD

Data residency determines the physical location of data, crucial for complying with data sovereignty laws.

Why this answer

Option C is correct because data residency refers to the physical location where data is stored, which is critical for compliance with data sovereignty laws. Option A (Data encryption) protects data at rest and in transit but does not control location. Option B (Data sovereignty) is the concept that data is subject to the laws of the country where it is collected, but the question asks for the concept to evaluate, which is data residency.

Option D (Data classification) categorizes data sensitivity but doesn't address location.

Full explanation →

166

Multi-Selectmedium

A company plans to migrate its on-premises workloads to the cloud. They will use Virtual Machines (VMs) for their legacy applications and a serverless computing service for new microservices. The cloud provider will manage the physical hardware, but the company is responsible for patching the operating system of the VMs. Which two cloud service models are being used?

Select 2 answers

A.IaaS and PaaS

B.IaaS and SaaS

C.PaaS and SaaS

D.IaaS only

AnswersA, D

VMs are IaaS; serverless is PaaS.

Why this answer

The company uses Virtual Machines (VMs) for legacy applications, where it manages the OS patching while the cloud provider handles the physical hardware — this is Infrastructure as a Service (IaaS). For new microservices, it uses a serverless computing service, which is a form of Platform as a Service (PaaS) where the provider manages the runtime and scaling, and the company only deploys code. Therefore, the two models are IaaS and PaaS, making option A correct.

Exam trap

The trap here is that candidates confuse serverless computing with SaaS, thinking it is a fully managed software service, when in fact it is a PaaS model where the customer writes and deploys code, not consumes a pre-built application.

Full explanation →

167

MCQmedium

A user reports receiving a phishing email that bypassed Exchange Online Protection (EOP). What should you configure to add a second layer of defense against sophisticated phishing attacks?

A.Purchase and assign Microsoft Defender for Office 365 Plan 2 licenses

B.Block all external images in email

C.Enable Safe Attachments in Exchange Online Protection

D.Configure DKIM signing for your domain

AnswerA

Defender for Office 365 Plan 2 includes advanced anti-phishing, impersonation, and automated investigation.

Why this answer

Microsoft Defender for Office 365 Plan 2 provides advanced anti-phishing policies, including impersonation protection and automated investigation. Option A (Safe Attachments in EOP) is basic. Option B (DKIM) is email authentication.

Option D (blocking all external images) is not a standard anti-phishing measure.

Full explanation →

168

MCQeasy

A financial services firm uses a public cloud provider for its customer-facing web application, but stores sensitive client data on its own on-premises servers. A secure VPN connection is used to transfer anonymized data from the public cloud to the on-premises environment for processing. Which cloud deployment model does this describe?

A.Public cloud

B.Private cloud

C.Hybrid cloud

D.Community cloud

AnswerC

Correct. Hybrid cloud integrates public and private cloud environments, often connected via VPN, allowing workloads to move between them.

Why this answer

This scenario describes a hybrid cloud because it combines a public cloud provider for the customer-facing web application with an on-premises private cloud for sensitive client data, connected via a secure VPN. The hybrid cloud model enables organizations to leverage the scalability and cost-efficiency of public cloud resources while maintaining strict control over sensitive data in a private environment. The use of a VPN to transfer anonymized data between the two environments is a key characteristic of hybrid cloud architecture, as it ensures secure communication across the boundary.

Exam trap

The trap here is that candidates may incorrectly choose 'Public cloud' because they focus on the customer-facing web application being hosted there, ignoring the on-premises storage of sensitive data, which is the defining characteristic of a hybrid deployment.

How to eliminate wrong answers

Option A is wrong because a public cloud model would have all resources, including sensitive client data, hosted and managed by the third-party cloud provider, not stored on-premises. Option B is wrong because a private cloud model would have all resources, including the web application, hosted on-premises or in a dedicated environment, not using a public cloud provider. Option D is wrong because a community cloud is shared by several organizations with common concerns (e.g., compliance or security requirements), but this scenario involves only one firm using both public and private infrastructure, not a multi-tenant community.

Full explanation →

169

MCQmedium

A tenant administrator is advising a department that wants to use Microsoft 365 and another public cloud provider for different workloads. Cloud concept or benefit best matches this requirement?

A.Microsoft Planner

B.Sensitivity labels

C.Multi-cloud

D.Data Loss Prevention (DLP)

AnswerC

Multi-cloud means using cloud services from more than one public cloud provider.

Why this answer

C is correct because multi-cloud refers to using multiple public cloud providers (e.g., Microsoft 365 and another provider like AWS or Google Cloud) for different workloads, which directly matches the requirement. This allows the organization to avoid vendor lock-in, optimize costs, and leverage best-of-breed services across clouds.

Exam trap

The trap here is that candidates may confuse multi-cloud with hybrid cloud (which combines public and private cloud) or think a specific Microsoft tool (like Planner) is the answer, when the question explicitly asks for a cloud concept or benefit.

How to eliminate wrong answers

Option A is wrong because Microsoft Planner is a task management and planning tool within Microsoft 365, not a cloud concept or benefit for using multiple cloud providers. Option B is wrong because sensitivity labels are a Microsoft Purview Information Protection feature used to classify and protect data, not a cloud deployment model. Option D is wrong because Data Loss Prevention (DLP) is a security policy mechanism to prevent unauthorized data sharing, not a cloud concept for multi-cloud usage.

Full explanation →

170

Multi-Selectmedium

Which three of the following correctly describe the shared responsibility model in Microsoft 365? (Choose three.)

Select 3 answers

.Microsoft is responsible for the physical security of its datacenters.

.The customer is responsible for managing user identities and access.

.Microsoft is responsible for maintaining the underlying network infrastructure.

.The customer is responsible for patching the operating system of Exchange Online servers.

.Microsoft is responsible for ensuring customer data is backed up in all scenarios.

.The customer is responsible for physical security of client devices used to access Microsoft 365.

Why this answer

The shared responsibility model delineates security and compliance obligations between Microsoft and the customer. Microsoft is responsible for the physical security of its datacenters, including access controls, surveillance, and environmental protections. The customer is responsible for managing user identities and access, such as configuring Azure Active Directory, enforcing multi-factor authentication, and controlling permissions.

Microsoft is responsible for maintaining the underlying network infrastructure, including the physical network hardware, routing, and connectivity within its datacenters and between regions.

Exam trap

The trap here is that candidates often assume Microsoft handles all security aspects, including data backup and OS patching for SaaS, but the model explicitly assigns data protection and identity management to the customer, while Microsoft only guarantees infrastructure uptime and physical security.

Full explanation →

171

MCQhard

An organization with 10,000 users is planning to deploy Microsoft 365. They need to minimize monthly costs while ensuring all users have access to Exchange Online, SharePoint Online, Teams, and Microsoft Copilot for Microsoft 365. Which licensing approach should they adopt?

A.Purchase Microsoft 365 E3 for most users and Copilot for a subset

B.Purchase Microsoft 365 E5 for all users

C.Purchase Microsoft 365 Business Premium for all users and add Copilot licenses

D.Purchase Microsoft 365 E3 for all users and add Copilot licenses

AnswerD

E3 provides the required services at a lower cost than E5, and Copilot can be added as an add-on.

Why this answer

Option D is correct because Microsoft 365 E3 provides the core enterprise-grade capabilities for Exchange Online, SharePoint Online, and Teams for all 10,000 users, while Copilot for Microsoft 365 can be added as an add-on license only for the users who need it, minimizing monthly costs. This approach avoids paying for premium features (like advanced security in E5) or unnecessary Copilot licenses across the entire user base, aligning with the requirement to minimize costs while ensuring all users have the required services.

Exam trap

The trap here is that candidates often assume Business Premium is a cheaper alternative for large organizations, but it has a 300-user limit and lacks enterprise features, making E3 the correct base license for organizations with 10,000 users.

How to eliminate wrong answers

Option A is wrong because purchasing Microsoft 365 E3 for most users and Copilot for a subset does not guarantee all users have access to Exchange Online, SharePoint Online, and Teams—if 'most' excludes some users, those users would lack the required services. Option B is wrong because Microsoft 365 E5 includes advanced security and compliance features that are not required, leading to unnecessary higher monthly costs for all 10,000 users. Option C is wrong because Microsoft 365 Business Premium is limited to 300 users and cannot scale to 10,000 users; it also lacks enterprise-level capabilities like unlimited mailbox storage and advanced compliance features that E3 provides.

Full explanation →

172

MCQeasy

A sales team needs a mobile-friendly solution to track and manage sales leads, meetings, and customer communications in a single interface. The solution should integrate with Outlook and include basic customer relationship management (CRM) capabilities. Which Microsoft 365 app is designed for this purpose?

A.Microsoft Lists

B.Microsoft Dynamics 365 Sales

C.Microsoft Viva Sales

D.Microsoft To Do

AnswerB

Dynamics 365 Sales is Microsoft's CRM application designed for managing leads, opportunities, and customer interactions, integrating with Outlook.

Why this answer

Microsoft Dynamics 365 Sales (formerly Dynamics CRM) provides comprehensive sales management, including lead tracking, opportunity management, and integration with Outlook. While the question mentions 'Microsoft 365 app', Dynamics 365 is part of the broader Microsoft business applications family but closely integrated. However, for a 'Microsoft 365 app' that does this, the built-in app is 'Dynamics 365 Sales'.

Some may think of 'Microsoft Lists' or 'Outlook', but those lack CRM capabilities. Alternatively, 'Microsoft Relationship Sales'? The question is straightforward: Dynamics 365 is the CRM solution. But note that the domain is 'apps and services', which includes Dynamics 365 as a service.

The correct answer is Dynamics 365 Sales.

Full explanation →

173

MCQeasy

A user is unable to send emails with attachments larger than 25 MB. The organization has Microsoft 365 Business Standard. What should you do to increase the attachment limit?

A.Modify the maximum message size in the Exchange admin center

B.Instruct the user to compress the file

C.Purchase an Exchange Online Kiosk add-on

D.Have the user upload the file to OneDrive and share a link

AnswerA

An admin can increase the maximum send/receive message size up to 150 MB via the Exchange admin center.

