Microsoft 365 Fundamentals MS-900 MS-900 Questions 151–217 | Page 3/3

151

MCQhard

A compliance officer needs to set up a policy that automatically monitors and detects activities related to accessing sensitive data from outside the corporate network. When a user from a foreign country accesses a confidential file, the policy should trigger an alert and require additional authentication. Which combination of Microsoft 365 solutions achieves this?

A.Microsoft Purview Data Loss Prevention and Conditional Access

B.Microsoft Purview Audit (Standard) and Microsoft Entra ID Identity Protection

C.Microsoft Purview Insider Risk Management and Microsoft Cloud App Security

D.Microsoft Purview eDiscovery and Privileged Identity Management

AnswerA

Microsoft Purview Data Loss Prevention (DLP) continuously inspects content in Exchange, SharePoint, OneDrive, and endpoints to detect sensitive data patterns and automatically trigger alerts or protective actions. Conditional Access in Microsoft Entra ID evaluates signals such as user location, device compliance, and risk level to require additional authentication (e.g., MFA) before access is granted. Together, they satisfy both the monitoring-and-alerting requirement and the adaptive authentication requirement, making them the correct pairing.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) monitors and detects sensitive data access from outside the corporate network, while Conditional Access enforces additional authentication (e.g., MFA) when such access is detected. Together, they meet the requirement for automatic alerting and step-up authentication based on location and data sensitivity.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Insider Risk Management with external access detection, but it is specifically for internal user risk, not foreign country access scenarios.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Audit (Standard) only logs user activities for forensic review, not real-time detection or policy-driven alerts, and Microsoft Entra ID Identity Protection focuses on user risk (e.g., compromised credentials) rather than data access policies. Option C is wrong because Microsoft Purview Insider Risk Management is designed for internal user behavior analytics (e.g., data exfiltration by employees), not external access detection, and Microsoft Cloud App Security provides cloud app visibility but lacks native DLP policy enforcement for on-premises file access. Option D is wrong because Microsoft Purview eDiscovery is for legal discovery and content search, not real-time monitoring, and Privileged Identity Management (PIM) manages just-in-time admin roles, not data access policies.

Full explanation →

152

MCQmedium

A tenant administrator is advising a department that wants to keep services available during a hardware failure. Cloud concept or benefit best matches this requirement?

A.Microsoft Planner

B.Data Loss Prevention (DLP)

C.High availability

D.Sensitivity labels

AnswerC

High availability focuses on keeping services accessible despite component failure.

Why this answer

High availability (C) is the correct answer because it directly addresses the requirement to keep services available during a hardware failure. High availability refers to a system's ability to remain operational and accessible despite component failures, typically achieved through redundancy, failover clustering, and load balancing. In Microsoft 365, this is implemented via redundant infrastructure across multiple datacenters and automatic failover mechanisms, ensuring service continuity without manual intervention.

Exam trap

The trap here is that candidates confuse high availability with disaster recovery or data protection features like DLP, but high availability specifically focuses on minimizing downtime during failures, not on preventing data loss or classifying data.

How to eliminate wrong answers

Option A is wrong because Microsoft Planner is a task management application, not a cloud concept or benefit; it does not provide infrastructure-level availability during hardware failures. Option B is wrong because Data Loss Prevention (DLP) is a security feature that helps prevent sensitive information from being shared inappropriately, but it has no role in maintaining service availability during hardware outages. Option D is wrong because sensitivity labels are used for data classification and protection (e.g., encryption, marking), not for ensuring uptime or resilience against hardware failures.

Full explanation →

153

MCQmedium

A company must comply with a regulation that requires all data stored in Microsoft 365 to remain within the European Union. Which Microsoft 365 feature should an administrator configure to enforce this geographic restriction?

A.Data Loss Prevention (DLP)

B.Information Rights Management (IRM)

C.Data Residency policies

D.Customer Lockbox

AnswerC

Data Residency policies are designed specifically to ensure customer data is stored at rest within a defined geographic region. In Microsoft 365, administrators can leverage features like Multi-Geo in Exchange Online, SharePoint, and OneDrive to provision storage in specific datacenters, or rely on regional commitments such as the EU Data Boundary. These policies directly enforce where data resides, meeting regulatory requirements for storage location, making this the correct answer.

Why this answer

Data Residency policies in Microsoft 365 allow administrators to define the geographic location where data at rest is stored. By configuring a Data Residency policy for the European Union, the administrator ensures that all data remains within EU data centers, meeting regulatory requirements.

Exam trap

The trap here is that candidates often confuse Data Residency policies with Data Loss Prevention (DLP) or Information Rights Management (IRM), mistakenly thinking those features control data location rather than focusing on data protection or access control.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) is designed to prevent sensitive information from being shared or leaked, not to control where data is stored geographically. Option B is wrong because Information Rights Management (IRM) protects data through encryption and usage restrictions, but does not enforce data residency or storage location constraints. Option D is wrong because Customer Lockbox provides customer approval control over Microsoft engineer access to data during support scenarios, but does not determine or enforce the geographic storage location of data.

Full explanation →

154

MCQeasy

A sales team needs to create a shared workspace where they can store customer documents, collaborate on a lead list, track follow-ups on a shared calendar, and hold video meetings with customers. Which Microsoft 365 service provides all these capabilities in a single, integrated experience?

A.Microsoft Viva Engage

B.Microsoft Teams

C.SharePoint Online

D.OneNote

AnswerB

Microsoft Teams is a comprehensive collaboration hub in Microsoft 365 that brings together persistent chat, channel-based discussions, shared document storage (backed by SharePoint Online), and co-authoring capabilities. It also includes a team calendar synced with Exchange Online and native integration with Microsoft Teams Meetings for video conferencing, enabling a sales team to manage files, schedules, and virtual meetings in one place. This integrated combination of chat, documents, calendar, and video meetings makes Teams the ideal shared workspace for a sales team's daily operations.

Why this answer

Microsoft Teams is the correct answer because it provides a single, integrated workspace that combines persistent chat, file storage (via SharePoint), collaborative editing on lists (via SharePoint or Planner), a shared calendar, and built-in video meetings. This eliminates the need to switch between separate apps for each task, fulfilling all the sales team's requirements in one experience.

Exam trap

The trap here is that candidates often pick SharePoint Online because they associate it with document storage and lists, forgetting that Teams integrates those features with video meetings and a shared calendar, making it the single, integrated solution the question explicitly requires.

How to eliminate wrong answers

Option A is wrong because Microsoft Viva Engage is primarily a social networking and employee engagement tool (formerly Yammer), not designed for document storage, lead list collaboration, shared calendars, or video meetings. Option C is wrong because SharePoint Online provides document storage and list collaboration, but lacks native video meeting capabilities and a shared calendar for tracking follow-ups without additional integration. Option D is wrong because OneNote is a digital note-taking app that supports collaboration on notes but does not offer document storage, lead list management, a shared calendar, or video meeting functionality.

Full explanation →

155

MCQeasy

A company with 200 employees needs to deploy Microsoft 365 Apps for Enterprise. They want to pay monthly and have no annual commitment. Which licensing program should they use?

A.Microsoft 365 Enterprise Agreement

B.Microsoft 365 Business Basic

C.Microsoft 365 Business Premium

D.Microsoft 365 E3

AnswerC

Microsoft 365 Business Premium is the correct choice because it includes the full Microsoft 365 Apps for Enterprise desktop applications, hosted Exchange, Teams, SharePoint, and advanced security features like Microsoft Defender for Office 365 and Intune, and it can be licensed on a true monthly basis with no annual commitment—making it a flexible, comprehensive solution for 200 employees.

Why this answer

Microsoft 365 Business Premium is the correct choice because it includes Microsoft 365 Apps for Enterprise (e.g., Word, Excel, PowerPoint) and is available as a monthly subscription with no annual commitment for organizations with up to 300 users. This aligns with the company's requirement of 200 employees and the desire for flexible, month-to-month billing.

Exam trap

The trap here is that candidates often confuse Microsoft 365 Business Premium with Microsoft 365 E3, assuming E3 is the only option for desktop Office apps, but Business Premium also includes Microsoft 365 Apps for Enterprise and is designed for smaller organizations with flexible monthly billing.

How to eliminate wrong answers

Option A is wrong because the Microsoft 365 Enterprise Agreement (EA) is a volume licensing program designed for large organizations (typically 250+ users) that requires a 3-year commitment, not monthly billing with no annual commitment. Option B is wrong because Microsoft 365 Business Basic does not include the desktop versions of Microsoft 365 Apps for Enterprise; it only provides web and mobile app access plus cloud services like Exchange Online. Option D is wrong because Microsoft 365 E3 is an enterprise-grade plan that includes Microsoft 365 Apps for Enterprise, but it is typically sold through Enterprise Agreement or CSP with annual commitments, and it is not the most straightforward option for a company of 200 employees seeking a simple monthly subscription without commitment.

Full explanation →

156

MCQmedium

A compliance officer needs to automatically retain all SharePoint documents that contain a specific project code for exactly 5 years. The retention must be applied automatically when the document is uploaded, without any user interaction. Which Microsoft Purview feature should they configure?

A.Data Loss Prevention (DLP) policy

B.Sensitivity labels

C.Retention labels with an auto-apply policy

D.eDiscovery (Premium)

AnswerC

Retention labels with an auto-apply policy are purpose-built for this scenario: a Microsoft Purview auto-label policy runs a query to match keywords, sensitive info types, or trainable classifiers, and automatically assigns the retention label to each matching item. The label then enforces the configured retention period and disposition action—such as delete after 7 years or keep forever—without requiring any user effort. This content-triggered, hands-free lifecycle management makes it the only option that fully satisfies the compliance officer's need for automatic retention.

Why this answer

Retention labels with an auto-apply policy are the correct choice because they allow you to automatically assign a retention label to SharePoint documents based on specific conditions, such as the presence of a project code, and enforce a fixed retention period (e.g., 5 years) without any user interaction. This feature is designed for automated, policy-driven retention based on content properties or sensitive information types.

Exam trap

The trap here is that candidates often confuse retention labels (which enforce retention actions) with sensitivity labels (which focus on classification and protection), leading them to choose Option B when the requirement is purely about automated retention duration.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) policies are designed to prevent unauthorized sharing or leakage of sensitive data, not to enforce retention or deletion schedules. Option B is wrong because sensitivity labels primarily classify and protect data with encryption or visual markings, and while they can trigger retention, they require manual application or user interaction unless combined with auto-labeling, which is not the primary mechanism for automated retention based on a project code. Option D is wrong because eDiscovery (Premium) is used for searching, holding, and exporting data for legal or investigative purposes, not for automatically retaining documents for a fixed period upon upload.

Full explanation →

157

MCQeasy

A colleague says, 'The public cloud is cheaper because you only pay for the resources you use, like compute hours or storage space.' Which cloud computing characteristic directly supports this pay-as-you-go model?

A.Rapid elasticity

B.Broad network access

C.Measured service

D.On-demand self-service

AnswerC

Measured service is the cloud feature that automates the metering of resource usage, such as CPU time, storage GBs, and network bandwidth, at a granular level. It is this metering capability that enables the pay-as-you-go model, where customers are billed only for the actual consumption, and it allows providers to offer variable pricing that can be lower for sporadic workloads compared to on-premises fixed capacity. This direct linkage between usage and billing is why measured service, not elasticity or self-service, is the correct answer.

Why this answer

Measured service is the cloud computing characteristic that enables a pay-as-you-go model by metering resource usage (e.g., compute hours, storage GB-months, outbound data transfer) and providing transparent billing based on actual consumption. This allows providers like Azure to charge only for what is used, directly supporting the colleague's statement that the public cloud is cheaper because you pay only for resources consumed.

Exam trap

The trap here is that candidates often confuse on-demand self-service (the ability to provision resources without waiting) with the billing model, but on-demand self-service does not inherently include usage metering or pay-as-you-go pricing.

How to eliminate wrong answers

Option A is wrong because rapid elasticity refers to the ability to automatically scale resources up or down quickly based on demand, not to the metering or billing mechanism that supports pay-as-you-go. Option B is wrong because broad network access describes the ability to access cloud services over the network via standard protocols (e.g., HTTPS, SSH), which enables connectivity but does not involve usage tracking or cost allocation. Option D is wrong because on-demand self-service allows users to provision resources without human interaction (e.g., via the Azure portal or CLI), but it does not inherently include the metering or billing logic that makes pay-as-you-go possible.

Full explanation →

158

Drag & Dropmedium

Drag and drop the steps to perform an eDiscovery content search in the Microsoft 365 compliance center into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

eDiscovery content search involves creating a search, specifying locations, query, and reviewing results.

Full explanation →

159

Multi-Selecteasy

A business wants to use a cloud solution where they can scale computing resources up or down automatically based on demand and only pay for what they use. The cloud provider manages the underlying hardware. Which two cloud characteristics are being described? (Choose two.)