Why this answer

In Microsoft 365 Business Standard, the default maximum message size for email attachments is 25 MB. To increase this limit, you must modify the maximum message size setting in the Exchange admin center (EAC), which controls the transport limits for the organization. This is the correct administrative action to raise the attachment size threshold beyond the default.

Exam trap

The trap here is that candidates often confuse the 25 MB default limit with a hard-coded protocol restriction (like SMTP's theoretical limit), leading them to choose workarounds like compression or OneDrive instead of recognizing that the limit is an administrative policy configurable in the Exchange admin center.

How to eliminate wrong answers

Option B is wrong because compressing the file reduces its size but does not increase the actual attachment limit; it is a workaround, not a solution to change the policy. Option C is wrong because the Exchange Online Kiosk add-on is a low-cost plan with a 25 MB limit and does not provide a higher attachment limit; it is designed for basic email access, not for increasing size restrictions. Option D is wrong because uploading to OneDrive and sharing a link bypasses the email attachment limit entirely, but the question asks how to increase the attachment limit for sending emails directly, not how to share files via alternative methods.

Full explanation →

174

MCQeasy

A business needs staff to access Microsoft 365 services from different locations using only an internet connection. Which cloud benefit is being used?

A.Capital expenditure spending

B.Manual provisioning

C.Broad network access

D.Server virtualization only

AnswerC

Broad network access means services are available over the network from many client types and locations.

Why this answer

Broad network access is a core characteristic of cloud computing defined by NIST SP 800-145. It means that resources are available over the network and can be accessed by standard client platforms (e.g., laptops, tablets, smartphones) using only an internet connection, without requiring a dedicated private link or on-premises hardware. In this scenario, staff accessing Microsoft 365 from different locations via the internet directly demonstrates broad network access.

Exam trap

The trap here is that candidates confuse 'broad network access' with 'server virtualization' or 'CapEx spending,' because they think cloud benefits are about hardware consolidation or cost models, rather than the fundamental characteristic of network-based, ubiquitous access.

How to eliminate wrong answers

Option A is wrong because capital expenditure (CapEx) spending refers to upfront investment in physical infrastructure (e.g., servers, data centers), which is the opposite of the cloud's operational expenditure (OpEx) model; the question describes accessing services via the internet, not a financial model. Option B is wrong because manual provisioning involves human intervention to set up resources, whereas cloud services like Microsoft 365 are self-service and automatically provisioned; the scenario focuses on access, not provisioning. Option D is wrong because server virtualization is a technology that enables multiple virtual machines on a single physical server, but it is not a cloud benefit itself and does not describe the ability to access services from anywhere via the internet; broad network access is the correct benefit.

Full explanation →

175

MCQhard

An organization uses Microsoft 365 E5 licenses. Users report that Microsoft 365 Apps for enterprise (e.g., Word, Excel) are slow to open. The IT team considers deploying a cloud-based solution to improve performance. Which cloud service model should they use?

A.Platform as a Service (PaaS)

B.Software as a Service (SaaS)

C.Infrastructure as a Service (IaaS)

D.Function as a Service (FaaS)

AnswerB

SaaS delivers Microsoft 365 Apps via the cloud, optimized for performance and reduced local load.

Why this answer

Option D is correct because SaaS (Software as a Service) provides ready-to-use applications like Microsoft 365 Apps via the cloud, reducing local processing requirements. Option A is wrong because IaaS would require managing virtual machines and installing software. Option B is wrong because PaaS is for application development, not end-user apps.

Option C is wrong because FaaS is for event-driven functions, not desktop applications.

Full explanation →

176

MCQhard

A sales team uses Microsoft Lists to track leads. They want to create a real-time dashboard that shows the number of leads by stage, the total deal value, and the win rate. The dashboard must update automatically when the list is changed. Which Microsoft 365 app should they use to build this dashboard?

A.Microsoft Power BI

B.Microsoft Excel

C.Microsoft SharePoint

D.Microsoft Power Automate

AnswerA

Correct. Power BI can connect to Microsoft Lists and create live dashboards with automatic data refresh.

Why this answer

Microsoft Power BI is the correct choice because it is designed to create real-time, interactive dashboards that can connect directly to Microsoft Lists via the Power BI service or Power BI Desktop. It supports automatic data refresh when the underlying list changes, enabling live tracking of leads by stage, total deal value, and win rate without manual intervention.

Exam trap

The trap here is that candidates often confuse Microsoft Power Automate with a dashboarding tool because it can respond to list changes, but it cannot visualize data; the correct answer requires recognizing that Power BI is the dedicated analytics and visualization app for real-time dashboards.

How to eliminate wrong answers

Option B is wrong because Microsoft Excel, while capable of creating charts and dashboards, does not natively support real-time automatic updates from Microsoft Lists without manual refresh or complex VBA scripting, and it lacks the robust data modeling and live dashboard capabilities of Power BI. Option C is wrong because Microsoft SharePoint is a content management and collaboration platform, not a dashboarding tool; it can host lists but cannot build real-time analytical dashboards with automatic updates. Option D is wrong because Microsoft Power Automate is a workflow automation tool that can trigger actions based on list changes but cannot create or display dashboards; it would need to integrate with Power BI for visualization.

Full explanation →

177

MCQmedium

Your organization has 500 users with Microsoft 365 E3 licenses. You want to add security features such as Microsoft Defender for Office 365 (Plan 1) and Microsoft Purview Information Protection. Which licensing approach should you recommend?

A.Keep E3 and add Microsoft 365 E5 Compliance add-on

B.Keep E3 and add Microsoft 365 E5 Security add-on

C.Upgrade all users to Microsoft 365 E5

D.Keep E3 and use the Security & Compliance Center for E3

AnswerC

Microsoft 365 E5 includes both Defender for Office 365 Plan 1 and Microsoft Purview Information Protection, meeting the requirements.

Why this answer

Microsoft 365 E5 includes both Defender for Office 365 (Plan 1) and Purview Information Protection (formerly Azure Information Protection P2) natively, whereas E3 requires separate add-ons. Upgrading all users to E5 is the simplest and most cost-effective licensing approach when both security features are needed for all 500 users, as it avoids the complexity and potential per-user cost of stacking multiple add-on SKUs.

Exam trap

The trap here is that candidates assume the E5 Security add-on or E5 Compliance add-on alone can cover both requirements, but each add-on only covers its respective domain (security or compliance), and neither alone includes both Defender for Office 365 (Plan 1) and Purview Information Protection.

How to eliminate wrong answers

Option A is wrong because the Microsoft 365 E5 Compliance add-on provides Purview Compliance features (e.g., eDiscovery, Audit) but does not include Defender for Office 365 (Plan 1), which is a security feature. Option B is wrong because the Microsoft 365 E5 Security add-on includes Defender for Office 365 (Plan 1) but does not include Purview Information Protection (which requires the E5 Compliance add-on or full E5). Option D is wrong because the Security & Compliance Center in E3 only offers basic security and compliance capabilities (e.g., limited DLP, basic audit) and does not include Defender for Office 365 (Plan 1) or Purview Information Protection, which require additional licensing.

Full explanation →

178

MCQeasy

A company needs to audit user activities in Microsoft 365 for compliance. Which tool should they use?

A.Microsoft Defender XDR

B.Microsoft Sentinel

C.Microsoft Purview Audit (Premium)

D.Microsoft Intune

AnswerC

Audit logs user and admin activities for compliance.

Why this answer

Microsoft Purview Audit (Premium) provides comprehensive auditing of user and admin activities. Option B is correct. The other options are for other purposes.

Full explanation →

179

MCQhard

A company with Microsoft 365 E5 wants to use AI to summarize email threads and draft replies automatically. Which Microsoft 365 service provides this capability?

A.Microsoft Viva Insights

B.Microsoft 365 Copilot

C.Microsoft Search

D.Microsoft Editor

AnswerB

Copilot provides AI-assisted email summarization and drafting.

Why this answer

Microsoft 365 Copilot integrates with Outlook and other Microsoft 365 apps to provide AI-powered email thread summarization and draft reply generation. It uses large language models (LLMs) combined with your Microsoft Graph data to understand context and produce relevant, personalized responses. This capability is not available in other Microsoft 365 services like Viva Insights or Microsoft Editor.

Exam trap

The trap here is that candidates may confuse Microsoft Viva Insights (which provides 'insights' and 'suggestions' about work patterns) with AI-powered content generation, or assume Microsoft Editor's grammar suggestions include drafting capabilities, when in fact only Copilot uses generative AI for these tasks.

How to eliminate wrong answers

Option A is wrong because Microsoft Viva Insights focuses on personal productivity analytics, wellbeing, and work patterns (e.g., meeting time, focus hours), not on generating email summaries or drafts. Option C is wrong because Microsoft Search provides enterprise search across files, messages, and sites using the Microsoft Graph, but it does not generate AI summaries or draft replies. Option D is wrong because Microsoft Editor is a writing assistant that checks spelling, grammar, and style in documents and emails, but it lacks the generative AI capabilities to summarize threads or draft replies from scratch.

Full explanation →

180

MCQeasy

A department needs a shared document library with version history, permissions, and co-authoring for team files. Which service should they primarily use?

A.SharePoint Online.

B.OneDrive for Business.

C.Microsoft Forms.

D.Microsoft Planner.

AnswerA

It is the primary Microsoft 365 service for team document management.

Why this answer

SharePoint Online is the correct choice because it provides a centralized, team-based document library with built-in version history, granular permission management, and real-time co-authoring. Unlike OneDrive for Business, which is designed for personal file storage, SharePoint Online supports shared workspaces where multiple users can collaborate simultaneously on the same documents while maintaining full audit trails and access controls.

Exam trap

The trap here is that candidates often confuse OneDrive for Business with SharePoint Online, assuming OneDrive can serve as a team library, but OneDrive lacks the centralized permission management and team-level version history that SharePoint provides for departmental collaboration.

How to eliminate wrong answers

Option B (OneDrive for Business) is wrong because it is primarily a personal cloud storage service for individual users, not designed for team-based shared libraries with centralized permissions and version history across a department. Option C (Microsoft Forms) is wrong because it is a survey and quiz creation tool, not a document storage or collaboration platform. Option D (Microsoft Planner) is wrong because it is a task management and project planning tool, lacking document library, versioning, and co-authoring capabilities.