Select 2 answers

A.Elasticity

B.Measured service

C.Scalability

D.High availability

AnswersA, B

Elasticity is the cloud computing characteristic that allows resources to be automatically scaled up or down in response to real-time demand. In the scenario, the business can dynamically adjust resource consumption without manual intervention, ensuring they only provision what is needed. This automatic provisioning and deprovisioning directly aligns with the definition of elasticity, which is distinct from mere scalability because it responds to fluctuations in workload instantaneously.

Why this answer

Elasticity is correct because it describes the ability to automatically scale computing resources up or down based on demand, which is a key characteristic of cloud computing. The scenario explicitly states that resources scale automatically, which aligns with elasticity rather than just the ability to scale (scalability). Measured service is correct because the business pays only for what they use, which is the pay-per-use billing model enabled by metering resource consumption.

Exam trap

The trap here is that candidates confuse scalability (the ability to scale) with elasticity (automatic scaling based on demand), and they overlook measured service as a distinct characteristic because they focus only on the scaling aspect rather than the pay-per-use billing model explicitly stated in the question.

Full explanation →

160

MCQmedium

A company with 500 users currently has Microsoft 365 Business Basic licenses. They need to provide all users with the desktop versions of Office apps and increase email storage to 100 GB per user. What is the most cost-effective licensing upgrade from the options below?

A.Upgrade all users to Microsoft 365 Business Standard

B.Upgrade all users to Microsoft 365 Business Premium

C.Keep Business Basic and purchase Exchange Online Plan 2 add-on for each user

D.Upgrade to Microsoft 365 E3

AnswerD

Microsoft 365 E3 is an enterprise offering that includes the full desktop Office suite (e.g., Word, Excel, PowerPoint) as well as Exchange Online Plan 2, which provides per-user mailboxes with a 100 GB storage limit. This single license simultaneously satisfies the desktop applications requirement and the 100 GB mailbox requirement for all 500 users. As such, upgrading to Microsoft 365 E3 is the correct and most straightforward solution.

Why this answer

Microsoft 365 Business Basic provides only web and mobile versions of Office apps and 50 GB of email storage. The requirement for desktop Office apps and 100 GB email storage per user is met by Microsoft 365 E3, which includes both the full desktop Office suite and Exchange Online Plan 2 (100 GB mailbox). Among the options, E3 is the most cost-effective upgrade because it bundles these features without the additional security and device management costs of Business Premium or the inefficiency of stacking add-ons on Business Basic.

Exam trap

The trap here is that candidates often assume Business Standard or Business Premium already includes 100 GB mailboxes, but they only include Exchange Online Plan 1 (50 GB), and the question specifically requires 100 GB per user, which forces the upgrade to an Enterprise plan like E3.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 Business Standard includes desktop Office apps but only provides 50 GB of email storage per user (Exchange Online Plan 1), not the required 100 GB. Option B is wrong because Microsoft 365 Business Premium also includes only 50 GB email storage per user and adds unnecessary security and device management features that increase cost without addressing the 100 GB requirement. Option C is wrong because keeping Business Basic and adding Exchange Online Plan 2 per user would provide the 100 GB storage but still lacks desktop Office apps, requiring an additional purchase (e.g., Office 365 E1 or separate Office licenses), making it less cost-effective than a single E3 license that bundles both.

Full explanation →

161

MCQeasy

A help desk lead is documenting the correct Microsoft 365 approach to use hosted email without managing mail servers. Cloud concept or benefit best matches this requirement?

A.Platform as a Service (PaaS)

B.Community cloud

C.Software as a Service (SaaS)

D.Infrastructure as a Service (IaaS)

AnswerC

SaaS delivers a complete application operated by the provider; Exchange Online is a SaaS example.

Why this answer

Microsoft 365's Exchange Online delivers hosted email as a Software as a Service (SaaS) offering. This means Microsoft manages the mail servers, software updates, and infrastructure, while the help desk lead simply configures user mailboxes and policies via the admin center. SaaS is the cloud model where the provider hosts and manages the entire application, aligning perfectly with the requirement to avoid managing mail servers.

Exam trap

The trap here is that candidates confuse PaaS with SaaS because both involve managed services, but PaaS requires you to manage the application code and runtime, whereas SaaS delivers a fully finished application like Exchange Online, eliminating all server management tasks.

How to eliminate wrong answers

Option A is wrong because Platform as a Service (PaaS) provides a runtime environment for deploying custom applications, not a ready-to-use hosted email service; you would still need to build and manage the email application code. Option B is wrong because Community cloud is a deployment model where infrastructure is shared among several organizations with common concerns (e.g., compliance), not a service model that delivers hosted email without server management. Option D is wrong because Infrastructure as a Service (IaaS) provides virtualized servers, storage, and networking, requiring the customer to install, configure, and manage the email server software (e.g., Exchange Server) themselves, which contradicts the 'without managing mail servers' requirement.

Full explanation →

162

MCQmedium

An HR manager needs to collect employee feedback on a new policy. They want to create a short survey that anonymizes responses and provides automatic charts summarizing the results. Which Microsoft 365 app is best suited for this task?

A.Microsoft Lists

B.Microsoft Forms

C.Microsoft Sway

D.Microsoft Excel

AnswerB

Microsoft Forms is purpose-built for creating surveys and questionnaires with multiple question types (choice, rating, text), branching, and anonymous response options. It automatically compiles responses into real-time summary charts, supports exporting results to Excel, and can be embedded in Teams or SharePoint, making it the ideal tool for an HR manager to efficiently gather and analyze feedback.

Why this answer

Microsoft Forms is the correct choice because it is specifically designed for creating surveys and quizzes with built-in anonymous response settings and automatic chart generation. The HR manager can enable 'Record name' to be off for anonymity, and Forms automatically visualizes results with pie charts, bar graphs, and summary data without manual setup.

Exam trap

The trap here is that candidates may confuse Microsoft Lists as a survey tool because it can collect data via forms, but Lists lacks anonymous response settings and automatic charting, which are core to Forms.

How to eliminate wrong answers

Option A is wrong because Microsoft Lists is a data tracking and organization app for managing structured information like inventory or issues, not for creating surveys with automatic chart summaries. Option C is wrong because Microsoft Sway is a digital storytelling and presentation tool for interactive reports and newsletters, lacking survey creation and anonymous response collection. Option D is wrong because Microsoft Excel is a spreadsheet application that requires manual data entry and chart creation, and it does not natively support anonymous survey distribution or automatic result visualization.

Full explanation →

163

MCQeasy

A healthcare organization stores patient records in SharePoint Online. They need to ensure that the data is encrypted at rest and in transit. Which statement is true regarding Microsoft 365 encryption?

A.Microsoft provides default encryption for data at rest and in transit.

B.Customers must enable encryption at rest manually for each workload.

C.Encryption only applies to Exchange Online, not SharePoint or OneDrive.

D.Encryption is optional and can be turned off if a customer chooses.

AnswerA

Microsoft applies encryption automatically, without requiring any customer configuration. Data at rest, including SharePoint patient records, is protected with BitLocker disk encryption and Storage Service Encryption, while data in transit is secured with industry-standard TLS 1.2+ protocols. These default protections cover every Microsoft 365 workload, so encryption is always on from the moment data is written.

Why this answer

Microsoft 365 provides default encryption for data at rest and in transit across all workloads, including SharePoint Online, Exchange Online, and OneDrive for Business. For data at rest, Microsoft uses BitLocker Drive Encryption and service-side encryption with per-file keys, while data in transit is secured using TLS 1.2+ and IPSec. This means the healthcare organization's patient records in SharePoint Online are automatically encrypted without any manual configuration.

Exam trap

The trap here is that candidates often assume encryption must be manually configured or is optional, but Microsoft 365 enforces encryption by default across all workloads, and customers cannot disable it.

How to eliminate wrong answers

Option B is wrong because encryption at rest is enabled by default for all Microsoft 365 workloads, including SharePoint Online, and does not require manual enablement per workload. Option C is wrong because encryption applies to all Microsoft 365 services, not just Exchange Online; SharePoint Online and OneDrive for Business also use BitLocker and service-side encryption for data at rest and TLS for data in transit. Option D is wrong because encryption is mandatory and cannot be turned off by customers; Microsoft enforces encryption as a core security feature to protect data.

Full explanation →

164

MCQmedium

A business stakeholder asks how Microsoft 365 can help them allow sign-in using biometrics or FIDO2 security keys. Microsoft security, identity, or compliance capability should it use?

A.Microsoft Planner

B.Microsoft Entra ID passwordless authentication

C.Microsoft Stream

D.Microsoft Forms

AnswerB

Microsoft Entra ID supports passwordless methods such as Windows Hello for Business and FIDO2 security keys.

Why this answer

Microsoft Entra ID passwordless authentication (Option B) is the correct capability because it directly supports sign-in using biometrics (Windows Hello, Microsoft Authenticator) and FIDO2 security keys. This feature eliminates the need for passwords by leveraging public-key cryptography and the WebAuthn standard, aligning with the stakeholder's request for passwordless sign-in methods.

Exam trap

The trap here is that candidates may confuse productivity tools (Planner, Stream, Forms) with identity and access management capabilities, failing to recognize that passwordless authentication is a core feature of Microsoft Entra ID, not a standalone app.

How to eliminate wrong answers

Option A (Microsoft Planner) is wrong because it is a task management and project planning tool, not an identity or authentication service. Option C (Microsoft Stream) is wrong because it is a video sharing and management platform, unrelated to authentication mechanisms. Option D (Microsoft Forms) is wrong because it is a survey and data collection tool, with no capability to handle biometric or FIDO2 sign-in.

Full explanation →

165

MCQmedium

A help desk lead is documenting the correct Microsoft 365 approach to view usage reports without changing configuration. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Whiteboard

B.Microsoft Stream

C.Microsoft Forms

D.Reports Reader

AnswerD

Reports Reader can view reporting data while maintaining limited permissions.

Why this answer

The Reports Reader role in Microsoft 365 is specifically designed to allow users to view usage reports and adoption metrics without requiring any administrative permissions or configuration changes. This role provides read-only access to the Reports section in the Microsoft 365 admin center, enabling help desk leads to monitor usage data without altering settings or licensing. The other options (Whiteboard, Stream, Forms) are unrelated to viewing usage reports.

Exam trap

The trap here is that candidates may confuse the Reports Reader role with other Microsoft 365 services (like Stream or Forms) that have 'reporting' features in their own context, but only the Reports Reader role provides tenant-wide usage report access without configuration changes.

How to eliminate wrong answers

Option A is wrong because Microsoft Whiteboard is a digital canvas collaboration tool, not a reporting or admin role, and it does not provide access to usage reports. Option B is wrong because Microsoft Stream is a video service for recording and sharing videos, and it lacks any built-in capability to view Microsoft 365 usage reports without additional configuration. Option C is wrong because Microsoft Forms is a survey and quiz creation tool, and it cannot be used to access or view tenant-level usage reports from the admin center.

Full explanation →

166

MCQmedium

A company needs to ensure that their cloud data and applications remain available even if an entire Azure region experiences an outage. They also want to minimize latency by hosting resources in multiple geographic locations. Which cloud concept addresses these requirements?

A.Scalability

B.Geo-redundancy

C.Measured service

D.Resource pooling

AnswerB

Geo-redundancy stores synchronous or asynchronous copies of data in a secondary Azure region, commonly a paired region, and automatically fails over or permits customer-triggered failover when the primary region becomes unavailable. Azure Storage geo-redundant storage (GRS) and geo-zone-redundant storage (GZRS) maintain a second copy hundreds of miles away, while read-access geo-redundant storage (RA-GRS) additionally lets applications read from the secondary region, improving availability and lowering latency for nearby users.

Why this answer

Geo-redundancy (Option B) is correct because it specifically addresses the requirement for data and application availability during an entire Azure region outage by replicating resources across multiple geographically separated regions, such as Azure paired regions (e.g., East US and West US). This also minimizes latency by allowing traffic to be routed to the nearest available region, leveraging Azure Traffic Manager or Azure Front Door for global load balancing.

Exam trap

The trap here is that candidates often confuse geo-redundancy with high availability within a single region (e.g., Availability Zones) or mistakenly think scalability or resource pooling can provide region-level disaster recovery, but only geo-redundancy ensures data and app availability across entire regions.

How to eliminate wrong answers

Option A is wrong because scalability refers to the ability to increase or decrease resources (e.g., compute or storage) to handle demand, not to maintain availability during a region-wide outage or to reduce latency across geographic locations. Option C is wrong because measured service is a cloud characteristic where usage is metered and billed (e.g., pay-as-you-go), which does not address disaster recovery or geographic latency. Option D is wrong because resource pooling describes the multi-tenant model where provider resources are shared among customers (e.g., Azure's hypervisor isolation), not the replication of data across regions for high availability.

Full explanation →

167

MCQhard

An organization wants to prevent employees from sharing sensitive files with external users via SharePoint Online, but they need to allow sharing with a specific external partner for a single project. What is the most efficient configuration?

A.Disable external sharing at the tenant level and enable it only for the specific project site

B.Change the default sharing link type to 'Specific people' and add the partner's domain to an allow list

C.Apply sensitivity labels with encryption to all files

D.Configure a DLP policy to block external sharing except for the partner domain

AnswerA

Disabling external sharing at the tenant level in the SharePoint admin center (under Policies > Sharing) establishes a baseline that blocks all external sharing by default. Enabling it only for the specific project site via site-level sharing settings grants a granular exception, so the partner can access that site while all other sites remain locked down. This layered configuration directly enforces the requirement, as tenant settings are inherited unless explicitly overridden for the chosen site collection.

Why this answer

It allows the organization to disable external sharing globally at the tenant level via the SharePoint admin center, which prevents all users from sharing with external users by default. Then, by enabling external sharing only for the specific project site (site-level override), the organization can grant the necessary access to the external partner while maintaining the broad restriction. This is the most efficient approach because it uses a single configuration change at the tenant level and a targeted exception at the site level, avoiding complex policies or labels.

Exam trap

The trap here is that candidates often confuse DLP policies or sensitivity labels as the primary method to control sharing, when in fact SharePoint sharing settings at the tenant and site level are the direct and most efficient configuration for this scenario.

How to eliminate wrong answers

Option B is wrong because changing the default sharing link type to 'Specific people' does not block external sharing; it only changes the default link behavior, and adding the partner's domain to an allow list (via cross-tenant access settings) still permits external sharing broadly, not just for the single project. Option C is wrong because applying sensitivity labels with encryption protects files but does not prevent sharing; users can still share encrypted files with external users, and encryption does not enforce sharing restrictions. Option D is wrong because configuring a DLP policy to block external sharing except for the partner domain is overly complex and less efficient; DLP policies are designed for data loss prevention (e.g., blocking sensitive info in emails or documents) and are not the primary tool for controlling SharePoint sharing settings, which are managed via sharing permissions.

Full explanation →

168

Multi-Selecteasy

A company uses a cloud service where they pay only for the compute hours their virtual machines run. They can increase or decrease the number of VMs instantly based on demand. Which two cloud computing characteristics are demonstrated? (Choose two.)

Select 2 answers

A.On-demand self-service

B.Rapid elasticity

C.Measured service

D.Resource pooling

AnswersB, C

Rapid elasticity is the cloud characteristic that enables resources to be provisioned and released elastically, often automatically, to scale outward and inward commensurate with demand. In this scenario, the company's ability to increase or decrease the number of virtual machines based on demand is a textbook example of rapid elasticity, as it directly addresses the agility and scalability of resource allocation. This elasticity is what allows the company to align its resource usage with actual workload, rather than over-provisioning for peak demand.

Why this answer

B is correct because rapid elasticity allows the company to instantly increase or decrease the number of virtual machines based on demand, scaling resources up or down automatically. C is correct because measured service ensures that the company pays only for the compute hours their VMs run, with usage metered and billed accordingly.

Exam trap

The trap here is that candidates often confuse 'on-demand self-service' with the ability to instantly scale resources, but on-demand self-service specifically refers to the user's ability to provision resources without provider intervention, not the elasticity of scaling.

Full explanation →

169

MCQmedium

A company with 500 users is currently licensed with Microsoft 365 E3. The compliance team needs to add advanced eDiscovery capabilities (including predictive coding and legal hold) and the ability to retain data for up to 7 years. What is the most cost-effective licensing addition?

A.Microsoft 365 E5 Compliance add-on

B.Microsoft 365 E5 Security add-on

C.Microsoft 365 E5

D.Office 365 E5

AnswerA

This add-on includes advanced eDiscovery and retention features, specifically designed to meet compliance needs without the full E5 suite.

Why this answer

The Microsoft 365 E5 Compliance add-on provides advanced eDiscovery capabilities (including predictive coding and legal hold) and the ability to retain data for up to 7 years via retention policies. This add-on is the most cost-effective way to add these specific compliance features to an existing Microsoft 365 E3 subscription, as it avoids the higher cost of upgrading the entire suite to E5.

Exam trap

The trap here is that candidates often confuse the E5 Compliance add-on with the full E5 suite, assuming they need to upgrade the entire license when a targeted add-on is sufficient and more cost-effective.

How to eliminate wrong answers

Option B is wrong because the Microsoft 365 E5 Security add-on focuses on security features like Microsoft Defender for Office 365 and Microsoft 365 Defender, not on compliance capabilities such as advanced eDiscovery or long-term data retention. Option C is wrong because Microsoft 365 E5 includes both security and compliance features but is significantly more expensive than the E5 Compliance add-on, making it less cost-effective when only compliance features are needed. Option D is wrong because Office 365 E5 is a legacy plan that does not include the Windows or device management components of Microsoft 365 E3, and it would require a full license migration rather than a simple add-on, increasing cost and complexity.

Full explanation →

170

MCQmedium

A marketing team wants to create a visual task board to track campaign activities, assign owners, and set deadlines. They do not need subtasks or dependencies. Which Microsoft 365 app is most suitable?

A.Microsoft Planner

B.Microsoft Project

C.Microsoft To Do

D.Microsoft Lists

AnswerA

Microsoft Planner is the correct choice because it provides a purpose-built Kanban-style board with customizable buckets for stages (e.g., To Do, Doing, Done), cards for each task, and built-in fields for assignments, due dates, and progress tracking. This visual board view is immediately available without configuration, and Planner integrates natively with Microsoft Teams channels so the entire marketing team can collaborate in real time. Planner is included with most Microsoft 365 enterprise and business plans, making it a low-friction, cost-effective solution for a team needing a lightweight visual task board.

Why this answer

Microsoft Planner is the most suitable app because it provides a visual Kanban-style task board specifically designed for team collaboration, allowing users to create tasks, assign owners, set deadlines, and track progress without requiring subtasks or dependencies. It integrates seamlessly with Microsoft Teams and other Microsoft 365 services, making it ideal for lightweight project management like campaign tracking.

Exam trap

The trap here is that candidates often confuse Microsoft Planner with Microsoft To Do or Microsoft Lists, assuming any task-related app can handle team boards, but only Planner provides the specific visual Kanban board with team assignment and deadline tracking without dependencies.

How to eliminate wrong answers

Option B (Microsoft Project) is wrong because it is a full-featured project management tool designed for complex projects with dependencies, subtasks, resource management, and Gantt charts, which is overkill for a simple visual task board and not intended for lightweight team collaboration. Option C (Microsoft To Do) is wrong because it is a personal task management app focused on individual productivity, lacking team assignment, shared boards, and deadline tracking for group activities. Option D (Microsoft Lists) is wrong because it is a data-tracking and list management app for creating custom lists, forms, and workflows, but it does not provide a native Kanban board view or built-in task assignment features like Planner does.

Full explanation →

171

Multi-Selectmedium

An e-commerce company hosts its website on a public cloud IaaS platform. The site experiences varying traffic throughout the year. The cloud provider automatically adds more virtual servers during peak traffic and removes them when demand drops. The company only pays for the resources used during each period. Which two cloud characteristics are demonstrated? (Choose two.)

Select 2 answers

A.Rapid elasticity

B.Measured service

C.On-demand self-service

D.Resource pooling

AnswersA, B

Rapid elasticity is a core NIST characteristic of cloud computing where resources can be provisioned and released automatically, often in response to demand, to scale outward and inward rapidly. In this IaaS scenario, the automatic addition and removal of VMs based on traffic levels directly demonstrates this capability, making it the correct answer.

Why this answer

Rapid elasticity is demonstrated because the cloud provider automatically scales virtual servers up or down in response to varying traffic, which is a key characteristic of cloud computing where resources can be provisioned and released elastically to match demand. Measured service is demonstrated because the company only pays for the resources used during each period, meaning the provider meters resource usage (e.g., CPU hours, memory, bandwidth) and bills accordingly, which is a core attribute of cloud services.

Exam trap

The trap here is that candidates often confuse 'on-demand self-service' with automatic scaling, but on-demand self-service is about manual provisioning without provider interaction, not about the system's ability to scale automatically based on load.

Full explanation →

172

Multi-Selecthard

Which THREE Microsoft 365 services are part of Microsoft Viva, the employee experience platform?

Select 3 answers

A.Viva Learning

B.Viva Insights

C.Viva Connections

D.Microsoft Teams

E.Microsoft Stream

AnswersA, B, C

Viva Learning integrates learning resources into the flow of work.

Why this answer

Viva Learning is correct because it is a dedicated Microsoft Viva module that provides a centralized learning hub within Microsoft Teams, allowing employees to access, share, and assign training content from LinkedIn Learning, Microsoft Learn, and third-party sources. It is explicitly part of the Viva employee experience platform, not a standalone service.

Exam trap

The trap here is that candidates confuse the underlying Microsoft 365 services (like Teams or Stream) with the Viva modules that run on top of them, leading them to select Teams as a Viva component instead of recognizing that Viva is a separate employee experience platform with distinct modules.

Full explanation →

173

MCQmedium

A company has 500 users and is considering moving to Microsoft 365. They need to ensure that all users have access to Exchange Online, SharePoint Online, and Teams, and they want to use Microsoft Entra ID P1 for identity management. Which Microsoft 365 subscription should they choose?

A.Microsoft 365 E5

B.Microsoft 365 E3

C.Microsoft 365 Business Basic

D.Microsoft 365 Business Premium

AnswerB

Microsoft 365 E3 is an enterprise-level plan with no seat cap, making it suitable for 500 users. It includes Exchange Online, SharePoint Online, Teams, and Microsoft Entra ID P1 (Azure AD Premium P1), which provides the required identity and access management features. This plan delivers all necessary services at a lower cost than E5, making it the correct and most cost-effective choice for the scenario.

Why this answer

Microsoft 365 E3 includes Exchange Online, SharePoint Online, Teams, and Microsoft Entra ID P1, meeting all stated requirements. Unlike Business Premium, E3 has no user limit, making it suitable for 500 users.

Exam trap

Candidates often overlook the 300-user limit on Microsoft 365 Business plans and assume Business Premium is sufficient for any organization size. In this scenario, the company has 500 users, so an Enterprise plan (E3) is required.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 E5 includes advanced security and compliance features (e.g., Microsoft Defender for Office 365, eDiscovery) that are not required, and it is more expensive than necessary. Option B is wrong because Microsoft 365 E3 includes Exchange Online, SharePoint Online, and Teams, but it only provides Microsoft Entra ID P1 as an add-on or through a separate license; it is not included by default in the E3 subscription. Option C is wrong because Microsoft 365 Business Basic includes Exchange Online, SharePoint Online, and Teams, but it does not include Microsoft Entra ID P1; it only provides Microsoft Entra ID Free, which lacks advanced identity management features.

Full explanation →

174

MCQmedium

A department asks for the Microsoft 365 service best suited for custom low-code business apps. Which service should they use? The design must avoid adding custom operational scripts.

A.Microsoft Defender for Endpoint

B.Microsoft Entra Privileged Identity Management

C.Microsoft Purview Compliance Manager

D.Power Apps

AnswerD

Power Apps is used to build low-code apps connected to business data.

Why this answer

Power Apps is the correct choice because it is a low-code application development platform within Microsoft 365 that enables users to build custom business apps without writing traditional code. It provides pre-built templates, connectors to Microsoft and third-party services, and a visual drag-and-drop designer, allowing departments to create tailored solutions without custom operational scripts.

Exam trap

The trap here is that candidates may confuse security or compliance tools (like Defender, PIM, or Compliance Manager) with app development platforms, failing to recognize that Power Apps is the designated low-code solution in the Microsoft 365 ecosystem.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Endpoint is a security solution for endpoint protection, threat detection, and response, not a platform for building custom low-code business apps. Option B is wrong because Microsoft Entra Privileged Identity Management is an identity governance tool for managing, controlling, and monitoring privileged access within Azure AD, not for app development. Option C is wrong because Microsoft Purview Compliance Manager is a compliance management solution that helps organizations assess and manage regulatory compliance, not a low-code app development service.

Full explanation →

175

MCQhard

A global company needs to ensure that only employees in the 'HR' security group can access a specific set of HR documents stored in SharePoint. If a user outside the group attempts to view or copy the content, it must be blocked. The protection must persist even if someone downloads the files and shares them externally, or if the files are saved to a personal device. Which Microsoft Purview solution should be used?

A.Data Loss Prevention (DLP) policy

B.Sensitivity labels with encryption and permission settings

C.Microsoft Entra ID Conditional Access

D.Microsoft Defender for Cloud Apps session policy

AnswerB

Sensitivity labels, when configured with encryption, use Azure Information Protection (AIP) to encrypt the file content and apply usage rights based on the authenticated identity. The encryption is embedded into the file itself, so the protection persists everywhere—whether the file is downloaded, attached to email, or saved to a USB drive. By setting the permission to require the HR group, only their Entra ID accounts gain the rights to decrypt and read the file, making this the only option that enforces persistent, identity-based access control.

Why this answer

Sensitivity labels with encryption and permission settings are the correct solution because they allow you to apply persistent protection that travels with the file, regardless of where it is stored or shared. By configuring a sensitivity label to restrict access to only members of the 'HR' security group and enabling encryption, the protection remains intact even if the file is downloaded, saved to a personal device, or shared externally. This meets the requirement for persistent access control that blocks unauthorized viewing or copying.