Full explanation →

181

MCQhard

An organization wants to use AI to summarize long email threads and suggest replies in Outlook. Which Microsoft 365 feature provides this capability?

A.Microsoft Copilot for Microsoft 365

B.Microsoft Editor

C.Microsoft Search

D.Microsoft Viva Insights

AnswerA

Copilot uses AI to summarize email threads and suggest replies in Outlook.

Why this answer

Microsoft Copilot for Microsoft 365 integrates AI directly into Outlook to summarize long email threads and generate suggested replies. It uses large language models and the Microsoft Graph to analyze conversation context, extract key points, and draft responses, all within the user's mailbox. This is the only Microsoft 365 feature designed specifically for these natural language processing tasks in Outlook.

Exam trap

The trap here is that candidates often confuse Microsoft Editor's basic AI writing assistance with Copilot's advanced generative AI capabilities, assuming Editor can handle complex tasks like summarization and reply generation, but Editor lacks the underlying large language model and Graph integration required for those features.

How to eliminate wrong answers

Option B is wrong because Microsoft Editor is a writing assistant that provides grammar, spelling, and style suggestions, but it cannot summarize email threads or generate suggested replies. Option C is wrong because Microsoft Search helps users find content across Microsoft 365 (e.g., emails, files, people) via a search index, but it does not perform AI-driven summarization or reply generation. Option D is wrong because Microsoft Viva Insights focuses on productivity and wellbeing analytics (e.g., focus time, meeting habits) and does not include capabilities for summarizing conversations or suggesting replies.

Full explanation →

182

MCQmedium

A company with 100 users wants to provide all users with Microsoft Teams and cloud file storage, but only the sales team of 20 users needs access to Dynamics 365. Which licensing approach is most cost-effective?

A.Purchase Microsoft 365 Business Basic for all 100 users and Dynamics 365 Sales Professional for the 20 sales users.

B.Purchase Microsoft 365 Business Premium for all 100 users.

C.Purchase Microsoft 365 E3 for all 100 users and add Dynamics 365 for the sales team.

D.Purchase Microsoft 365 Business Basic for all users and Dynamics 365 Business Central for the 20 sales users.

AnswerA

Business Basic includes Teams and SharePoint for all users. Dynamics 365 licenses are only needed for those who will use the CRM.

Why this answer

Microsoft 365 Business Basic includes Teams and SharePoint for all users at a low cost. Adding Dynamics 365 Sales Professional licenses only for the sales team minimizes expense. Business Premium is more expensive, E3 is also pricier, and Business Central is an ERP not a CRM.

Hence, the correct approach is Business Basic plus Dynamics 365 Sales for the sales team.

Full explanation →

183

MCQmedium

An organization has 50 users with Microsoft 365 Business Premium licenses. They are considering moving to Microsoft 365 E3 for better compliance and advanced analytics features. What is the relationship between these plans?

A.E3 is a downgrade from Business Premium

B.E3 is an upgrade from Business Premium in terms of security and compliance

C.E3 is designed for smaller organizations while Business Premium is for enterprise

D.They are equivalent but E3 includes additional apps

AnswerB

E3 includes enhanced compliance and analytics capabilities not available in Business Premium.

Why this answer

Microsoft 365 Business Premium is designed for small and medium-sized businesses (up to 300 users) and includes security features like Microsoft Defender for Business and compliance capabilities such as Data Loss Prevention (DLP). Microsoft 365 E3 is an enterprise-grade plan that offers advanced compliance features (e.g., eDiscovery, Legal Hold, Advanced Audit) and more robust analytics via Power BI Pro, making it an upgrade in compliance and analytics, though Business Premium has slightly stronger built-in security for its user count.

Exam trap

The trap here is that candidates often assume Business Premium is always superior due to its 'security-first' marketing, but the exam tests the distinction that E3 offers deeper compliance and analytics, making it an upgrade in those specific domains.

How to eliminate wrong answers

Option A is wrong because E3 is not a downgrade; it provides superior compliance and analytics capabilities, while Business Premium focuses on integrated security for SMBs. Option C is wrong because Business Premium is specifically designed for smaller organizations (up to 300 users), whereas E3 is an enterprise plan with no user limit, not the reverse. Option D is wrong because the plans are not equivalent; E3 lacks some Business Premium security features (e.g., Microsoft Defender for Business) but adds enterprise compliance and analytics tools, and they do not share the same app set.

Full explanation →

184

MCQeasy

Your company uses Microsoft 365 and wants to ensure that when employees share sensitive documents externally, access is automatically revoked after 30 days. Which solution should you use?

A.Microsoft Intune

B.Microsoft Defender for Cloud Apps

C.Microsoft Entra ID Conditional Access

D.Microsoft Information Protection (MIP)

AnswerC

Conditional Access policies can require session timeouts and revoke access after a defined period.

Why this answer

Azure AD (Entra ID) Conditional Access policies can enforce access time limits. Option A (MIP) classifies data. Option C (Defender for Cloud Apps) provides session control.

Option D (Intune) manages devices, not access duration.

Full explanation →

185

MCQhard

A company is deploying Microsoft 365 Copilot and wants to ensure that prompts and responses are not used to train the underlying AI models. Which setting must be configured?

A.Configure data boundary for Copilot to 'No training'

B.Enable Customer Key for Copilot

C.Assign Copilot licenses to users

D.Enable audit logging for Copilot interactions

AnswerA

This setting ensures prompts and responses are not used for training.

Why this answer

Option A is correct because the 'Data boundary for Copilot' setting, when configured to 'No training', explicitly prevents Microsoft from using prompts and responses from Microsoft 365 Copilot to train or improve its underlying AI models. This setting ensures that organizational data remains within the tenant's data boundary and is not used for model retraining, addressing data privacy and compliance requirements.

Exam trap

The trap here is that candidates often confuse data protection features like Customer Key or audit logging with the specific data usage control for AI training, assuming any encryption or logging setting prevents data from being used for model training, when in fact only the 'No training' data boundary setting directly addresses this requirement.

How to eliminate wrong answers

Option B is wrong because Customer Key provides tenant-level control over encryption keys for data at rest in Microsoft 365, but it does not control whether prompts and responses are used for AI model training. Option C is wrong because assigning Copilot licenses to users grants access to the service but has no effect on data usage for training; licensing is about entitlement, not data governance. Option D is wrong because enabling audit logging for Copilot interactions records user activities for compliance and security monitoring, but it does not prevent Microsoft from using the data for AI training.

Full explanation →

186

MCQmedium

A field service team needs a mobile-friendly app that allows technicians to view customer information from a central database, log completed tasks, and capture photos on-site. The IT department has limited development resources and wants to build this app quickly without writing extensive code. Which Microsoft 365 app is best suited for this requirement?

A.Microsoft Power Apps

B.Microsoft Forms

C.Microsoft Power Automate

D.Microsoft Power BI

AnswerA

Correct. Power Apps allows building custom mobile apps quickly with minimal code, integrating with various data sources.

Why this answer

Microsoft Power Apps is the correct choice because it enables rapid development of custom mobile-friendly apps with minimal code, allowing the field service team to view customer data from a central database (e.g., Dataverse or SharePoint), log completed tasks, and capture photos on-site. Its low-code platform provides pre-built connectors and templates that directly address the need for a data-driven, mobile-first application without extensive development resources.

Exam trap

The trap here is that candidates often confuse Power Automate with Power Apps, thinking that automation alone can build an app, but Power Automate only orchestrates workflows and cannot provide the interactive user interface required for field technicians to view data, log tasks, and capture photos.

How to eliminate wrong answers

Option B (Microsoft Forms) is wrong because it is designed for creating surveys and forms for data collection, not for building a multi-functional mobile app that integrates with a central database and supports task logging and photo capture. Option C (Microsoft Power Automate) is wrong because it focuses on workflow automation and process orchestration, not on creating a user-facing mobile application with custom UI and data interaction. Option D (Microsoft Power BI) is wrong because it is a business analytics and visualization tool, not an app development platform; it cannot provide the interactive, data-entry functionality required for field technicians.

Full explanation →

187

MCQhard

An organization is reconciling their Microsoft 365 invoice and notices charges for 'Microsoft 365 Copilot' that they did not expect. The administrator suspects that users may have inadvertently enabled Copilot via self-service purchase. How should they prevent this in the future?

A.Remove Copilot licenses from all users

B.Disable self-service purchasing in the Microsoft 365 admin center

C.Cancel the Copilot subscription

D.Set up billing alerts for unexpected charges

AnswerB

Prevents users from making unauthorized purchases.

Why this answer

Option B is correct because disabling self-service purchasing in the Microsoft 365 admin center is the direct method to prevent users from acquiring Copilot licenses on their own. Self-service purchasing allows users to buy subscriptions like Microsoft 365 Copilot without admin approval, leading to unexpected charges. By disabling this feature, the administrator regains control over license procurement, ensuring no future inadvertent Copilot activations occur.

Exam trap

The trap here is that candidates may confuse reactive billing controls (like alerts or license removal) with the proactive administrative setting that actually blocks the self-service purchase mechanism, leading them to choose a non-preventive option.

How to eliminate wrong answers

Option A is wrong because removing Copilot licenses from all users is a reactive measure that does not prevent users from re-enabling Copilot via self-service purchase; it only cleans up existing assignments. Option C is wrong because canceling the Copilot subscription removes the service entirely but does not address the root cause—self-service purchasing remains enabled, allowing users to re-subscribe. Option D is wrong because setting up billing alerts only notifies the administrator of unexpected charges after they occur, rather than preventing the self-service purchase from happening in the first place.

Full explanation →

188

MCQmedium

Refer to the exhibit. An admin runs the PowerShell command shown. What is the implication for the user's mailbox?

A.The retention policy is not effective

B.The mailbox has no retention policy applied

C.The mailbox is on litigation hold

D.The mailbox will automatically delete items after 30 days

AnswerC

LitigationHoldEnabled is True.

Why this answer

The PowerShell command `Set-Mailbox -LitigationHoldEnabled $true` places the user's mailbox on litigation hold. This preserves all mailbox content, including deleted items and original versions of modified items, for eDiscovery purposes. The hold overrides any retention policy that would otherwise delete or archive items, ensuring data is retained indefinitely until the hold is removed.