Exam trap

The trap here is that candidates often confuse DLP policies (which only monitor and block sharing at the transport layer) with sensitivity labels (which provide persistent encryption and access control that stays with the file), leading them to choose DLP when the question explicitly requires protection that persists after download or external sharing.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) policies are designed to detect and prevent accidental sharing of sensitive information based on content inspection, but they do not apply persistent encryption or access control that travels with the file after it is downloaded or saved to a personal device. Option C is wrong because Microsoft Entra ID Conditional Access controls access at the authentication and session level for cloud apps, but it does not provide persistent protection that remains with the file once it is downloaded or shared outside the controlled environment. Option D is wrong because Microsoft Defender for Cloud Apps session policies can monitor and control access in real-time within the browser session, but they cannot enforce persistent encryption or access restrictions on files that have been downloaded or saved locally.

Full explanation →

176

MCQmedium

A compliance officer needs to automatically detect when employees share customers' personal data (e.g., social security numbers) via email and block such sharing. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Insider Risk Management

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Audit

AnswerA

DLP policies are content-aware and use built-in sensitive information types, such as regex patterns for Social Security numbers, to scan emails, documents, and chats across Exchange Online, SharePoint, and Teams. When a match occurs, DLP can automatically block the message from being sent or the file from being shared, while also showing a policy tip to the user and alerting the compliance officer. This provides real-time, automated detection and remediation of sensitive data sharing, which is exactly the requirement.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to identify, monitor, and automatically protect sensitive data—such as social security numbers—across Microsoft 365 services, including Exchange Online. DLP policies can be configured with conditions that detect sensitive information types (e.g., U.S. Social Security Number) in email messages and apply actions like blocking the email from being sent.

This directly meets the compliance officer's requirement to automatically detect and block sharing of customers' personal data via email.

Exam trap

The trap here is that candidates often confuse Communication Compliance (which reviews communications for policy violations) with DLP (which actively blocks sensitive data), leading them to select option C because they think 'compliance' implies blocking, but Communication Compliance only detects and flags, not blocks.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Insider Risk Management focuses on identifying, analyzing, and remediating internal risks (e.g., data theft, policy violations) by correlating signals from various sources, but it does not provide real-time blocking of sensitive data in email. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect and review inappropriate or policy-violating communications (e.g., harassment, insider trading) but does not have the capability to automatically block data sharing based on sensitive content like social security numbers. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, but it is a passive auditing tool that cannot automatically detect or block data sharing in real time.

Full explanation →

177

MCQmedium

A compliance administrator needs to block sharing of documents containing credit card numbers. Which Microsoft 365 capability is the best fit?

A.Data Loss Prevention policies

B.Microsoft Teams live events

C.Microsoft Bookings

D.OneDrive sync client

AnswerA

DLP detects sensitive information types and can restrict sharing across Microsoft 365 locations.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft 365 are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers—across Exchange Online, SharePoint, OneDrive, and Teams. By configuring a DLP policy with a built-in sensitive info type for credit card numbers, the administrator can block users from sharing documents containing that data, either by preventing the action or triggering a notification. This directly addresses the compliance requirement to block sharing of documents with credit card numbers.

Exam trap

The trap here is that candidates may confuse the OneDrive sync client with the OneDrive cloud service, thinking the sync client can enforce DLP policies locally, when in fact DLP policies are applied at the cloud service layer and the sync client simply replicates cloud-side restrictions.

How to eliminate wrong answers

Option B is wrong because Microsoft Teams live events is a broadcast and meeting feature for streaming video to large audiences; it has no capability to scan or block documents based on sensitive content like credit card numbers. Option C is wrong because Microsoft Bookings is a scheduling and appointment management tool; it does not include any data classification or policy enforcement to block sharing of sensitive information. Option D is wrong because the OneDrive sync client is a desktop application that synchronizes files between a local device and OneDrive; it does not natively enforce DLP policies or block sharing of documents containing credit card numbers—DLP policies are enforced at the cloud service level, not by the sync client.

Full explanation →

178

MCQeasy

A company uses a cloud provider that charges them based solely on the exact number of gigabytes of storage used and the number of virtual machine hours consumed. They can increase or decrease usage at any time without any upfront commitment. Which essential characteristic of cloud computing does this billing model demonstrate?

A.Measured service

B.Rapid elasticity

C.Resource pooling

D.On-demand self-service

AnswerA

Measured service is the cloud characteristic where a provider meters resource usage — such as compute hours, storage capacity, and network bandwidth — and bills customers based solely on that measured consumption. This pay-per-use model directly matches the scenario of being charged based on actual resource utilization, not on flat fees or other factors.

Why this answer

The billing model charges based on exact gigabytes of storage used and virtual machine hours consumed, which directly aligns with the 'measured service' characteristic of cloud computing. Measured service means cloud providers meter and bill customers precisely for the resources they consume, often using a pay-as-you-go model. This allows the company to pay only for what they use without upfront commitments, as described in the scenario.

Exam trap

The trap here is that candidates often confuse 'measured service' with 'on-demand self-service' because both involve user control and flexibility, but measured service specifically focuses on the metering and billing aspect, not the ability to provision resources without human interaction.

How to eliminate wrong answers

Option B (Rapid elasticity) is wrong because rapid elasticity refers to the ability to automatically scale resources up or down quickly in response to demand, not to the billing or metering of those resources. Option C (Resource pooling) is wrong because resource pooling describes how the provider's computing resources are pooled to serve multiple customers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand; it does not directly relate to billing granularity. Option D (On-demand self-service) is wrong because on-demand self-service allows a consumer to provision computing capabilities automatically without requiring human interaction with each service provider; while the scenario mentions the ability to increase or decrease usage at any time, the key billing aspect of 'pay per exact usage' is specifically measured service, not the provisioning mechanism.

Full explanation →

179

MCQmedium

Wide World Importers is a retail company with 2,000 users. They use Microsoft 365 E3. They need to: (1) Deploy a new employee experience platform that integrates with Microsoft 365 and provides personalized news, tasks, and learning; (2) Enable employees to create low-code apps to automate approvals and workflows without custom development; (3) Provide a secure way for employees to store and share company files with granular permissions; (4) Allow IT to manage mobile devices and applications centrally. Which Microsoft 365 services should they use?

A.Viva Connections, Power Apps and Power Automate, SharePoint Online, Microsoft Intune

B.Viva Insights, Power Apps and Power Automate, SharePoint Online, Microsoft 365 Defender

C.Microsoft Teams, Power Apps and Power Automate, OneDrive, Microsoft Entra ID

D.Viva Connections, Power BI, OneDrive, Microsoft Intune

AnswerA

This option is correct because it combines the four required services. Viva Connections delivers a personalized employee experience portal within Teams and SharePoint, Power Apps and Power Automate enable low-code custom business apps and automated workflows, SharePoint Online provides centralized document storage with granular permission controls, and Microsoft Intune enforces mobile device management (MDM) and mobile application management (MAM) policies for company-owned and BYOD devices.

Why this answer

Microsoft Viva Connections provides the employee experience platform with personalized news and tasks. Power Apps and Power Automate allow low-code app creation for approvals. SharePoint Online provides secure file storage with granular permissions.

Microsoft Intune provides mobile device and app management. Microsoft Teams is a collaboration platform but not the employee experience platform.

Full explanation →

180

MCQeasy

A sales team needs a centralized repository for customer proposals that multiple team members can edit simultaneously and that maintains version history. Which Microsoft 365 service should they use?

A.OneDrive for Business

B.SharePoint Online

C.Microsoft Teams

D.Exchange Online

AnswerB

SharePoint Online is the correct choice because it provides team-specific document libraries with granular permission controls, content types, and managed metadata that support a shared repository. Multiple users can co-author the same document simultaneously while version history records every change, and workflows or retention policies can be applied at the site or library level. For a centralized customer repository, SharePoint gives the sales team a governed, collaborative home rather than a personal drive or a communication tool.

Why this answer

SharePoint Online is the correct choice because it provides a centralized document library where multiple users can co-author documents simultaneously, with built-in version history to track changes over time. This aligns directly with the requirement for a shared repository with real-time collaboration and versioning, which OneDrive for Business lacks for team-wide access.

Exam trap

The trap here is that candidates often confuse Microsoft Teams as the file storage solution, but Teams relies on SharePoint Online for its Files tab, so the underlying service providing version history and simultaneous editing is SharePoint Online, not Teams itself.

How to eliminate wrong answers

Option A is wrong because OneDrive for Business is designed for personal storage and sharing with individuals, not as a centralized team repository; it does not support simultaneous editing by multiple team members in a shared workspace. Option C is wrong because Microsoft Teams is a collaboration platform that uses SharePoint Online for file storage; Teams itself does not provide the document library or version history features required. Option D is wrong because Exchange Online is an email and calendaring service, not a document management or collaboration tool, and cannot store or version customer proposals.

Full explanation →

181

Drag & Dropmedium

Drag and drop the steps to enable Microsoft 365 audit logging in the compliance center into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence to enable Microsoft 365 audit logging in the compliance center is: first sign in to the Microsoft 365 Compliance center, then navigate to the Audit solution, click 'Start recording user and admin activity' to enable auditing, and finally wait for the audit log to become active (which may take up to 24 hours). This order ensures that all prerequisites are met and the feature is properly activated.

Full explanation →

182

MCQhard

A compliance officer needs to ensure that any document containing passport numbers automatically gets a 'Highly Confidential' label and is encrypted when saved in SharePoint. The labeling should occur without any user interaction. Which Microsoft Purview feature should they configure?

A.Auto-labeling policy for sensitivity labels

B.Manual labeling using the Office apps

C.Retention labels with DLP policy

D.Trainable classifiers

AnswerA

Auto-labeling policies for sensitivity labels are purpose-built to evaluate content against sensitive information types—such as passport numbers, credit card numbers, or other regex-based classifiers—and automatically apply the appropriate sensitivity label without any user intervention. In Microsoft 365, these policies can be run in simulation mode first to validate accuracy, then switched to enforced mode to consistently label and optionally encrypt content. This directly satisfies the compliance officer's requirement because labeling and protection are applied programmatically at rest or in motion, rather than depending on human action.

Why this answer

Auto-labeling policies in Microsoft Purview can automatically apply a sensitivity label (e.g., 'Highly Confidential') to documents containing passport numbers when saved in SharePoint, without any user interaction. This is achieved by configuring a policy that uses sensitive info types (e.g., 'Passport Number') to detect the data and then automatically apply the label and encryption. The labeling occurs at rest, triggered by document upload or modification, meeting the compliance officer's requirement for zero user intervention.

Exam trap

The trap here is that candidates often confuse retention labels (which manage lifecycle) with sensitivity labels (which enforce protection like encryption), leading them to choose Option C, or they mistakenly think trainable classifiers (Option D) can directly apply labels without an auto-labeling policy.

How to eliminate wrong answers

Option B is wrong because manual labeling requires users to actively select a label in Office apps, which contradicts the requirement for automatic labeling without user interaction. Option C is wrong because retention labels are designed for managing data retention and deletion, not for applying encryption or sensitivity classifications; DLP policies can enforce actions but do not automatically apply sensitivity labels with encryption. Option D is wrong because trainable classifiers are used to identify content based on machine learning patterns (e.g., contracts or resumes), but they do not directly apply sensitivity labels or encryption; they can be used as conditions in auto-labeling policies, but the feature itself is not the policy that applies the label.

Full explanation →

183

MCQmedium

A company with 50 users currently has Microsoft 365 Business Basic licenses. They now want to give all users the desktop versions of Office apps and 1 TB of OneDrive storage per user. What is the most cost-effective licensing change?

A.Purchase Microsoft 365 Apps for Business licenses for all users

B.Upgrade all users to Microsoft 365 Business Standard

C.Upgrade all users to Microsoft 365 Business Premium

D.Purchase Microsoft 365 E3 licenses for all users

AnswerB

Upgrading every user to Microsoft 365 Business Standard is the appropriate choice because it includes the full desktop versions of Word, Excel, PowerPoint, and Outlook in addition to the cloud services already present in Business Basic, such as a 1 TB OneDrive, Exchange Online, Teams, and SharePoint. Since the tenant already has Business Basic, changing the licenses to Business Standard is a straightforward SKU modification, and the license change is billed at the price difference, making it more economical than purchasing a second Office-only plan.

Why this answer

Microsoft 365 Business Standard includes desktop Office apps, Exchange Online, Teams, and 1 TB OneDrive storage. Upgrading the existing subscriptions to Business Standard is more cost-effective than adding separate Microsoft 365 Apps for Business licenses because the latter does not include additional benefits like Exchange, and upgrading is typically priced per user as an incremental cost.

Full explanation →

184

MCQeasy

Your company wants to ensure that only managed and compliant devices can access Microsoft 365 resources. Which Microsoft 365 security feature enforces conditional access based on device compliance?

A.Microsoft Purview Compliance Manager

B.Microsoft Defender for Cloud Apps

C.Microsoft Sentinel

D.Microsoft Intune with Conditional Access in Microsoft Entra ID

AnswerD

Intune provides device compliance, and Entra ID Conditional Access enforces it.

Why this answer

Microsoft Intune manages device compliance policies (e.g., requiring encryption, antivirus, or a minimum OS version), and when integrated with Conditional Access in Microsoft Entra ID (formerly Azure AD), it enforces access decisions based on the device's compliance status. This ensures only managed and compliant devices can access Microsoft 365 resources, blocking or granting limited access to non-compliant devices.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB) with the device compliance enforcement mechanism, but Conditional Access with Intune is the specific feature that enforces access based on device compliance, not Defender for Cloud Apps.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Compliance Manager is a compliance management solution for assessing and managing regulatory compliance (e.g., GDPR, ISO 27001), not for enforcing device-level conditional access. Option B is wrong because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility and control over cloud app usage, but it does not natively enforce conditional access based on device compliance; it can integrate with Conditional Access but is not the primary enforcement point. Option C is wrong because Microsoft Sentinel is a Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution for threat detection and incident response, not for device compliance-based access control.

Full explanation →

185

MCQmedium

A legal team is involved in a court case and needs to identify all emails and documents related to a specific project across the entire organization. They need to place these items on hold to prevent deletion or modification. Which Microsoft Purview solution should they use?

A.Data Loss Prevention (DLP)

B.eDiscovery (Standard)

C.Audit (Standard)

D.Communication Compliance

AnswerB

eDiscovery (Standard) is the native Microsoft 365 solution for legal discovery, enabling keyword and metadata searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams content. It supports placing non-custodial and custodial holds to preserve in-place content from deletion, and its export function packages the search results and metadata for review. This aligns exactly with the legal team's need to identify and preserve relevant information for the court case.

Why this answer

EDiscovery (Standard), is correct because it is specifically designed for legal discovery processes, allowing authorized users to search for content across Exchange Online, SharePoint Online, OneDrive for Business, and Teams. It can place a legal hold on identified items to preserve them from deletion or modification, which directly meets the legal team's requirement to identify and hold all emails and documents related to a specific project.

Exam trap

The trap here is that candidates often confuse eDiscovery with Audit, thinking that logging all activities (Audit) is sufficient for legal holds, but Audit only records events and cannot preserve or search content for litigation purposes.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) is focused on preventing sensitive data from being shared or leaked, not on searching for and preserving content for legal cases. Option C is wrong because Audit (Standard) provides logging and visibility into user and admin activities but does not include search capabilities or the ability to place holds on content. Option D is wrong because Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) and does not provide the discovery or hold functionality needed for litigation.

Full explanation →

186

MCQeasy

A startup wants to focus only on developing and deploying its application code without managing underlying servers or operating systems. Which cloud service model best fits this need?

A.Infrastructure as a Service (IaaS)

B.Platform as a Service (PaaS)

C.Software as a Service (SaaS)

D.On-premises deployment

AnswerB

PaaS delivers a fully managed hosting environment that includes the operating system, language runtime, web server, and deployment tooling as part of the service. The startup only manages its application code and data, while the platform provider automatically handles patching, scaling, and infrastructure maintenance—exactly matching the requirement to focus purely on development and deployment.

Why this answer

Platform as a Service (PaaS) is the correct choice because it abstracts the underlying infrastructure, including servers, operating systems, and runtime environments, allowing the startup to focus solely on developing and deploying application code. With PaaS, the cloud provider manages the OS patching, hardware scaling, and middleware, while the customer only manages the application and data. This directly matches the requirement of not managing servers or operating systems.

Exam trap

The trap here is that candidates often confuse PaaS with IaaS, mistakenly thinking that IaaS also abstracts the OS, but IaaS only abstracts the hardware while leaving OS management to the customer.

How to eliminate wrong answers

Option A is wrong because Infrastructure as a Service (IaaS) provides virtualized servers, storage, and networking, but the customer is still responsible for managing the operating system, middleware, and runtime—contradicting the requirement to avoid managing servers or OS. Option C is wrong because Software as a Service (SaaS) delivers fully managed applications (e.g., Office 365, Salesforce) where the customer does not develop or deploy code, only consumes the software—this does not fit the need to develop and deploy custom application code. Option D is wrong because on-premises deployment requires the startup to own and manage all hardware, servers, and operating systems, which is the opposite of the stated goal of not managing underlying infrastructure.

Full explanation →

187

MCQmedium

A compliance administrator needs to assess compliance posture against standards and improvement actions. Which Microsoft 365 capability is the best fit?

A.OneDrive sync client

B.Microsoft Teams live events

C.Microsoft Purview Compliance Manager

D.Microsoft Bookings

AnswerC

Compliance Manager provides assessments, improvement actions, and compliance scoring.

Why this answer

Microsoft Purview Compliance Manager is the correct choice because it provides a comprehensive dashboard for assessing an organization's compliance posture against standards like ISO 27001, NIST, and GDPR, and it offers actionable improvement actions with step-by-step guidance. It automatically tracks controls, assigns scores, and integrates with Microsoft Secure Score to help administrators prioritize remediation efforts.

Exam trap

The trap here is that candidates may confuse general security or productivity tools (like OneDrive or Teams) with compliance-specific capabilities, overlooking that Compliance Manager is the dedicated solution for assessing and improving compliance posture against standards.

How to eliminate wrong answers

Option A is wrong because the OneDrive sync client is a file synchronization tool that syncs local files with cloud storage; it has no compliance assessment or improvement action capabilities. Option B is wrong because Microsoft Teams live events is a broadcasting feature for large virtual meetings; it does not provide compliance posture evaluation or improvement actions. Option D is wrong because Microsoft Bookings is a scheduling and appointment management tool; it lacks any compliance assessment or remediation functionality.

Full explanation →

188

MCQeasy

A service owner is comparing Microsoft 365 capabilities and needs to meter compute and storage usage for consumption-based billing. Cloud concept or benefit best matches this requirement?

A.Sensitivity labels

B.Microsoft Planner

C.Data Loss Prevention (DLP)

D.Measured service

AnswerD

Measured service tracks usage so customers can be charged according to consumption.

Why this answer

Measured service is a core cloud computing concept where resource usage (such as compute and storage) is metered, tracked, and billed based on actual consumption. This directly matches the service owner's requirement for consumption-based billing, as Microsoft 365 uses metering for services like Azure Active Directory and Exchange Online to enable pay-as-you-go models.

Exam trap

The trap here is that candidates confuse operational features (like DLP or sensitivity labels) with cloud service model characteristics, mistakenly thinking data protection tools are related to billing rather than recognizing measured service as a fundamental cloud attribute.

How to eliminate wrong answers

Option A is wrong because sensitivity labels are a Microsoft Purview Information Protection feature used to classify and protect data based on sensitivity, not to meter compute or storage usage. Option B is wrong because Microsoft Planner is a task management and collaboration tool within Microsoft 365, not a billing or metering mechanism. Option C is wrong because Data Loss Prevention (DLP) is a security policy feature that prevents unauthorized sharing of sensitive data, not a consumption-based billing capability.

Full explanation →

189

MCQmedium

A company currently uses Microsoft 365 Business Basic licenses for 80 users. They want to add the desktop versions of Office apps (Word, Excel, PowerPoint) without any additional security or compliance features. Which upgrade is the most cost-effective?

A.Upgrade to Microsoft 365 Business Standard

B.Upgrade to Microsoft 365 Business Premium

C.Upgrade to Microsoft 365 E3

D.Purchase Office 2019 Professional Plus standalone

AnswerA

Business Standard provides the full suite of desktop Office applications (Word, Excel, PowerPoint, Outlook) along with Exchange Online, SharePoint, Teams, and OneDrive, at a lower per-user monthly cost than Premium or E3. It directly meets the requirement for installed Office apps while preserving the cloud-based collaboration and management capabilities already present in Business Basic. It also includes the same core productivity and communication services without the additional security and device-management overhead that would be unnecessary for this scenario.

Why this answer

Microsoft 365 Business Standard is the most cost-effective upgrade from Business Basic because it includes the desktop versions of Office apps (Word, Excel, PowerPoint) without adding the advanced security and compliance features found in Business Premium or Enterprise plans. Business Standard provides the same core productivity tools at a lower per-user price point, making it the ideal choice when only desktop Office is needed.

Exam trap

The trap here is that candidates often choose Business Premium or E3 because they assume 'more features' means 'better value,' but the question explicitly states no additional security or compliance features are needed, making the lower-tier Business Standard the correct cost-effective choice.

How to eliminate wrong answers

Option B is wrong because Microsoft 365 Business Premium includes advanced security and compliance features (e.g., Microsoft Defender for Office 365, Azure Information Protection) that are not required, making it more expensive than necessary. Option C is wrong because Microsoft 365 E3 is an enterprise plan with additional capabilities like advanced eDiscovery, legal hold, and larger mailbox storage, which are overkill and significantly more costly for a small business needing only desktop Office. Option D is wrong because Office 2019 Professional Plus standalone is a non-subscription product that lacks cloud integration, updates, and support, and is not a direct upgrade path from Microsoft 365 Business Basic; it also does not include the same cloud services (e.g., Exchange Online, SharePoint) that the company already uses.

Full explanation →

190

MCQeasy

A company wants to ensure that all outgoing emails containing sensitive financial data are encrypted automatically. The encryption should require the recipient to authenticate to read the message. Which Microsoft 365 solution should the administrator configure?

A.Microsoft Defender for Office 365

B.Microsoft Purview Message Encryption

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview Insider Risk Management

AnswerB

Microsoft Purview Message Encryption, built on Azure Rights Management, encrypts outbound email content so that only authenticated recipients can decrypt it using a Microsoft account or a one-time passcode in a secure web portal. This capability can be fully automated via mail flow rules in Exchange Online, such as applying encryption when a DLP policy identifies sensitive financial data or when a message is sent to an external domain. The service ensures confidentiality for both data at rest and in transit, directly meeting the stated requirement.

Why this answer

Microsoft Purview Message Encryption (MPME) is the correct solution because it allows organizations to send encrypted emails that require recipients to authenticate (via a Microsoft account or a one-time passcode) before they can read the message. This directly meets the requirement for automatic encryption of outgoing emails with sensitive financial data and recipient authentication.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Data Loss Prevention (DLP) with Message Encryption, but DLP only detects and blocks sensitive data, while Message Encryption provides the actual encryption and recipient authentication required by the question.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Office 365 is a security solution focused on threat protection (anti-phishing, anti-malware, safe attachments/links), not on encrypting outgoing emails with recipient authentication. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) can detect and block sensitive data in emails but does not natively encrypt messages with recipient authentication; it can trigger MPME policies but is not the encryption solution itself. Option D is wrong because Microsoft Purview Insider Risk Management is designed to detect and mitigate internal risks (e.g., data theft, policy violations) and does not provide email encryption or recipient authentication.

Full explanation →

191

MCQmedium

A help desk lead is documenting the correct Microsoft 365 approach to web/mobile Office apps, business email, Teams, OneDrive, and SharePoint, but not desktop Office apps. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Stream

B.Microsoft Whiteboard

C.Microsoft Forms

D.Microsoft 365 Business Basic

AnswerD

Business Basic provides core cloud services and web/mobile apps without desktop Office apps.

Why this answer

The question describes a scenario requiring web/mobile Office apps, business email, Teams, OneDrive, and SharePoint—but explicitly excludes desktop Office apps. Microsoft 365 Business Basic is the correct plan because it includes all these services (Exchange Online for email, Teams, SharePoint Online, OneDrive for Business, and web/mobile versions of Office apps) without including the desktop Office applications, making it the most relevant licensing concept.

Exam trap

The trap here is that candidates often confuse Microsoft 365 Business Basic with Microsoft 365 Business Standard or Apps for Business, mistakenly thinking Basic includes desktop Office apps, or they incorrectly select a feature-specific tool (like Stream or Forms) instead of recognizing the question is about the correct licensing plan.

How to eliminate wrong answers

Option A is wrong because Microsoft Stream is a video service (for recording, sharing, and managing videos) and does not provide any of the core productivity services listed (email, Teams, OneDrive, SharePoint, or Office apps). Option B is wrong because Microsoft Whiteboard is a digital canvas collaboration tool, not a licensing plan that bundles the required services. Option C is wrong because Microsoft Forms is a survey and quiz creation tool, not a licensing plan that includes email, Teams, OneDrive, or SharePoint.

Full explanation →

192

MCQmedium

An organization wants to automatically detect when a user attempts to share a document containing a customer's credit card number via email. The system should block the sharing and display a warning to the user. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP)

B.Sensitivity labels

C.Retention policies

D.eDiscovery

AnswerA

Data Loss Prevention (DLP) uses Microsoft Purview's content analyzers and sensitive information types, such as credit card numbers or Social Security numbers, to scan documents in real time when a user attempts to share them through SharePoint, OneDrive, or Teams. When a match occurs, the DLP policy can block the sharing action, restrict access, or show a policy tip to the user. Because DLP inspects the actual file content and is integrated into the sharing workflow, it is the only solution that proactively detects and stops sensitive data from leaving the organization.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers—across Exchange Online, SharePoint, OneDrive, and Teams. When a user attempts to share a document containing a credit card number via email, DLP can inspect the content using built-in sensitive information types (e.g., Credit Card Number), block the email, and display a policy tip warning to the user. This matches the requirement exactly.