Exam trap

The trap here is that candidates confuse litigation hold with a retention policy or assume the command removes the policy, when in fact litigation hold is a separate preservation mechanism that overrides deletion behavior without altering the applied retention policy.

How to eliminate wrong answers

Option A is wrong because litigation hold overrides retention policies, making the retention policy temporarily ineffective for deletion or archiving, but the policy itself remains applied and will take effect once the hold is removed. Option B is wrong because the command does not remove or prevent a retention policy from being applied; it only enables litigation hold, which coexists with any existing policy. Option D is wrong because litigation hold prevents automatic deletion of items after any period, including 30 days; items are retained indefinitely regardless of retention tags or settings.

Full explanation →

189

MCQmedium

A company runs a custom application on a cloud provider's infrastructure. The provider manages the physical servers, networking, and storage, but the company installs, configures, and patches the operating system and application. Which cloud service model is this?

A.Software as a Service (SaaS)

B.Platform as a Service (PaaS)

C.Infrastructure as a Service (IaaS)

D.Function as a Service (FaaS)

AnswerC

Correct. The customer has control over the OS, storage, and deployed applications, while the provider manages the physical infrastructure.

Why this answer

This scenario describes Infrastructure as a Service (IaaS) because the cloud provider manages the underlying physical infrastructure (servers, networking, storage), while the customer retains control over the operating system, middleware, and application. In IaaS, the customer is responsible for OS patching, configuration, and application management, which matches the given responsibilities.

Exam trap

The trap here is confusing IaaS with PaaS because both involve deploying applications, but the key differentiator is OS-level control and patching responsibility—IaaS gives you full OS access, while PaaS abstracts it away.

How to eliminate wrong answers

Option A is wrong because Software as a Service (SaaS) delivers a fully managed application to end users, where the provider handles everything including the OS and application, and the customer does not install or patch the OS. Option B is wrong because Platform as a Service (PaaS) provides a managed runtime environment where the provider manages the OS and middleware, and the customer only deploys code, not the OS or its patches. Option D is wrong because Function as a Service (FaaS) is an event-driven compute model where the provider manages the entire infrastructure and the customer only uploads individual functions, with no OS-level access or patching responsibility.

Full explanation →

190

MCQmedium

A company with 200 users currently has Microsoft 365 Business Basic licenses. They need to add Microsoft Defender for Office 365 (Plan 1) and device management capabilities using Microsoft Intune. What is the most cost-effective licensing upgrade to obtain these features?

A.Upgrade to Microsoft 365 Business Premium

B.Add standalone Microsoft Defender for Office 365 Plan 1

C.Add standalone Microsoft Intune

D.Upgrade to Microsoft 365 E3

AnswerA

Business Premium includes Defender for Office 365 Plan 1, Intune, and many other security features, making it the most cost-effective upgrade.

Why this answer

Microsoft 365 Business Premium includes both Microsoft Defender for Office 365 (Plan 1) and Microsoft Intune device management, making it the most cost-effective upgrade from Business Basic. Purchasing these as standalone add-ons would cost more per user than the bundled Business Premium license, which also provides additional security and productivity features.

Exam trap

The trap here is that candidates often assume adding individual add-ons is cheaper, but Microsoft bundles these features in Business Premium at a lower total cost per user than purchasing them separately, and they may overlook that E3 is an enterprise plan with unnecessary extras for a 200-user company.

How to eliminate wrong answers

Option B is wrong because adding standalone Microsoft Defender for Office 365 Plan 1 would provide email security but not device management via Intune, requiring a separate Intune license and increasing total cost. Option C is wrong because adding standalone Microsoft Intune would enable device management but not provide Defender for Office 365 Plan 1, necessitating an additional purchase for email protection. Option D is wrong because upgrading to Microsoft 365 E3 is significantly more expensive than Business Premium and includes features (like advanced eDiscovery and compliance) not required for the stated needs, making it less cost-effective.

Full explanation →

191

MCQmedium

A development team uses a cloud service to run applications where the provider manages the runtime environment, operating system, and middleware. The team only writes and uploads code. Which service model are they using?

A.IaaS (Infrastructure as a Service)

B.PaaS (Platform as a Service)

C.SaaS (Software as a Service)

D.FaaS (Function as a Service)

AnswerB

PaaS abstracts the underlying platform, so the provider handles the OS, runtime, and middleware, enabling developers to deploy applications without managing infrastructure.

Why this answer

The scenario describes the team writing and uploading code while the provider manages the runtime environment, operating system, and middleware. This is the defining characteristic of Platform as a Service (PaaS), where the cloud provider abstracts the underlying infrastructure and platform layers, allowing developers to focus solely on application code. In PaaS, the provider handles OS patching, runtime updates, and middleware configuration, which matches the description exactly.

Exam trap

The trap here is that candidates often confuse PaaS with IaaS because both involve deploying applications, but the key differentiator is who manages the runtime and middleware — PaaS abstracts them away, while IaaS requires the user to manage them.

How to eliminate wrong answers

Option A (IaaS) is wrong because IaaS provides virtualized computing resources (e.g., VMs, storage, networks) but the user is responsible for managing the runtime environment, operating system, and middleware; the team would need to install and configure these themselves, not just upload code. Option C (SaaS) is wrong because SaaS delivers fully functional software applications over the internet (e.g., Office 365, Salesforce) where users consume the application without writing or uploading code; the team in the question is actively developing and uploading code. Option D (FaaS) is wrong because FaaS (Function as a Service) is a subset of serverless computing where developers upload individual functions that are executed in response to events, but the provider still manages the runtime environment; however, the question specifies the team runs 'applications' and manages the 'runtime environment, operating system, and middleware' at a higher abstraction level than individual functions, and FaaS typically involves event-driven, stateless functions rather than full application hosting.

Full explanation →

192

MCQhard

A company uses Microsoft 365 (a SaaS offering). A security incident occurs where an employee's account is compromised because the employee reused their corporate password on a personal website. According to the shared responsibility model, who is primarily responsible for this security failure?

A.The customer (the company using Microsoft 365)

B.Microsoft, because they provide the SaaS platform

C.Both Microsoft and the customer share equal responsibility

D.It depends on the contract terms with Microsoft

AnswerA

Correct. The customer is responsible for managing user identities, credentials, and access policies. The breach was due to weak password practices.

Why this answer

In the Microsoft 365 shared responsibility model, the customer is responsible for securing user identities, including password hygiene and multi-factor authentication (MFA). Since the employee reused their corporate password on a personal website, this is a customer-side identity management failure, not a platform vulnerability. Microsoft secures the SaaS infrastructure, but customer-managed credentials fall under the customer's responsibility.

Exam trap

The trap here is that candidates often assume SaaS means Microsoft handles all security, but the shared responsibility model clearly places identity and credential management on the customer, especially for user-caused password reuse incidents.

How to eliminate wrong answers

Option B is wrong because Microsoft is responsible for the security of the SaaS platform itself (e.g., physical data centers, network infrastructure, and service-level controls), not for how customers manage their own user credentials or enforce password policies. Option C is wrong because the shared responsibility model does not assign equal responsibility for all incidents; identity and access management (IAM) tasks like password policies and user training are explicitly customer obligations. Option D is wrong because the shared responsibility model is a standard framework defined by Microsoft for all Microsoft 365 tenants, not a negotiable contract term; while specific contractual clauses may add details, the core division of responsibilities is fixed.

Full explanation →

193

MCQmedium

During a Microsoft 365 planning workshop, keep a workload on-premises while using Microsoft cloud collaboration services. Cloud concept or benefit best matches this requirement?

A.Hybrid cloud

B.Sensitivity labels

C.Microsoft Planner

D.Data Loss Prevention (DLP)

AnswerA

Hybrid cloud combines on-premises or private resources with public cloud services.

Why this answer

A hybrid cloud model is the correct answer because it explicitly describes a scenario where an organization keeps certain workloads on-premises while integrating with Microsoft cloud collaboration services like Microsoft 365. This allows for a unified management plane, identity federation via Azure AD Connect, and seamless data synchronization between on-premises infrastructure and cloud services such as Exchange Online, SharePoint Online, or Teams.

Exam trap

The trap here is that candidates may confuse a specific Microsoft 365 feature (like sensitivity labels or DLP) with a cloud deployment model, failing to recognize that 'hybrid cloud' is the architectural concept that directly addresses the requirement of mixing on-premises and cloud services.

How to eliminate wrong answers

Option B is wrong because sensitivity labels are a Microsoft 365 compliance feature used to classify and protect data based on sensitivity, not a cloud deployment model that enables hybrid connectivity. Option C is wrong because Microsoft Planner is a task management application within Microsoft 365, not a cloud concept or benefit that supports keeping workloads on-premises. Option D is wrong because Data Loss Prevention (DLP) is a policy-based security feature to prevent unauthorized sharing of sensitive data, not a cloud architecture that allows hybrid workloads.

Full explanation →

194

MCQmedium

A business stakeholder asks how Microsoft 365 can help them protect Windows endpoints with endpoint detection and response capabilities. Microsoft security, identity, or compliance capability should it use?

A.Microsoft Planner

B.Microsoft Forms

C.Microsoft Stream

D.Microsoft Defender for Endpoint

AnswerD

Defender for Endpoint provides endpoint protection, detection, and response.

Why this answer

Microsoft Defender for Endpoint is the correct choice because it provides endpoint detection and response (EDR) capabilities specifically designed to protect Windows endpoints. It uses behavioral sensors, cloud analytics, and threat intelligence to detect, investigate, and respond to advanced threats in real time, aligning directly with the stakeholder's request.

Exam trap

The trap here is that candidates may confuse general productivity tools (Planner, Forms, Stream) with security capabilities, failing to recognize that only Microsoft Defender for Endpoint is purpose-built for endpoint detection and response (EDR) in Microsoft 365.

How to eliminate wrong answers

Option A is wrong because Microsoft Planner is a project management tool for task assignment and scheduling, not a security capability. Option B is wrong because Microsoft Forms is a survey and data collection tool, lacking any endpoint detection or response functionality. Option C is wrong because Microsoft Stream is a video hosting and sharing platform, unrelated to endpoint security or threat detection.