Exam trap

The trap here is that candidates confuse sensitivity labels with DLP, assuming labels can block sharing, when in fact labels only apply protection settings (encryption, markings) and rely on DLP or other controls to enforce blocking actions.

How to eliminate wrong answers

Option B (Sensitivity labels) is wrong because sensitivity labels classify and protect data by applying encryption or visual markings, but they do not automatically inspect content for specific patterns like credit card numbers or block sharing actions in real time. Option C (Retention policies) is wrong because retention policies are used to preserve or delete data after a specified period for compliance or legal reasons, not to prevent sharing or detect sensitive content. Option D (eDiscovery) is wrong because eDiscovery is a tool for searching and exporting content for legal or investigative purposes, not for real-time blocking or warning on outbound sharing.

Full explanation →

193

MCQmedium

A small business with 50 users currently has Microsoft 365 Business Basic subscriptions. They need the desktop versions of Office apps (Word, Excel, PowerPoint) for each user, in addition to the web and mobile versions they already have. What should they purchase for each user?

A.Microsoft 365 Business Standard license

B.Microsoft 365 F3 license

C.Office 365 E1 license

D.Microsoft 365 Business Voice add-on

AnswerA

Microsoft 365 Business Standard is a per-user subscription for up to 300 users that includes the installed Microsoft 365 Apps for business (Word, Excel, PowerPoint, Outlook, and others) alongside the same cloud services as Business Basic: Exchange Online, SharePoint, Teams, OneDrive, and Power Platform tools. This plan adds the full desktop Office clients to your existing business-grade collaboration stack, letting each user install Office on up to five devices. For a small business with 50 users who need desktop Office, this is the direct, cost-effective upgrade from Business Basic, as it precisely resolves the desktop app gap without adding unnecessary enterprise-level features.

Why this answer

Microsoft 365 Business Standard includes the desktop versions of Office apps (Word, Excel, PowerPoint) plus web and mobile access, making it the correct upgrade from Business Basic. The customer already has web and mobile apps via Business Basic, so adding Business Standard provides the missing desktop apps without over-provisioning.

Exam trap

The trap here is that candidates confuse 'Business Voice' as an Office app add-on rather than a PSTN telephony service, or they assume F3 or E1 include desktop apps because they are higher-tier enterprise plans, when in fact only Business Standard, Business Premium, and E3/E5 provide the full desktop Office suite.

How to eliminate wrong answers

Option B (Microsoft 365 F3 license) is wrong because F3 is a firstline worker plan that does not include the full desktop Office apps—it only provides web and mobile versions, which the customer already has. Option C (Office 365 E1 license) is wrong because E1 is an enterprise plan that also lacks desktop Office apps, offering only web and mobile access. Option D (Microsoft 365 Business Voice add-on) is wrong because it is a telephony add-on for calling features, not a license that includes desktop Office applications.

Full explanation →

194

MCQeasy

A small business with 10 users needs Microsoft 365 desktop versions of Office apps (Word, Excel, PowerPoint), business-grade email, and 1 TB of cloud storage per user. They do not need advanced security or compliance features. Which Microsoft 365 plan is the most cost-effective choice?

A.Microsoft 365 Business Basic

B.Microsoft 365 Business Standard

C.Microsoft 365 Business Premium

D.Microsoft 365 E3

AnswerB

Microsoft 365 Business Standard is the correct choice because it includes the fully installed desktop versions of Office apps (Word, Excel, PowerPoint, Outlook, and others) for each of the 10 users, alongside business-grade email (Exchange Online), 1 TB of OneDrive cloud storage per user, and Teams collaboration tools. This plan directly satisfies the stated need for desktop apps without adding unnecessary enterprise-level features.

Why this answer

Microsoft 365 Business Standard is the most cost-effective plan that includes desktop versions of Office apps (Word, Excel, PowerPoint), business-grade email (Exchange Online), and 1 TB of OneDrive cloud storage per user. Business Basic only provides web and mobile apps, not desktop versions. Business Premium adds advanced security and compliance features (e.g., Microsoft Defender for Office 365, Azure Information Protection) that the customer explicitly does not need.

E3 is an enterprise plan with similar features but at a higher per-user cost, making it overkill for a 10-user small business.

Exam trap

The trap here is that candidates often confuse 'business-grade email' with the need for desktop Office apps, and incorrectly choose Business Basic because it includes Exchange Online email, forgetting that Basic lacks the desktop Office client installation rights that the question explicitly requires.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 Business Basic includes only web and mobile versions of Office apps, not the full desktop installable versions (Word, Excel, PowerPoint) required by the customer. Option C is wrong because Microsoft 365 Business Premium includes advanced security and compliance features (e.g., Microsoft Defender for Office 365, Azure Information Protection, Data Loss Prevention) that the customer explicitly does not need, making it more expensive than necessary. Option D is wrong because Microsoft 365 E3 is an enterprise-grade plan designed for larger organizations with advanced compliance, security, and analytics capabilities (e.g., eDiscovery, Litigation Hold, Advanced Audit), and its per-user cost is significantly higher than Business Standard, making it an overpriced choice for a small business with only 10 users and no advanced requirements.

Full explanation →

195

MCQhard

An organization uses Microsoft 365 E5 and wants to automatically classify and protect sensitive documents stored in SharePoint Online based on content patterns (e.g., credit card numbers). They need to apply encryption and restrict access when such content is detected. Which Microsoft 365 service should they configure?

A.Microsoft Entra ID

B.Microsoft Purview Information Protection

C.Microsoft Sentinel

D.Microsoft Defender for Cloud Apps

AnswerB

Purview Information Protection provides automatic classification and labeling based on sensitive content.

Why this answer

Microsoft Purview Information Protection (formerly Azure Information Protection) is the correct service because it provides content-based classification and protection for sensitive data. It uses trainable classifiers and sensitive information types (e.g., credit card numbers) to automatically apply encryption and restrict access via sensitivity labels in SharePoint Online.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a CASB) with data classification, but it lacks the native content scanning and encryption enforcement that Purview Information Protection provides.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra ID is an identity and access management service, not a content classification or protection engine; it cannot scan documents for patterns like credit card numbers. Option C is wrong because Microsoft Sentinel is a security information and event management (SIEM) solution for threat detection and response, not for data classification or encryption. Option D is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that provides visibility and control over cloud apps, but it does not natively classify or encrypt content based on patterns within SharePoint documents.

Full explanation →

196

MCQmedium

A compliance administrator needs to automatically detect when employees share documents containing a customer's credit card number via email and block such sharing before the email is sent. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP)

B.Information Rights Management (IRM)

C.Sensitivity labels

D.Microsoft Defender for Office 365 (ATP)

AnswerA

Data Loss Prevention (DLP) policies in Microsoft 365 compliance automatically scan outbound email messages and attachments for sensitive information types, such as credit card numbers, and can block the message at the transport layer. A DLP rule can trigger a block action, preventing the sender from delivering the message, and even include a policy tip to notify the user. This is the only option here that directly inspects message content for defined sensitive patterns and enforces an outbound send block.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect sensitive data, such as credit card numbers, in transit (e.g., email) and enforce policy actions like blocking the email before it is sent. DLP uses deep content analysis, including pattern matching against predefined sensitive information types (e.g., credit card number regex), to inspect email bodies and attachments in real time within Exchange Online.

Exam trap

The trap here is that candidates often confuse Information Rights Management (IRM) with DLP because both involve protecting sensitive data, but IRM controls access after sending while DLP prevents the send action itself.

How to eliminate wrong answers

Option B is wrong because Information Rights Management (IRM) protects content after it is sent by encrypting and restricting permissions (e.g., prevent forwarding or printing), but it does not automatically detect or block sensitive data before transmission. Option C is wrong because sensitivity labels are used to classify and protect data based on manual or automatic labeling, but they do not natively scan for specific patterns like credit card numbers or block emails in transit; DLP policies can leverage labels, but the detection and blocking action is DLP's function. Option D is wrong because Microsoft Defender for Office 365 (formerly ATP) focuses on threat protection against malware, phishing, and malicious links, not on preventing accidental sharing of sensitive data like credit card numbers via content inspection.

Full explanation →

197

MCQmedium

A manager wants to set up a daily automated reminder email to employees who have not completed a mandatory training video in Microsoft Stream. The reminder should stop once the training is marked complete. Which Microsoft 365 tool should the manager use?

A.Power Automate

B.Microsoft Forms

C.SharePoint Designer

D.Viva Learning

AnswerA

Power Automate is the correct solution because it uses a recurrence trigger to start a cloud flow daily. That flow can query training completion status via Microsoft Graph or a SharePoint list, apply a conditional branch to filter only employees who haven't completed, and then send personalized reminder emails through Outlook. Crucially, you can add a 'terminate' or condition-based logic to stop the flow after all employees finish, and schedule maintenance is built into the platform's licensing.

Why this answer

Power Automate is the correct tool because it can create an automated workflow that queries Microsoft Stream (or a connected system like SharePoint or a custom list) for employees who have not completed the training, sends a daily reminder email, and stops when the training status changes to 'complete'. This leverages triggers like 'Recurrence' and conditions based on data from Stream or a related data source.

Exam trap

The trap here is that candidates often confuse Viva Learning (a learning portal) with an automation tool, assuming it can send reminders, but Viva Learning lacks workflow triggers and actions for automated email scheduling.

How to eliminate wrong answers

Option B is wrong because Microsoft Forms is a survey and data collection tool, not an automation engine; it cannot send automated reminders or check completion status. Option C is wrong because SharePoint Designer is a legacy tool for SharePoint 2010/2013 workflows, not designed for Microsoft 365 cloud automation or integration with Stream. Option D is wrong because Viva Learning is a learning management interface for accessing and assigning training content, but it lacks native workflow automation to send recurring reminders based on completion status.

Full explanation →

198

MCQmedium

During a Microsoft 365 planning workshop, host custom applications on virtual machines while managing the operating system. Cloud concept or benefit best matches this requirement?

A.Platform as a Service (PaaS)

B.Infrastructure as a Service (IaaS)

C.Hybrid cloud

D.Software as a Service (SaaS)

AnswerB

IaaS provides virtual machines, storage, and networking while customers manage the operating system and applications.

Why this answer

Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, including virtual machines where you can host custom applications and have full control over the operating system. This matches the requirement because IaaS gives you the flexibility to manage the OS, install custom software, and configure the environment without worrying about the underlying physical hardware.

Exam trap

The trap here is that candidates often confuse PaaS with IaaS because both involve hosting applications, but PaaS does not allow OS-level management, which is the key differentiator in this question.

How to eliminate wrong answers

Option A is wrong because Platform as a Service (PaaS) abstracts away the operating system and infrastructure management, focusing on deploying and managing applications without OS-level control, which contradicts the requirement to manage the operating system. Option C is wrong because Hybrid cloud is a deployment model that combines public and private clouds, not a service model that provides virtual machines with OS management capabilities. Option D is wrong because Software as a Service (SaaS) delivers fully managed applications accessed via a browser or client, with no access to the underlying OS or virtual machines.

Full explanation →

199

Multi-Selectmedium

Which three of the following are characteristics of Microsoft 365 subscription plans? (Choose three.)

Select 3 answers

.Subscription plans are available in monthly and annual commitment terms.

.All subscription plans include the full desktop version of Office applications.

.Plans can be upgraded or downgraded at any time without any restrictions.

.Business plans include Microsoft 365 Business Basic, Business Standard, and Business Premium.

.Enterprise plans are licensed on a per-user basis with a minimum of 5 seats.

.Add-on services, such as Microsoft 365 Copilot, can be purchased to supplement existing plans.

Why this answer

Microsoft 365 subscription plans offer monthly and annual commitment terms, giving customers flexibility in billing. Business plans are specifically categorized as Business Basic, Business Standard, and Business Premium, each with different feature sets. Add-on services like Microsoft 365 Copilot can be purchased to enhance existing subscriptions, allowing organizations to scale capabilities without changing their base plan.

Exam trap

The trap here is that candidates assume all subscription plans include full desktop Office apps, but Microsoft deliberately excludes them from lower-tier plans (e.g., Business Basic) to drive upsell to higher SKUs.

Full explanation →

200

MCQhard

A company with 100 Microsoft 365 Business Premium users needs to add advanced compliance features: eDiscovery (Premium) and Communication Compliance. They want to keep their existing Business Premium subscriptions to retain current capabilities. What is the most cost-effective licensing approach?

A.Upgrade all 100 users from Business Premium to Microsoft 365 E5

B.Purchase Microsoft 365 E5 Compliance add-on for all 100 users

C.Purchase Microsoft 365 E5 eDiscovery and Audit add-on

D.Purchase Microsoft 365 E5 Compliance and Information Protection add-on

AnswerB

Microsoft 365 E5 Compliance is an officially supported add-on that can be purchased on top of Microsoft 365 Business Premium to close specific compliance gaps. It provides eDiscovery (Premium), Communication Compliance, and other advanced compliance tools without requiring users to change their base license. This is the most cost-effective option because only the missing functionality is added, and assigning it to all 100 users exactly matches the stated business need.

Why this answer

Microsoft 365 Business Premium already includes the base compliance features, and the Microsoft 365 E5 Compliance add-on provides the advanced capabilities (eDiscovery Premium and Communication Compliance) without requiring a full license upgrade. This add-on is the most cost-effective approach as it adds only the needed compliance features to existing Business Premium subscriptions.

Exam trap

The trap here is that candidates often assume they must upgrade to a full E5 license to get advanced compliance features, overlooking the existence of targeted add-ons like Microsoft 365 E5 Compliance that can be layered onto existing Business Premium subscriptions.

How to eliminate wrong answers

Option A is wrong because upgrading all 100 users from Business Premium to Microsoft 365 E5 is significantly more expensive than adding the E5 Compliance add-on, and it provides many extra features (e.g., advanced analytics, advanced threat protection) that are not required, making it not cost-effective. Option C is wrong because there is no standalone 'Microsoft 365 E5 eDiscovery and Audit add-on'; eDiscovery (Premium) and Communication Compliance are part of the Microsoft 365 E5 Compliance suite, not a separate eDiscovery-only add-on. Option D is wrong because 'Microsoft 365 E5 Compliance and Information Protection add-on' is not a valid SKU name; the correct add-on is simply 'Microsoft 365 E5 Compliance', which includes both eDiscovery Premium and Communication Compliance, and the mention of 'Information Protection' is redundant or misleading.

Full explanation →

201

MCQmedium

A non-profit organization with 100 users needs business-grade email, desktop versions of Office apps (Word, Excel, PowerPoint), and 1 TB of cloud storage per user. They are eligible for non-profit pricing. Which Microsoft 365 plan meets these requirements at the lowest cost?

A.Microsoft 365 Business Basic (Nonprofit)

B.Microsoft 365 Business Standard (Nonprofit)

C.Microsoft 365 Business Premium (Nonprofit)

D.Microsoft 365 E3 (Nonprofit)

AnswerB

This subscription includes the full desktop Office suite, business-grade email with a 50 GB mailbox, 1 TB of OneDrive storage per user, and Teams, all at the discounted nonprofit pricing. For an organization with 100 users that simply needs reliable business productivity tools, this plan delivers the necessary installed applications and collaboration capabilities without paying for advanced security or compliance extras. It aligns directly with the core requirement and is the most cost-effective eligible option.

Why this answer

Microsoft 365 Business Standard (Nonprofit) is the lowest-cost plan that includes business-grade email (Exchange Online), desktop versions of Office apps (Word, Excel, PowerPoint), and 1 TB of cloud storage per user (OneDrive for Business). Microsoft 365 Business Basic (Nonprofit) lacks the desktop Office apps, while Business Premium and E3 include additional security and compliance features that increase cost beyond the stated requirements.

Exam trap

The trap here is that candidates often confuse 'Business Basic' as sufficient because it includes email and cloud storage, forgetting that desktop Office apps are a separate, higher-tier requirement, or they over-select 'Business Premium' or 'E3' thinking more features are always better for nonprofits.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 Business Basic (Nonprofit) provides only web and mobile versions of Office apps, not the full desktop versions required by the question. Option C is wrong because Microsoft 365 Business Premium (Nonprofit) includes all the required features but adds advanced security and device management capabilities (e.g., Microsoft Defender for Business, Intune) that raise the cost unnecessarily. Option D is wrong because Microsoft 365 E3 (Nonprofit) is an enterprise-grade plan with additional compliance, analytics, and advanced security features (e.g., eDiscovery, Advanced Audit) that far exceed the stated needs and come at a higher price point.

Full explanation →

202

MCQeasy

A company wants to move its IT infrastructure to the cloud but must keep all customer data within a specific geographic region due to data residency laws. They also want to avoid paying for large upfront hardware costs. Which cloud characteristic best supports this need?

A.Geographic distribution (regional data centers)

B.Elasticity

C.High availability

D.Self-service

AnswerA

Cloud providers maintain physically distinct regional data centers that let customers designate a specific location for data at rest, such as an Azure region in the same country or border. This is the only attribute that directly addresses data residency and sovereignty requirements, because workload placement is tied to the chosen region's legal and regulatory jurisdiction. Scaling, availability, and self-service mechanics do not have any intrinsic capability to constrain where data is stored.

Why this answer

Geographic distribution refers to cloud providers operating multiple data centers across different regions, enabling customers to choose a specific region to store data and comply with data residency laws. This characteristic directly addresses the requirement to keep customer data within a specific geographic region while avoiding upfront hardware costs, as the cloud provider owns and manages the infrastructure.

Exam trap

The trap here is that candidates often confuse geographic distribution with high availability or elasticity, mistakenly thinking that scaling or redundancy can satisfy data residency requirements, when only region-specific data centers can enforce legal data boundaries.

How to eliminate wrong answers

Option B (Elasticity) is wrong because elasticity refers to the ability to automatically scale resources up or down based on demand, not to the geographic placement of data. Option C (High availability) is wrong because high availability ensures that services remain operational despite failures through redundancy within or across data centers, but it does not guarantee data residency in a specific region. Option D (Self-service) is wrong because self-service allows users to provision resources on demand without manual intervention from the provider, but it has no relation to geographic data placement or compliance with data residency laws.

Full explanation →

203

MCQmedium

Your company is deploying Microsoft Purview to manage data subject requests (DSRs) under GDPR. Users need to submit requests to access or delete their personal data. Which Microsoft Purview solution should you use?

A.Microsoft Purview Data Subject Requests

B.Microsoft Purview Records Management

C.Microsoft Purview Audit (Premium)

D.Microsoft Purview Data Loss Prevention (DLP)

AnswerA

Microsoft Purview Data Subject Requests is the definitive solution for managing DSRs under GDPR, providing a centralized portal to profile personal data, find matches, and orchestrate the review and export of data. Unlike other Purview modules, it includes built-in workflows to handle subjects' rights to access, rectify, and erase personal data across Microsoft 365 services, and it generates auditable trails for compliance. This makes it the correct choice whenever the requirement is specifically about responding to DSRs.

Why this answer

Microsoft Purview Data Subject Requests is the dedicated solution for managing data subject requests (DSRs) under GDPR. It provides a centralized interface for users to submit requests to access or delete their personal data, and for administrators to track and fulfill those requests. The other options are incorrect: Records Management handles retention and disposition of records, Audit (Premium) provides logging and investigation capabilities, and Data Loss Prevention (DLP) protects against data leaks.

Therefore, option A is the correct answer.

Full explanation →

204

MCQmedium

A non-profit organization with 300 users needs to deploy Microsoft 365 Business Basic for all users. They also require device management via Microsoft Intune for 50 users who use company-owned mobile devices. The organization is eligible for non-profit pricing. What is the most cost-effective licensing approach?

A.Assign Microsoft 365 Business Premium to all 300 users

B.Purchase Microsoft Intune Plan 1 add-on licenses for the 50 users who need device management

C.Create a separate Microsoft 365 Business Basic tenant for the 50 users and include Intune

D.Purchase Microsoft 365 E3 licenses for the 50 users

AnswerB

Intune Plan 1 is available as a standalone per-user add-on that can be layered onto Microsoft 365 Business Basic, and licenses can be selectively assigned in the Microsoft 365 admin center to only the 50 users responsible for device management. Because the add-on is independent of the base subscription tier, you pay a low per-user price (about $8/user/month) for just those users, while the other 250 users remain on plain Business Basic. This delivers the required MDM/MAM capability at the absolute lowest licensing cost and avoids paying for extra suite features.

Why this answer

Microsoft 365 Business Basic provides the core productivity and collaboration tools (Exchange Online, Teams, SharePoint) needed by all 300 users. For the 50 users requiring device management, purchasing Microsoft Intune Plan 1 as an add-on license is the most cost-effective approach because it adds mobile device management (MDM) capabilities to their existing Business Basic subscription without upgrading the entire tenant or purchasing more expensive suites. Non-profit pricing applies to both the base license and the add-on, minimizing costs.

Exam trap

The trap here is that candidates often assume device management requires an entire suite upgrade (e.g., Business Premium or E3) rather than recognizing that Intune Plan 1 can be purchased as a cost-effective standalone add-on for specific users, leveraging the existing base license.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 Business Premium includes advanced security and device management features (e.g., Intune, Azure AD P1, Microsoft Defender for Office 365) that are not needed for all 300 users, resulting in unnecessary cost for the 250 users who only require basic productivity tools. Option C is wrong because creating a separate tenant for 50 users introduces administrative overhead, breaks single-tenant management, and prevents unified collaboration (e.g., cross-tenant sharing complexities), while still requiring Intune licenses for those 50 users. Option D is wrong because Microsoft 365 E3 licenses are significantly more expensive than Business Basic plus Intune Plan 1 add-on, and they include many enterprise features (e.g., eDiscovery, advanced compliance) that are not required for device management alone.

Full explanation →

205

MCQmedium

A help desk lead is documenting the correct Microsoft 365 approach to preserve relevant mailboxes and SharePoint content during a legal case. Microsoft security, identity, or compliance capability should it use?

A.Microsoft Stream

B.Microsoft Forms

C.Microsoft Planner

D.Microsoft Purview eDiscovery hold

AnswerD

eDiscovery holds preserve relevant content for legal investigations.

Why this answer

Microsoft Purview eDiscovery hold is the correct capability because it allows organizations to place legal holds on mailboxes, SharePoint sites, and other content sources to preserve data relevant to a legal case. This ensures that content cannot be altered or deleted until the hold is released, meeting compliance and eDiscovery requirements.

Exam trap

The trap here is that candidates may confuse general productivity tools like Stream, Forms, or Planner with compliance capabilities, mistakenly thinking they can be used for legal preservation when they lack the necessary retention and hold features.

How to eliminate wrong answers

Option A is wrong because Microsoft Stream is a video hosting and sharing service, not designed for legal hold or content preservation. Option B is wrong because Microsoft Forms is used for creating surveys and quizzes, with no capability to place holds on mailboxes or SharePoint content. Option C is wrong because Microsoft Planner is a task management tool for organizing work, lacking any compliance or eDiscovery hold functionality.

Full explanation →

206

MCQhard

During requirements gathering, an IT manager says the organization must compare service models and identify where the customer manages the most layers. Cloud concept or benefit best matches this requirement?

A.Platform as a Service (PaaS)

B.Software as a Service (SaaS)

C.Infrastructure as a Service (IaaS)

D.Hybrid cloud

AnswerC

Customers generally manage more layers in IaaS than in PaaS or SaaS.

Why this answer

The IT manager's requirement is to identify the service model where the customer manages the most layers. In Infrastructure as a Service (IaaS), the cloud provider manages only the physical infrastructure (servers, storage, networking), while the customer is responsible for managing the operating system, middleware, runtime, data, and applications. This gives the customer the highest degree of control and management responsibility compared to PaaS or SaaS.

Exam trap

The trap here is that candidates often confuse 'most management' with 'most convenience,' incorrectly selecting PaaS or SaaS because they assume more provider management is the goal, whereas the question explicitly asks for the model where the customer manages the most layers.

How to eliminate wrong answers

Option A is wrong because Platform as a Service (PaaS) offloads management of the operating system, middleware, and runtime to the provider, leaving the customer to manage only applications and data — fewer layers than IaaS. Option B is wrong because Software as a Service (SaaS) shifts nearly all management to the provider, with the customer typically only managing user access and data — the fewest layers of any cloud service model. Option D is wrong because hybrid cloud is a deployment model (combining public and private cloud), not a service model, and does not define which layers the customer manages; it is irrelevant to the specific requirement of comparing service models by management responsibility.

Full explanation →

207

Drag & Dropmedium

Drag and drop the steps to reset a user's password in Microsoft 365 admin center into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order to reset a user's password in Microsoft 365 admin center is to first navigate to Users > Active users, then select the user, click Reset password, and finally enter and confirm the new password. This sequence ensures the proper workflow for password management.

Full explanation →

208

MCQmedium

A company currently has Microsoft 365 E5 licenses for all users. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a potential security incident. Which of the following capabilities is already included in their existing license?

A.Microsoft Defender for Microsoft 365 Plan 1

B.Microsoft Entra ID Premium P1

C.Microsoft 365 Defender (including advanced hunting)

D.Microsoft Cloud App Security

AnswerC

Microsoft 365 Defender (including advanced hunting) is the correct choice because E5 includes the full unified security operations experience, enabling investigators to use KQL to query over email, endpoints, identities, and applications in one portal. Advanced hunting allows proactive, multi-domain searches for indicators of compromise, exactly what is needed when hunting for a cross-domain attack. This capability is exclusive to the combined Microsoft 365 Defender product, not to individual add-ons.