Full explanation →

195

MCQhard

An organization uses Microsoft 365 and wants to automatically detect and remediate security incidents across identities, endpoints, and cloud apps. Which Microsoft 365 service should they deploy?

A.Microsoft Sentinel

B.Microsoft Purview

C.Microsoft Defender for Office 365

D.Microsoft Defender XDR

AnswerD

Microsoft Defender XDR provides integrated threat detection and response across identities, endpoints, and cloud apps.

Why this answer

Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security solution that automatically detects and remediates security incidents across identities, endpoints, and cloud apps. It correlates signals from Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps to deliver automated investigation and response, aligning directly with the scenario's requirement for holistic incident management.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft Defender XDR (an XDR), but Sentinel requires manual configuration for automated remediation across domains, whereas Defender XDR provides built-in, cross-domain automated response out of the box.

How to eliminate wrong answers

Option A is wrong because Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests logs from multiple sources for threat detection and response, but it does not natively provide automated cross-domain remediation across identities, endpoints, and cloud apps without custom playbooks and integrations. Option B is wrong because Microsoft Purview is a data governance, compliance, and risk management solution focused on data classification, labeling, and protection, not on detecting and remediating security incidents across identities, endpoints, and cloud apps. Option C is wrong because Microsoft Defender for Office 365 is specifically designed to protect against threats in email, SharePoint, OneDrive, and Teams, and does not cover identity or endpoint security incidents, making it too narrow for the described requirement.

Full explanation →

196

MCQeasy

During requirements gathering, an IT manager says the organization must let users provision resources from a portal without provider interaction. Cloud concept or benefit best matches this requirement?

A.On-demand self-service

B.Data Loss Prevention (DLP)

C.Microsoft Planner

D.Sensitivity labels

AnswerA

On-demand self-service allows consumers to provision resources automatically when needed.

Why this answer

On-demand self-service is a core NIST-defined characteristic of cloud computing that allows users to provision computing resources—such as virtual machines, storage, or network capacity—automatically through a web portal or API without requiring human interaction from the service provider. This directly matches the IT manager's requirement for users to provision resources from a portal without provider interaction, making option A correct.

Exam trap

The trap here is that candidates may confuse a specific Microsoft 365 feature (like Planner or sensitivity labels) with a fundamental cloud computing characteristic, or mistakenly think DLP is a provisioning mechanism, when the question explicitly tests the NIST definition of on-demand self-service.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) is a security policy and technology used to prevent sensitive data from being leaked or shared inappropriately, not a cloud concept for self-service resource provisioning. Option C is wrong because Microsoft Planner is a task management and planning application within Microsoft 365, not a cloud computing characteristic or benefit related to provisioning resources without provider interaction. Option D is wrong because sensitivity labels are classification and protection mechanisms applied to documents and emails to enforce access controls and encryption, not a cloud concept for automated resource provisioning.

Full explanation →

197

MCQhard

A global enterprise uses Microsoft 365 E5 and has users in Europe, Asia, and North America. They need to ensure that user data in Exchange Online and SharePoint Online remains within the European Union for EU users. They also want to apply a retention policy to keep all data for at least 7 years. Which combination of Microsoft 365 features should an administrator use?

A.Enforce data residency using Multi-Geo capabilities in Exchange Online and SharePoint Online, and apply a retention policy via Microsoft Purview Data Lifecycle Management.

B.Use Microsoft Purview Compliance Manager to configure data residency and retention settings.

C.Use Data Location for Exchange Online and a SharePoint multi-geo tenant, then create a retention policy in Purview for 7 years.

D.Configure Microsoft Entra ID Conditional Access policies to restrict data access based on location.

AnswerA

Multi-Geo ensures data stays in EU; retention policy enforces 7-year retention.

Why this answer

Option A is correct because Multi-Geo capabilities in Exchange Online and SharePoint Online allow the administrator to pin user data at the tenant level to a specific geographic location (e.g., the EU), ensuring data residency. A retention policy configured via Microsoft Purview Data Lifecycle Management can then be applied to retain all data for a minimum of 7 years, meeting both compliance requirements.

Exam trap

The trap here is confusing data residency enforcement (which requires Multi-Geo) with access control (Conditional Access) or compliance scoring (Compliance Manager), leading candidates to pick options that address only part of the requirement or use the wrong tool entirely.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Compliance Manager is a risk-assessment and compliance-scoring tool, not a feature for configuring data residency or retention policies; it does not enforce data location or set retention durations. Option C is wrong because 'Data Location for Exchange Online' is not a standalone feature—Multi-Geo is the correct mechanism for Exchange Online data residency, and the phrase 'SharePoint multi-geo tenant' is redundant and imprecise; the retention policy in Purview is correctly described, but the data residency part is misstated. Option D is wrong because Microsoft Entra ID Conditional Access policies control access based on location (e.g., blocking sign-ins from outside the EU), but they do not enforce where data is stored or apply retention; they are an identity and access control feature, not a data residency or lifecycle management tool.

Full explanation →

198

MCQmedium

You need to provide external partners access to a single document without giving them access to your entire SharePoint site. What should you do?

A.Add the partners as guests to the SharePoint site

B.Email the document as an attachment

C.Create a Microsoft 365 group and add them

D.Share a direct link to the document with specific permissions

AnswerD

Direct sharing with permissions allows external access to that document only.

Why this answer

Option D is correct because sharing a direct link with specific permissions allows you to grant external partners access to a single document without giving them broader access to the entire SharePoint site. This method uses SharePoint's granular permission model, where you can set the link to 'Specific people' and restrict permissions to 'View' or 'Edit' only on that document, ensuring no unintended access to other site content.

Exam trap

The trap here is that candidates often confuse 'guest access' (which grants site-level access) with 'document-level sharing' (which is granular), leading them to incorrectly choose Option A, assuming guest access can be scoped to a single document.

How to eliminate wrong answers

Option A is wrong because adding partners as guests to the SharePoint site grants them access to the entire site, including all documents, lists, and pages, which violates the requirement to restrict access to a single document. Option B is wrong because emailing the document as an attachment creates a separate copy outside SharePoint, losing version control, permissions management, and audit trails, and does not provide controlled access to the original document. Option C is wrong because creating a Microsoft 365 group and adding partners gives them access to all resources associated with that group (e.g., SharePoint site, Teams, Planner), which again exposes the entire site, not just the single document.

Full explanation →

199

MCQeasy

Your company wants to run a phishing simulation to test employee awareness. Which Microsoft 365 tool can you use to create and launch a simulated phishing campaign?

A.Microsoft Defender for Cloud Apps

B.Microsoft Defender for Office 365 Attack Simulation Training

C.Microsoft Intune

D.Microsoft Purview Compliance Manager

AnswerB

Attack Simulation Training is designed for phishing simulations.

Why this answer

Microsoft Defender for Office 365 includes Attack Simulation Training, which allows you to create and launch simulated phishing attacks. Option A is correct. Option B (Defender for Cloud Apps) is a CASB, Option C (Microsoft Intune) is for device management, and Option D (Microsoft Purview) is for compliance.

Full explanation →

200

MCQhard

A hospital uses Microsoft 365 and needs to comply with HIPAA by ensuring that patient health information in emails is encrypted both in transit and at rest. Which Microsoft 365 feature should they enable?

A.Microsoft Defender for Office 365

B.Microsoft Intune

C.Microsoft Purview Data Lifecycle Management

D.Office 365 Message Encryption

AnswerD

This encrypts emails both in transit and at rest.

Why this answer

Office 365 Message Encryption (OME) is the correct feature because it provides built-in encryption for emails both in transit (via TLS) and at rest (via Azure Rights Management), ensuring that patient health information (PHI) remains protected and compliant with HIPAA requirements. OME integrates with Azure Information Protection to apply persistent encryption that travels with the email, regardless of where it is stored.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Office 365 (a threat protection tool) with email encryption, because both are security-related, but Defender does not provide the persistent encryption required for HIPAA compliance.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 is a security service focused on threat protection (anti-phishing, anti-malware, safe attachments/links), not on encrypting email content at rest or in transit for compliance. Option B is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) tool that manages devices and apps, but it does not directly encrypt email messages themselves. Option C is wrong because Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 retention policies) manages data retention and deletion, not encryption of email content.

Full explanation →

201

MCQhard

A company migrates its database to Azure SQL Database (PaaS). According to the shared responsibility model, which of the following is the customer's responsibility?

A.Managing user access and authentication

B.Patching the operating system of the database server

C.Maintaining the physical infrastructure

D.Managing the virtualization layer

AnswerA

In PaaS, the customer is responsible for their data, including who has access and authentication.

Why this answer

In the shared responsibility model for Azure SQL Database (PaaS), the customer is responsible for managing user access and authentication because the customer controls who can connect to the database and what permissions they have. Microsoft manages the underlying infrastructure, including the operating system, physical hardware, and virtualization layer, while the customer must secure data access through Azure Active Directory or SQL authentication, configure firewall rules, and manage logins and users.

Exam trap

The trap here is that candidates often assume patching or infrastructure maintenance is shared in PaaS, but Microsoft fully manages the OS and physical layers, while the customer's responsibility is strictly limited to data, access, and application-level security.

How to eliminate wrong answers

Option B is wrong because patching the operating system of the database server is the responsibility of Microsoft, not the customer, as Azure SQL Database is a PaaS service where Microsoft handles OS-level updates and security patches. Option C is wrong because maintaining the physical infrastructure, such as servers, storage, and networking hardware, is entirely managed by Microsoft in the cloud model. Option D is wrong because managing the virtualization layer, including hypervisors and virtual machine orchestration, is also Microsoft's responsibility in a PaaS offering like Azure SQL Database.

Full explanation →

202

MCQmedium

A legal team needs to store documents with strict retention policies and eDiscovery capabilities. Which Microsoft 365 workload should they primarily use?

A.Power BI

B.Microsoft Bookings

C.Microsoft Teams

D.SharePoint Online

AnswerD

Supports compliance features.

Why this answer

Option A is correct because SharePoint Online supports retention policies and eDiscovery. Option B is wrong because Microsoft Teams stores data but is not primarily for compliance. Option C is wrong because Power BI is for analytics.

Option D is wrong because Microsoft Bookings is for scheduling.

Full explanation →

203

MCQmedium

A mid-sized company, Fabrikam, uses Microsoft 365 Business Premium. The company has 500 users and wants to implement a solution to protect against phishing attacks that target user credentials. The solution must: 1. Automatically detect and block malicious links in emails and Teams messages. 2. Provide real-time protection when users click on links in emails. 3. Allow users to report suspicious emails to the security team. 4. Integrate with Microsoft Entra ID to enforce conditional access policies based on user risk. Which combination of Microsoft 365 services should Fabrikam deploy?

A.Deploy Microsoft Intune and enforce conditional access policies that require compliant devices.

B.Deploy Microsoft Sentinel and configure analytics rules for phishing.

C.Deploy Microsoft Purview Data Loss Prevention and set up an email policy.

D.Deploy Microsoft Defender for Office 365 and enable Microsoft Defender XDR.

AnswerD

Covers link protection, reporting, and integration with Entra ID.

Why this answer

Microsoft Defender for Office 365 (formerly Office 365 ATP) provides Safe Links and Safe Attachments to automatically detect and block malicious links in email and Teams messages, and offers real-time protection when users click links. Microsoft Defender XDR (Extended Detection and Response) correlates signals across Defender for Office 365, Defender for Endpoint, and Microsoft Entra ID to enforce conditional access policies based on user risk, fulfilling all four requirements.

Exam trap

The trap here is that candidates often confuse Microsoft Purview (compliance/DLP) with email security, or think Intune's compliance policies can replace dedicated phishing protection, but only Defender for Office 365 provides the required link scanning and click-time protection for email and Teams.

How to eliminate wrong answers

Option A is wrong because Microsoft Intune focuses on device management and compliance, not on detecting phishing links in emails or Teams messages, and it cannot automatically block malicious links in those channels. Option B is wrong because Microsoft Sentinel is a SIEM/SOAR tool for aggregating and analyzing security logs, not a real-time email/Teams phishing protection service; it lacks built-in Safe Links or click-time protection. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent accidental or unauthorized sharing of sensitive data, not to detect or block phishing links in emails or Teams messages.

Full explanation →

204

MCQeasy

A small company with 15 employees needs business-grade email, desktop versions of Office apps (Word, Excel, PowerPoint), and 1 TB of cloud storage per user. They do not need advanced security or compliance features. Which Microsoft 365 plan is the most cost-effective choice?

A.Microsoft 365 Business Basic

B.Microsoft 365 Business Standard

C.Microsoft 365 Business Premium

D.Microsoft 365 E3

AnswerB

Business Standard includes desktop Office apps, Exchange Online, and 1 TB cloud storage per user.

Why this answer

Microsoft 365 Business Standard is the most cost-effective choice because it includes business-grade email (Exchange Online), desktop versions of Office apps (Word, Excel, PowerPoint), and 1 TB of cloud storage per user via OneDrive. It meets all stated requirements without the added cost of advanced security or compliance features found in higher-tier plans.

Exam trap

The trap here is that candidates often confuse 'Business Basic' with 'Business Standard,' assuming Basic includes desktop apps, when in fact Basic only offers web and mobile versions, not the full locally installed Office suite.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 Business Basic provides only web and mobile versions of Office apps, not the desktop versions required by the question. Option C is wrong because Microsoft 365 Business Premium includes advanced security and compliance features (e.g., Microsoft Defender for Office 365, Azure Information Protection) that the company does not need, making it more expensive than necessary. Option D is wrong because Microsoft 365 E3 is an enterprise plan designed for larger organizations with advanced compliance, security, and analytics capabilities, and it costs significantly more than Business Standard without providing additional value for a 15-employee company.

Full explanation →

205

MCQeasy

A small business wants to use email and collaboration software without maintaining servers, databases, or application updates. Which cloud service model best describes Microsoft 365?

A.Infrastructure as a Service (IaaS)

B.Platform as a Service (PaaS)

C.Software as a Service (SaaS)

D.On-premises hosting

AnswerC

Microsoft 365 delivers complete cloud-hosted applications that Microsoft operates and updates.

Why this answer

Microsoft 365 is a cloud-based suite that provides email (Exchange Online) and collaboration tools (Teams, SharePoint) as ready-to-use applications. This aligns with the SaaS model, where the provider manages the underlying infrastructure, platform, and software updates, allowing the customer to simply use the software without server maintenance.

Exam trap

The trap here is that candidates often confuse PaaS with SaaS because both are 'platforms' in a broad sense, but PaaS is for developers building apps (e.g., Azure App Service), while SaaS delivers finished applications like Microsoft 365.

How to eliminate wrong answers

Option A is wrong because IaaS provides virtualized computing resources (VMs, storage, networking) where the customer must still manage the OS, applications, and updates, which contradicts the 'without maintaining servers' requirement. Option B is wrong because PaaS offers a development platform (runtime, database, middleware) for building custom applications, not ready-to-use email and collaboration software like Microsoft 365. Option D is wrong because on-premises hosting requires the customer to own and maintain all hardware, software, and updates locally, which is the opposite of the cloud-based, no-maintenance model described.

Full explanation →

206

MCQmedium

A company wants to ensure that all administrative actions in Microsoft 365 are logged and that any changes to roles and permissions are reviewed on a monthly basis. Which Microsoft Purview solution should the compliance team use?

A.Audit (Standard)

B.Audit (Premium)

C.Privileged Access Management

D.Privileged Identity Management

AnswerD

PIM enables recurring access reviews of privileged roles, ensuring that changes to roles and permissions are reviewed monthly.

Why this answer

Privileged Identity Management (PIM) is the correct solution because it provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions. PIM also generates audit logs for role activations and changes, and supports periodic access reviews (e.g., monthly reviews of role assignments) through Microsoft Entra ID access reviews, directly meeting the requirement to review changes to roles and permissions on a monthly basis.

Exam trap

The trap here is that candidates often confuse Privileged Access Management (PAM) with Privileged Identity Management (PIM), but PAM is for task-level just-in-time access while PIM is for role-level lifecycle management and recurring reviews.

How to eliminate wrong answers

Option A is wrong because Audit (Standard) only captures basic events like user sign-ins and mailbox access, not the detailed role activation or permission change logs needed for monthly review of administrative roles. Option B is wrong because Audit (Premium) provides more detailed logging (e.g., when admin users access sensitive items) but does not include the ability to schedule or enforce monthly access reviews of role assignments. Option C is wrong because Privileged Access Management (PAM) is focused on just-in-time access for specific high-risk tasks (e.g., changing a mailbox permission) and does not provide the role assignment lifecycle management or recurring review capabilities that PIM offers.

Full explanation →

207

MCQhard

An organization decides to implement Microsoft 365 Business Premium. The security team wants to ensure that all devices accessing company data are compliant with security policies. Which service should they use?

A.Microsoft Defender for Office 365

B.Microsoft Entra ID

C.Microsoft Intune

D.Microsoft Purview

AnswerC

Microsoft Intune is a mobile device management and mobile application management service that enforces compliance policies.

Why this answer

Option A is correct because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service that enforces compliance policies. Option B is wrong because Microsoft Entra ID is for identity and access management. Option C is wrong because Microsoft Defender for Office 365 protects email and collaboration tools.

Option D is wrong because Microsoft Purview is for data governance and compliance.

Full explanation →

208

MCQmedium

A business stakeholder asks how Microsoft 365 can help them check feature availability by plan, region, or rollout status. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Whiteboard

B.Official Microsoft service descriptions and licensing documentation

C.Microsoft Stream

D.Microsoft Forms

AnswerB

Official documentation is the reliable source for plan and availability details.

Why this answer

The stakeholder's question is about checking feature availability by plan, region, or rollout status, which is a licensing and documentation concern. Official Microsoft service descriptions and licensing documentation (such as the Microsoft 365 Licensing Datasheets and Service Descriptions on the Microsoft 365 admin center) provide the authoritative, up-to-date matrix of which features are available in which plans, supported regions, and current rollout phases. This is the correct resource for such inquiries, as it is maintained by Microsoft and directly addresses licensing and support concepts.

Exam trap

The trap here is that candidates may confuse a specific application (like Whiteboard, Stream, or Forms) with a licensing or documentation resource, because the question mentions 'feature availability' and they might think these apps have built-in feature checkers, but only the official service descriptions and licensing documentation provide the authoritative, plan- and region-specific data.

How to eliminate wrong answers

Option A is wrong because Microsoft Whiteboard is a collaboration application, not a resource for checking feature availability by plan, region, or rollout status; it has no licensing or documentation role. Option C is wrong because Microsoft Stream is a video service for enterprise content, not a source for licensing or feature availability documentation; it does not provide plan or region matrices. Option D is wrong because Microsoft Forms is a survey and quiz tool, not a licensing or support documentation resource; it cannot be used to check feature availability by plan or region.

Full explanation →

209

MCQmedium

A company uses Microsoft 365 E5. The security team wants to automatically investigate and remediate advanced threats across email, endpoints, and identities. Which Microsoft 365 Defender workload should they enable?

A.Microsoft Defender for Identity

B.Microsoft Defender for Endpoint

C.Microsoft Defender for Office 365

D.Microsoft Defender XDR

AnswerD

Correct. XDR provides cross-domain investigation and response.

Why this answer

Microsoft Defender XDR (option D) is the correct answer because it is the unified, cross-domain security solution that correlates signals across email, endpoints, identities, and cloud apps to automatically investigate and remediate advanced threats. Unlike the individual Defender workloads, Defender XDR provides integrated incident response and automated actions across all these domains, which directly matches the requirement for automatic investigation and remediation across email, endpoints, and identities.