Why this answer

Microsoft 365 Defender (formerly Microsoft Threat Protection) includes advanced hunting capabilities that allow security teams to run Kusto Query Language (KQL) queries across email, endpoints, identities, and cloud apps. Since the company already has Microsoft 365 E5 licenses, this capability is included without any additional purchase.

Exam trap

The trap here is that candidates often confuse Microsoft 365 Defender (the unified security suite) with its individual component plans (e.g., Defender for Office 365 Plan 1 or Plan 2), not realizing that advanced hunting is a feature of the full Microsoft 365 Defender included in E5, not a separate add-on.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Microsoft 365 Plan 1 is a subset of the full Microsoft 365 Defender and does not include advanced hunting; advanced hunting is only available in Plan 2 or the full Microsoft 365 Defender included in E5. Option B is wrong because Microsoft Entra ID Premium P1 provides identity and access management features like Conditional Access but does not include advanced threat hunting across email, endpoints, and identities. Option D is wrong because Microsoft Cloud App Security (now part of Microsoft Defender for Cloud Apps) provides cloud app discovery and data protection but does not include the unified advanced hunting query capability across email and endpoints that Microsoft 365 Defender provides.

Full explanation →

209

Multi-Selectmedium

Which THREE Microsoft 365 apps are included in Microsoft 365 Business Basic?

Select 3 answers

A.Microsoft Excel (desktop)

B.Microsoft Teams

C.Microsoft Visio

D.Microsoft SharePoint

E.Microsoft Word (web)

AnswersB, D, E

Teams is included in Business Basic.

Why this answer

Microsoft 365 Business Basic is a cloud-only subscription that includes web and mobile versions of Office apps, not desktop clients. Microsoft Teams is included as the core collaboration hub, providing chat, video conferencing, and file sharing. SharePoint is also included for document management and intranet sites, and Word (web) is available as a browser-based word processor.

Exam trap

The trap here is that candidates often assume 'Business Basic' includes desktop Office apps because they conflate it with 'Business Standard' or 'Business Premium,' but Microsoft explicitly reserves desktop clients for higher-tier subscriptions.

Full explanation →

210

Multi-Selectmedium

A project team needs to collaborate on personal work files that follow a user across devices and co-author related Office files. Which two Microsoft 365 capabilities are most relevant?

Select 2 answers

A.Microsoft Purview eDiscovery case

B.OneDrive for Business

C.SharePoint Online document storage

D.Exchange anti-malware policy

AnswersB, C

OneDrive is intended for individual file storage and sync.

Why this answer

OneDrive for Business is designed for personal work files that follow a user across devices, providing sync capabilities and per-user storage. It also supports real-time co-authoring of Office files (e.g., Word, Excel, PowerPoint) when files are stored in OneDrive and shared with collaborators, making it the primary solution for user-centric file collaboration.

Exam trap

The trap here is that candidates may confuse SharePoint Online document storage as only for team sites, but it is also the underlying storage for OneDrive for Business, making both B and C correct for personal files that follow a user and co-authoring, as OneDrive provides the user-specific sync and SharePoint provides the backend storage and sharing infrastructure.

Full explanation →

211

MCQeasy

A company runs its customer relationship management (CRM) system using a cloud provider's SaaS offering. They also use virtual machines (IaaS) from the same provider to host a legacy application. In this scenario, who is responsible for patching the operating system of the virtual machines?

A.The cloud provider is fully responsible for patching all components.

B.The customer is responsible for patching the operating system of the virtual machines.

C.The cloud provider patches the OS for all services equally.

D.No patching is needed because the cloud handles everything.

AnswerB

This is the correct statement for an IaaS virtual machine. Because the customer provisions and controls the VM, they are accountable for the guest operating system and must apply patches, including critical security updates, to that OS. The provider manages the underlying physical hosts and the hypervisor, but does not access or modify the guest OS unless the customer explicitly enables a management or patching service. Therefore, the customer must have an ongoing patching process for the VM's operating system to maintain security and compliance.

Why this answer

In an IaaS model, the cloud provider is responsible for the security of the physical infrastructure, hypervisor, and network, but the customer retains responsibility for the guest operating system and applications. Since the virtual machines are IaaS resources, the customer must manage OS patches, updates, and configuration. This follows the shared responsibility model, where the customer is accountable for anything they configure or deploy within the virtual machine.

Exam trap

The trap here is that candidates confuse the IaaS model with SaaS, assuming the cloud provider patches everything, but Microsoft explicitly tests the shared responsibility model where the customer patches the OS in IaaS.

How to eliminate wrong answers

Option A is wrong because the cloud provider is not fully responsible for patching all components; in IaaS, the customer patches the OS and applications. Option C is wrong because the cloud provider does not patch the OS for all services equally; for SaaS, the provider patches the OS, but for IaaS, the customer does. Option D is wrong because patching is absolutely needed; the cloud does not handle OS-level patching for IaaS resources, and unpatched systems are vulnerable to exploits.

Full explanation →

212

MCQmedium

During a Microsoft 365 planning workshop, view service health and create support requests without broad user management. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Stream

B.Microsoft Forms

C.Microsoft Whiteboard

D.Service Support Administrator

AnswerD

Service Support Administrator can manage support-related tasks.

Why this answer

The Service Support Administrator role in Microsoft 365 is specifically designed to allow users to view service health and create support requests without granting broader user management permissions. This role is part of the least-privilege administrative model, enabling helpdesk or support staff to monitor service incidents and open tickets via the Microsoft 365 admin center or the Microsoft 365 admin mobile app, while being restricted from modifying users, licenses, or other administrative settings.

Exam trap

The trap here is that candidates often confuse the Service Support Administrator role with the Helpdesk Administrator role, which also can create support requests but additionally has broader user management capabilities (e.g., resetting passwords), leading to an incorrect choice if they don't carefully read the requirement for 'without broad user management.'

How to eliminate wrong answers

Option A is wrong because Microsoft Stream is a video service for uploading, sharing, and managing enterprise videos; it does not provide any administrative capabilities for viewing service health or creating support requests. Option B is wrong because Microsoft Forms is a survey and quiz creation tool; it has no role in service health monitoring or support ticket management. Option C is wrong because Microsoft Whiteboard is a digital canvas for collaboration; it lacks any administrative or support functionality related to service health or support requests.

Full explanation →

213

MCQeasy

A compliance officer needs to automatically retain all emails in Exchange Online for exactly 7 years, and then permanently delete them. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP) policy

B.Retention policy

C.Sensitivity label

D.eDiscovery case

AnswerB

Retention policies in Microsoft Purview are the correct answer because they are purpose-built to automatically retain content for a specified duration and then optionally delete it, directly satisfying the compliance officer's need. You can apply a retention policy to Exchange mailboxes, and it works at the item level, ensuring every email is retained for the configured period. These policies support both adaptive and static scopes and can be set to keep items indefinitely or for a specific number of days, making them ideal for regulatory compliance.

Why this answer

A retention policy in Microsoft Purview is designed to retain data for a specified period and then automatically delete it. By configuring a retention policy with a retention period of 7 years and an action to permanently delete the content at the end of that period, the compliance officer can meet the requirement for Exchange Online emails. This policy applies at the mailbox level and ensures that all emails are retained for exactly 7 years before being irreversibly removed.

Exam trap

The trap here is that candidates often confuse retention policies (which automate lifecycle management) with DLP policies (which prevent data leaks) or sensitivity labels (which classify data), leading them to select an option that addresses a different compliance goal.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy is used to detect and prevent the sharing of sensitive information (e.g., credit card numbers) via rules and actions like blocking or warning, not to enforce time-based retention and deletion. Option C is wrong because a sensitivity label is used to classify and protect data based on sensitivity (e.g., encryption, visual markings), and while it can be part of a retention label, it does not independently enforce a fixed retention and deletion schedule without being published as a retention label policy. Option D is wrong because an eDiscovery case is used for legal holds and content searches for litigation or investigation purposes, not for automated, scheduled retention and deletion of all emails.

Full explanation →

214

Multi-Selectmedium

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

Select 2 answers

A.Threat Explorer in Microsoft Defender for Office 365

B.It replaces the need for identity and access management

C.It requires every document to be made public

D.The policy should be tested with a limited group before broad rollout

AnswersA, D

Threat Explorer supports investigation of email threats, campaigns, and delivery actions.

Why this answer

Threat Explorer in Microsoft Defender for Office 365 is a powerful tool for investigating phishing campaigns. It allows security analysts to view and filter email threat data, including malware, phishing, and spam, in near real-time. This enables the organization to identify, analyze, and remediate malicious emails that are part of a phishing campaign, making option A correct.

Exam trap

The trap here is that candidates may confuse Threat Explorer with a general security solution that replaces IAM, or assume it requires public document access, when in fact it is a specialized email threat investigation tool that operates within the existing security boundaries.

Full explanation →

215

MCQhard

A compliance officer needs to ensure that all outgoing emails containing a customer's credit card number are automatically encrypted before delivery. External recipients must be able to reply with the same level of encryption without a separate signing-up process. Which Microsoft Purview solution should be configured?

A.Office 365 Message Encryption (OME) with a DLP policy

B.Sensitivity labels with automatic marking

C.Azure Information Protection (AIP)

D.Microsoft Defender for Office 365

AnswerA

Office 365 Message Encryption (OME) integrated with a Data Loss Prevention (DLP) policy is the standard mechanism for automatically encrypting outgoing emails that contain sensitive data such as credit card numbers. The DLP policy scans outbound messages for specific sensitive info types and, when matched, conditionally modifies the message to apply OME encryption via Azure Rights Management. OME ensures external recipients receive an encrypted email and can authenticate via a secure web portal to read and reply, maintaining end-to-end confidentiality without requiring the recipient to have an M365 license.

Why this answer

Office 365 Message Encryption (OME) with a Data Loss Prevention (DLP) policy is the correct solution because OME provides automatic encryption for emails based on sensitive information types (e.g., credit card numbers) detected by DLP rules. It also supports the 'encrypt-only' option, which allows external recipients to reply with the same level of encryption without requiring a separate sign-up or certificate exchange, leveraging the Microsoft 365 message encryption infrastructure.

Exam trap

The trap here is that candidates often confuse sensitivity labels (Option B) with DLP-based encryption, not realizing that sensitivity labels require explicit configuration for automatic encryption and do not inherently handle reply encryption without additional setup, whereas OME with DLP provides the seamless, policy-driven encryption and reply capability described.

How to eliminate wrong answers

Option B is wrong because sensitivity labels with automatic marking can apply visual markings or encryption, but they do not natively trigger encryption based on DLP-sensitive information types like credit card numbers; they require manual or policy-based labeling and do not inherently enable seamless encrypted replies without recipient sign-up. Option C is wrong because Azure Information Protection (AIP) is a classification and labeling solution that can apply encryption via rights management, but it is not primarily designed for automatic email encryption based on DLP policies and often requires the recipient to have an Azure RMS-enabled client or sign in for decryption. Option D is wrong because Microsoft Defender for Office 365 focuses on threat protection (e.g., anti-phishing, anti-malware, safe attachments) and does not provide automatic email encryption based on content inspection for compliance purposes.

Full explanation →

216

Drag & Dropmedium

Drag and drop the steps to deploy Microsoft 365 Apps for enterprise to a Windows device using the Microsoft 365 Apps admin center into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Deploying Office uses the admin center to create a config, then ODT to install based on that config.

Full explanation →

217

MCQmedium

A compliance officer needs to ensure that all emails and documents in Exchange Online and SharePoint are automatically retained for five years. After five years, the data should be automatically deleted. Which Microsoft Purview solution should they configure?

A.Retention policies

B.Data loss prevention (DLP) policies

C.Sensitivity labels

D.eDiscovery (Standard)

AnswerA

Retention policies in Microsoft Purview are lifecycle management rules applied to workloads such as Exchange email and SharePoint Online, enabling organizations to automatically keep content for a defined period (for example, seven years) and then trigger permanent deletion at the end of that schedule. They support adaptive and static scopes and can be complemented by retention labels for item-level control. This time-based retain-then-delete behavior directly satisfies the compliance officer's requirement.

Why this answer

Retention policies in Microsoft Purview are designed to automatically retain data for a specified period and then delete it, meeting the compliance officer's requirement for Exchange Online and SharePoint. This solution applies at the container level (e.g., mailboxes, sites) and can enforce a five-year retention followed by automatic deletion without user intervention.

Exam trap

The trap here is that candidates often confuse retention policies with DLP policies, mistakenly thinking DLP can enforce time-based retention and deletion, when DLP is solely focused on preventing data loss through content inspection and action rules.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) policies focus on preventing unauthorized sharing or leakage of sensitive data through rules and actions (e.g., blocking emails), not on automated retention and deletion schedules. Option C is wrong because Sensitivity labels classify and protect data with encryption or visual markings, but they do not inherently enforce time-based retention or deletion; they can be used with retention policies but are not the primary solution for automated lifecycle management. Option D is wrong because eDiscovery (Standard) is used for searching and exporting content for legal or investigative purposes, not for configuring automatic retention and deletion policies.

Full explanation →

Microsoft 365 Fundamentals MS-900 (MS-900) — Questions 151–217