Exam trap

The trap here is that candidates often confuse the individual Defender workloads (Identity, Endpoint, Office 365) with the integrated cross-domain solution (Defender XDR), mistakenly thinking one of the single-domain tools can automatically investigate and remediate across all three domains simultaneously.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Identity focuses solely on on-premises Active Directory and hybrid identity threats using behavioral analytics and alerts, but it does not cover email or endpoint investigation and remediation. Option B is wrong because Microsoft Defender for Endpoint is limited to endpoint devices (Windows, macOS, Linux, Android, iOS) and does not include email or identity threat investigation and remediation. Option C is wrong because Microsoft Defender for Office 365 protects only email and collaboration workloads (Exchange Online, SharePoint, Teams) and does not extend to endpoint or identity threat investigation and remediation.

Full explanation →

210

MCQeasy

A department asks for the Microsoft 365 service best suited for enterprise video publishing and town hall recordings. Which service should they use?

A.Microsoft Purview Compliance Manager

B.Microsoft Stream on SharePoint

C.Microsoft Entra Privileged Identity Management

D.Microsoft Defender for Endpoint

AnswerB

Stream built on SharePoint supports enterprise video experiences.

Why this answer

Microsoft Stream on SharePoint is the correct service because it is designed for enterprise video publishing, including town hall recordings, live events, and on-demand video. It leverages SharePoint's storage and permissions model, allowing videos to be stored as files in document libraries with metadata, retention policies, and granular access controls, making it ideal for internal communications.

Exam trap

The trap here is that candidates may confuse Microsoft Stream (classic) with Stream on SharePoint, or think that Microsoft Purview Compliance Manager or Defender for Endpoint could handle video content due to their broad names, but the question specifically requires a service for enterprise video publishing and town hall recordings.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Compliance Manager is a compliance management solution that provides risk assessments and controls for regulatory standards (e.g., GDPR, ISO 27001), not a video publishing or recording service. Option C is wrong because Microsoft Entra Privileged Identity Management is an identity governance tool for managing, monitoring, and auditing privileged roles and just-in-time access, not for video content. Option D is wrong because Microsoft Defender for Endpoint is a security solution for endpoint detection and response (EDR), antivirus, and threat hunting, not for video publishing or town hall recordings.

Full explanation →

211

MCQhard

A multinational company needs to ensure that its Microsoft 365 tenant meets regional data residency requirements by storing data only in specific geographic locations. Which Microsoft 365 feature should they use?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Intune

C.Microsoft Entra ID Conditional Access

D.Multi-Geo Capabilities

AnswerD

Multi-Geo allows data to be stored in specified regions.

Why this answer

Multi-Geo Capabilities in Microsoft 365 allow organizations to provision and store data at rest in specific geographic locations (geo regions) to meet data residency requirements. This feature enables a single tenant to span multiple countries/regions, with user data (Exchange Online, SharePoint, OneDrive, Teams) stored in the chosen geo location, ensuring compliance with regional regulations.

Exam trap

The trap here is that candidates often confuse data residency (where data is stored) with data access control (Conditional Access) or data lifecycle management, leading them to pick a security or governance feature instead of the dedicated geo-location feature.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management is a solution for governing data retention, deletion, and classification, not for controlling the geographic storage location of data. Option B is wrong because Microsoft Intune is a cloud-based endpoint management and mobile device management (MDM) service, not a tool for defining data residency or geo-location storage. Option C is wrong because Microsoft Entra ID Conditional Access is an identity-driven policy engine that controls access based on conditions like location, device, or risk, but it does not determine where data is stored at rest.

Full explanation →

212

MCQmedium

A service owner is comparing Microsoft 365 capabilities and needs to understand which security tasks Microsoft handles and which remain with the customer. Cloud concept or benefit best matches this requirement?

A.Microsoft Planner

B.Data Loss Prevention (DLP)

C.Sensitivity labels

D.Shared responsibility model

AnswerD

The shared responsibility model explains provider and customer responsibilities in cloud services.

Why this answer

The shared responsibility model defines which security tasks are handled by Microsoft (e.g., physical security, hypervisor patching) and which remain with the customer (e.g., user access management, data classification). This directly matches the service owner's need to understand the division of security responsibilities in Microsoft 365.

Exam trap

The trap here is that candidates may confuse specific security features (like DLP or sensitivity labels) with the overarching responsibility framework, failing to recognize that the shared responsibility model is the foundational concept that explains the division of security tasks.

How to eliminate wrong answers

Option A is wrong because Microsoft Planner is a task management and collaboration tool, not a security concept that defines responsibility boundaries. Option B is wrong because Data Loss Prevention (DLP) is a specific security feature that helps prevent data leaks, but it does not describe the overarching model of shared security responsibilities. Option C is wrong because sensitivity labels are used to classify and protect data based on policies, but they are a tool within the customer's responsibilities, not the model that explains which tasks Microsoft handles versus the customer.

Full explanation →

213

MCQhard

Adventure Works is a global manufacturing company with 10,000 employees using Microsoft 365 E3. They have a hybrid identity setup with Microsoft Entra Connect syncing on-premises Active Directory to Microsoft Entra ID. The company wants to implement a zero-trust security model and has identified that many users still use weak passwords and do not use MFA. They want to enforce MFA for all users, but they also want to allow users to register for MFA on their own using the Microsoft Authenticator app. The security team is concerned about phishing attacks and wants to use a more secure MFA method. Additionally, they want to ensure that any new user created in on-premises AD is automatically enabled for MFA within 24 hours. What should you recommend?

A.Configure Identity Protection to enforce MFA for risky sign-ins.

B.Enable per-user MFA in the Microsoft 365 admin center for all users.

C.Enable self-service password reset (SSPR) and require MFA for password changes.

D.Create a Conditional Access policy that requires MFA for all users and configure authentication methods policy to allow only Microsoft Authenticator.

AnswerD

This enforces MFA for all sign-ins and uses a secure method. New users are automatically covered.

Why this answer

Option D is correct. A Conditional Access policy with 'Require multifactor authentication' for all users is the best approach. Combined with a 'Security Defaults' or MFA registration policy, users can self-register.

Using 'Microsoft Authenticator' as the authentication method can be enforced via authentication methods policy. For new users, the Conditional Access policy will apply automatically when they sign in. Option A (per-user MFA) is outdated and not scalable.

Option B (identity protection) is for risk-based policies, not blanket MFA. Option C (SSPR) does not enforce MFA.

Full explanation →

214

MCQeasy

A sales manager wants to streamline the process of generating follow-up emails after customer meetings. Which Microsoft 365 app allows them to automatically create email drafts based on meeting notes using AI?

A.SharePoint Online

B.Copilot in Outlook

C.Microsoft Viva Insights

D.Microsoft Teams Premium

AnswerB

Copilot in Outlook can draft emails from meeting notes using AI.

Why this answer

Copilot in Outlook leverages AI to automatically generate email drafts based on meeting notes, transcripts, or summaries, directly within the Outlook interface. This allows the sales manager to streamline follow-up emails without manual composition, using natural language processing to extract key points and action items from the meeting context.

Exam trap

The trap here is that candidates may confuse Microsoft Teams Premium's intelligent recap feature (which summarizes meetings) with the AI email drafting capability, but Teams Premium does not generate email drafts; that is a distinct function of Copilot in Outlook.

How to eliminate wrong answers

Option A is wrong because SharePoint Online is a document management and collaboration platform, not an AI-powered email drafting tool; it lacks the integrated AI capabilities to generate email drafts from meeting notes. Option C is wrong because Microsoft Viva Insights focuses on personal productivity analytics, wellbeing, and meeting effectiveness insights, not on generating email content or drafts. Option D is wrong because Microsoft Teams Premium provides enhanced meeting features like intelligent recap, custom backgrounds, and advanced security, but it does not include AI-driven email draft generation; that capability is specific to Copilot in Outlook.

Full explanation →

215

MCQhard

An organization with 50,000 users is planning to deploy Microsoft 365 E5. They want to use Microsoft Entra ID P2 features for identity protection and access reviews. However, they notice that Entra ID P2 is included in E5 but not in E3. They also need to ensure compliance with regulatory requirements for data residency. Which additional licensing or configuration is required?

A.Purchase Microsoft Purview Information Protection add-on

B.Enable data residency by configuring Azure Information Protection policies

C.Purchase Microsoft Entra ID P2 licenses separately for all users

D.Add Microsoft 365 Multi-Geo licenses for users who need data residency in other regions

AnswerD

Multi-Geo is an add-on that enables data residency in specific geographic locations.

Why this answer

Data residency is addressed through Microsoft 365 Multi-Geo capabilities, which require additional licenses (per user beyond the central location). Entra ID P2 is included in E5, so no extra identity license is needed. Microsoft Purview Information Protection is also included.

Full explanation →

216

MCQmedium

A marketing team wants to create a centralized repository for brand assets, such as logos and templates, that can be accessed by all employees. Which Microsoft 365 service should they use?

A.SharePoint Online

B.Microsoft Stream

C.OneDrive for Business

D.Microsoft Lists

AnswerA

SharePoint provides team sites with document libraries for centralized content.

Why this answer

SharePoint Online is the correct choice because it is designed as a cloud-based document management and storage platform that supports centralized repositories with granular permission controls. It allows the marketing team to create a dedicated site or document library for brand assets, enabling all employees to access, share, and collaborate on logos and templates while maintaining version history and compliance policies.

Exam trap

The trap here is that candidates often confuse OneDrive for Business with SharePoint Online, assuming OneDrive can serve as a team repository, but OneDrive is designed for personal storage and lacks the centralized management, site hierarchy, and enterprise-level sharing controls that SharePoint provides.

How to eliminate wrong answers

Option B (Microsoft Stream) is wrong because it is a video management service for storing, streaming, and sharing recorded content, not a repository for static brand assets like logos and templates. Option C (OneDrive for Business) is wrong because it is a personal cloud storage solution intended for individual file storage and sharing, lacking the centralized, team-wide access controls and site structure needed for a company-wide brand asset repository. Option D (Microsoft Lists) is wrong because it is a data-tracking application for creating lists of items (e.g., issues, contacts) with metadata and views, not a file storage system for binary assets like images and documents.

Full explanation →

217

MCQmedium

A help desk lead is documenting the correct Microsoft 365 approach to improve employee experience through learning, insights, goals, and engagement experiences. Microsoft 365 app or service is the best fit?

A.Microsoft Viva

B.Microsoft Forms

C.Microsoft Planner

D.Microsoft Purview Audit

AnswerA

Microsoft Viva is the employee experience platform for Microsoft 365.

Why this answer

Microsoft Viva is the correct answer because it is an integrated employee experience platform (EXP) within Microsoft 365 that explicitly combines learning (Viva Learning), insights (Viva Insights), goals (Viva Goals), and engagement (Viva Engage). This directly matches the help desk lead's requirement to improve employee experience through those four pillars, whereas the other options are single-purpose tools that do not cover the full scope.

Exam trap

The trap here is that candidates may confuse Microsoft Viva with a single-feature app like Planner or Forms, failing to recognize that Viva is the only option designed as a comprehensive employee experience platform covering all four specified areas.

How to eliminate wrong answers

Option B (Microsoft Forms) is wrong because it is a survey and data collection tool, not a platform for learning, insights, goals, or engagement experiences. Option C (Microsoft Planner) is wrong because it is a lightweight project management and task assignment tool, lacking any capabilities for learning analytics, goal tracking, or employee engagement. Option D (Microsoft Purview Audit) is wrong because it is a compliance and auditing solution for tracking user and admin activities, unrelated to improving employee experience through learning, insights, goals, or engagement.

Full explanation →

218

Multi-Selecthard

An organization with 5,000 users has Microsoft 365 E3 licenses. They want to add Microsoft Defender for Office 365 (Plan 1) and Microsoft Purview Data Loss Prevention (DLP). Which THREE actions can achieve this?

Select 3 answers

A.Purchase Microsoft Purview DLP as an add-on

B.Upgrade all users to Microsoft 365 E5

C.Downgrade to Microsoft 365 E1 and add the features

D.Purchase Microsoft Defender for Office 365 (Plan 1) as an add-on

E.Switch to Microsoft 365 Business Premium

AnswersA, B, D

Purview DLP is available as an add-on for E3.

Why this answer

Microsoft 365 E3 licenses include Exchange Online Protection but not Defender for Office 365 (Plan 1) or Purview DLP. Both features can be added as standalone add-on subscriptions (Options A and D). Alternatively, upgrading all users to Microsoft 365 E5 bundles both features natively, making Option B correct.

This approach avoids per-user add-on costs and simplifies license management.

Exam trap

The trap here is that candidates often assume Microsoft 365 E1 or Business Premium can be scaled to 5,000 users, but E1 lacks the required features and Business Premium has a strict 300-user limit, making both invalid for this scenario.

Full explanation →

219

MCQmedium

A help desk lead is documenting the correct Microsoft 365 approach to keep a workload on-premises while using Microsoft cloud collaboration services. Cloud concept or benefit best matches this requirement?

A.Hybrid cloud

B.Sensitivity labels

C.Microsoft Planner

D.Data Loss Prevention (DLP)

AnswerA

Hybrid cloud combines on-premises or private resources with public cloud services.

Why this answer

A hybrid cloud model is the correct approach because it allows an organization to keep a specific workload on-premises while leveraging Microsoft cloud collaboration services (such as Exchange Online, SharePoint Online, or Teams). This is achieved through integration technologies like Azure AD Connect for identity synchronization and Exchange Hybrid Configuration Wizard for mail routing, enabling a seamless coexistence between on-premises and cloud environments.

Exam trap

The trap here is that candidates confuse a specific Microsoft 365 service or feature (like Planner or DLP) with a cloud deployment model, failing to recognize that 'hybrid cloud' is the architectural concept that directly addresses the requirement of keeping a workload on-premises while using cloud services.

How to eliminate wrong answers

Option B (Sensitivity labels) is wrong because sensitivity labels are a Microsoft Information Protection feature used to classify and protect data based on sensitivity, not to architect a hybrid deployment where workloads remain on-premises. Option C (Microsoft Planner) is wrong because Planner is a cloud-based task management tool within Microsoft 365, not a concept or benefit that describes keeping workloads on-premises while using cloud services. Option D (Data Loss Prevention) is wrong because DLP is a security policy mechanism to prevent unauthorized sharing of sensitive data, not a cloud deployment model that supports hybrid scenarios.

Full explanation →

220

Multi-Selectmedium

Which THREE of the following are security features included in Microsoft 365 Business Premium? (Choose three.)

Select 3 answers

A.Microsoft Entra ID Plan 1

B.Microsoft Sentinel

C.Microsoft Purview Data Loss Prevention

D.Microsoft Defender for Business

E.Microsoft Defender for Cloud Apps

AnswersA, C, D

Entra ID P1 is included for identity management.

Why this answer

Option A is correct: Microsoft Defender for Business is included. Option B is correct: Microsoft Entra ID Plan 1 is included. Option D is correct: Microsoft Purview DLP is included.

Option C is wrong because Microsoft Sentinel is not included in Business Premium. Option E is wrong because Microsoft Defender for Cloud Apps (Cloud App Security) is not included as a full feature; some capabilities are included but not the full product.

Full explanation →

221

MCQmedium

An enterprise wants to allow employees to access corporate resources (emails, files, intranet) from unmanaged personal devices while ensuring that corporate data cannot be copied to personal apps. Which Microsoft 365 technology should be configured?

A.Microsoft Intune Mobile Device Management (MDM)

B.Microsoft Intune Mobile Application Management (MAM)

C.Microsoft Entra ID Conditional Access

D.Microsoft Baseline Protection

AnswerB

MAM allows policy-driven data protection at the app level, separating corporate and personal data.

Why this answer

Microsoft Intune Mobile Application Management (MAM) allows administrators to apply data protection policies directly to applications, such as Outlook and SharePoint, without enrolling the device itself. This enables employees to access corporate resources from unmanaged personal devices while preventing data from being copied or transferred to personal apps through features like multi-identity management and app-level PIN policies.

Exam trap

The trap here is that candidates often confuse MDM (device-level management) with MAM (app-level management), assuming that any data protection requires full device enrollment, when MAM provides the exact capability needed for unmanaged devices.

How to eliminate wrong answers

Option A is wrong because Microsoft Intune MDM requires device enrollment, which gives the organization control over the entire device, conflicting with the requirement to keep personal devices unmanaged. Option C is wrong because Microsoft Entra ID Conditional Access controls access based on conditions like device compliance or location but does not provide the granular data-loss prevention controls within apps needed to block copying corporate data to personal apps. Option D is wrong because Microsoft Baseline Protection is not a real Microsoft 365 technology; it is a distractor that does not exist in the Microsoft 365 security portfolio.

Full explanation →

222

Multi-Selecthard

Which TWO scenarios are best suited for a hybrid cloud deployment?

Select 2 answers

A.Extending on-premises Active Directory to Microsoft Entra ID

B.Using cloud bursting to handle peak load for an on-premises application

C.Storing archival data that is rarely accessed

D.Hosting a public-facing website with high traffic

E.Running a legacy application that requires physical hardware

AnswersA, B

Hybrid identity solutions connect on-premises AD to cloud.

Why this answer

Options A and D are correct. Hybrid cloud is ideal for connecting on-premises resources to public cloud, such as extending on-premises Active Directory to Azure AD (now Microsoft Entra ID) and using cloud bursting for extra capacity. Option B (Running a legacy app that requires physical hardware) is not cloud-friendly.

Option C (Hosting a public website) can be done in public cloud alone. Option E (Storing archival data) can be done in public cloud alone.

Full explanation →

223

MCQmedium

A user accidentally shared a file containing credit card numbers with a partner organization. You need to prevent similar incidents and detect when such data is shared externally. What should you configure?

A.Azure Information Protection (AIP)

B.Microsoft Purview eDiscovery

C.Microsoft 365 Data Loss Prevention (DLP) policy

D.Information Rights Management (IRM)

AnswerC

DLP policies detect sensitive data like credit card numbers and block sharing.

Why this answer

A DLP policy (B) can detect credit card numbers and block external sharing. Option A (IRM) protects files after sharing. Option C (AIP) is now part of MIP.

Option D (eDiscovery) is for search, not prevention.

Full explanation →

224

Multi-Selectmedium

Which THREE are features of Microsoft Purview Information Protection?

Select 3 answers

A.Auto-labeling for sensitive data

B.Encryption for emails and documents

C.Data loss prevention policies

D.Retention policies

E.Sensitivity labels

AnswersA, B, E

Auto-labeling automatically applies labels based on content.

Why this answer

Options A, B, and D are correct. Information Protection includes sensitivity labels, auto-labeling, and encryption. Option C is wrong because DLP is a separate solution.

Option E is wrong because retention policies are part of Data Lifecycle Management.

Full explanation →

225

MCQhard

A tenant administrator sees the above JSON snippet for a Copilot for Microsoft 365 license assignment. What is the result of this configuration?

A.The user receives Copilot for Microsoft 365 with all features enabled.

B.The license assignment is invalid because Copilot for Microsoft 365 cannot be assigned via JSON.

C.The user receives Copilot for Microsoft 365 but cannot use Bing Chat Enterprise or Teams meeting recordings.

D.The user is assigned a Microsoft 365 E5 license instead.

AnswerC

Correct. The disabledPlans list indicates which services are turned off.

Why this answer

Option C is correct because the JSON snippet shows that the 'Bing_Chat_Enterprise' and 'Microsoft_Teams_Meeting_Recording' service plans are disabled (status 'Disabled') for the Copilot for Microsoft 365 license assignment. This means the user receives Copilot but without those specific features. The JSON snippet is a valid way to assign a Copilot license with custom service plan exclusions using Microsoft Graph or PowerShell.

Exam trap

The trap here is that candidates assume all features are enabled by default when a license is assigned, but the JSON snippet's 'Disabled' status for specific service plans directly contradicts that assumption, and many overlook the ability to disable individual service plans during license assignment.

How to eliminate wrong answers

Option A is wrong because the JSON explicitly disables two service plans, so the user does not receive all features enabled. Option B is wrong because Copilot for Microsoft 365 can be assigned via JSON using the Microsoft Graph API or PowerShell with the `-LicenseOptions` parameter, which is a standard method for granular license assignment. Option D is wrong because the JSON specifies the SKU for Copilot for Microsoft 365 (not an E5 license), and disabling service plans does not change the license type.

Full explanation →

Microsoft 365 Fundamentals MS-900 (MS-900) — Questions 151–225