Microsoft 365 Fundamentals MS-900 MS-900 Questions 301–375 | Page 5/14

301

MCQeasy

A user needs to access their work files from a personal device without storing a copy locally. Which Microsoft 365 app should they use?

A.Microsoft Outlook

B.OneDrive for Business

C.Microsoft Teams

D.Microsoft SharePoint

AnswerB

OneDrive for Business allows files on demand, streaming from the cloud.

Why this answer

OneDrive for Business enables users to access work files from any device via the cloud, with the option to stream files on demand without downloading them locally. This is achieved through Files On-Demand, which uses placeholder files and syncs only metadata, ensuring no full copy is stored on the personal device unless explicitly made available offline.

Exam trap

The trap here is that candidates may confuse SharePoint's web-based access with the ability to prevent local storage, overlooking that OneDrive for Business is the only option with a dedicated Files On-Demand feature that explicitly avoids storing a full copy locally on personal devices.

How to eliminate wrong answers

Option A is wrong because Microsoft Outlook is an email and calendar client, not designed for file storage or remote access without local copies; it downloads attachments locally by default. Option C is wrong because Microsoft Teams primarily focuses on chat, meetings, and collaboration, and while it can access files from SharePoint or OneDrive, it does not provide a dedicated mechanism to prevent local storage of files on personal devices. Option D is wrong because Microsoft SharePoint is a web-based document management and collaboration platform that can be accessed via browser, but it does not natively offer a Files On-Demand feature to prevent local caching; files opened from SharePoint in a browser may still be cached locally by the browser or Office apps.

Full explanation →

302

Multi-Selectmedium

Which TWO are key capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Select 2 answers

A.Email encryption and secure messaging

B.Device compliance policy enforcement

C.On-device malware scanning

D.Cloud Discovery to identify shadow IT

E.Session control to monitor and control app access in real-time

AnswersD, E

Cloud Discovery identifies apps and users in your environment.

Why this answer

Defender for Cloud Apps provides Cloud Discovery (A) to identify cloud apps in use, and session control (B) to monitor and control app sessions. Option C (malware scanning) is for Defender for Endpoint. Option D (device compliance) is for Intune.

Option E (email encryption) is for Office 365.

Full explanation →

303

MCQeasy

A team needs to create a shared online document and collaborate in real time with colleagues. They require built-in version history and the ability to access the document from any device. Which Microsoft 365 app should they use?

A.Microsoft Word (desktop)

B.Microsoft Word Online

C.Microsoft OneNote

D.Microsoft Teams

AnswerB

Correct. Word Online runs in a browser, supports real-time co-authoring, automatic version history, and is accessible from any device with internet.

Why this answer

Microsoft Word Online is the correct choice because it is a browser-based version of Word that enables real-time co-authoring, automatic version history, and access from any device with an internet connection. Unlike the desktop app, it does not require installation and syncs changes instantly via OneDrive or SharePoint, meeting all stated requirements.

Exam trap

The trap here is that candidates often confuse Microsoft Teams as the app for document collaboration, but Teams itself is a hub for communication and relies on integrated Office Online apps for actual document editing, making Word Online the direct answer for the specific requirements of shared document creation and real-time collaboration.

How to eliminate wrong answers

Option A is wrong because Microsoft Word (desktop) requires installation on a specific device, lacks built-in real-time co-authoring without additional configuration (e.g., saving to OneDrive with AutoSave enabled), and does not inherently provide cross-device access without manual file transfer. Option C is wrong because Microsoft OneNote is a digital notebook app designed for free-form note-taking and organization, not for creating structured shared documents with the same real-time collaboration and version history features as Word Online. Option D is wrong because Microsoft Teams is a collaboration platform for chat, meetings, and channel-based file sharing, but its document editing capabilities rely on integrated Office Online apps (like Word Online) rather than providing a standalone document creation and editing experience.

Full explanation →

304

MCQmedium

A compliance-aware administrator is selecting the right Microsoft 365 capability to desktop Office apps plus business email and collaboration services without advanced security management. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Stream

B.Microsoft Forms

C.Microsoft 365 Business Standard

D.Microsoft Whiteboard

AnswerC

Business Standard includes desktop Office apps and core business services.

Why this answer

Microsoft 365 Business Standard is the correct choice because it includes desktop versions of Office apps (Word, Excel, PowerPoint, Outlook) plus business-class email (Exchange Online) and collaboration services (Teams, SharePoint, OneDrive) without advanced security features like Microsoft Defender for Office 365 or Azure Information Protection. This plan is designed for organizations needing core productivity and communication tools but not the higher-tier security management found in Business Premium or Enterprise plans.

Exam trap

The trap here is that candidates may confuse individual Microsoft services (like Stream, Forms, or Whiteboard) with the comprehensive licensing plans that bundle multiple services, leading them to select a standalone tool instead of the correct subscription plan.

How to eliminate wrong answers

Option A is wrong because Microsoft Stream is a video hosting and sharing service, not a licensing plan that bundles desktop Office apps, email, and collaboration services. Option B is wrong because Microsoft Forms is a survey and quiz creation tool, not a subscription that provides the core productivity and communication suite described. Option D is wrong because Microsoft Whiteboard is a digital canvas for collaboration, not a licensing plan that includes desktop Office apps, business email, and collaboration services.

Full explanation →

305

MCQmedium

A tenant administrator is advising a department that wants to deploy application code without maintaining the operating system or runtime platform. Cloud concept or benefit best matches this requirement?

A.Private cloud

B.Platform as a Service (PaaS)

C.Infrastructure as a Service (IaaS)

D.Software as a Service (SaaS)

AnswerB

PaaS lets developers focus on code while the provider manages the platform, runtime, and underlying infrastructure.

Why this answer

PaaS lets developers focus on code while the provider manages the platform, runtime, and underlying infrastructure.

Exam trap

Candidates might confuse PaaS with IaaS, forgetting that IaaS still requires the user to manage the operating system.

Full explanation →

306

Multi-Selecthard

Which THREE of the following are included in Microsoft Defender XDR? (Choose three.)

Select 3 answers

A.Microsoft Defender for Endpoint

B.Microsoft Purview

C.Microsoft Sentinel

D.Microsoft Defender for Office 365

E.Microsoft Defender for Identity

AnswersA, D, E

Part of Defender XDR.

Why this answer

Option A is correct because Microsoft Defender for Office 365 is part of Defender XDR. Option B is correct because Microsoft Defender for Endpoint is included. Option C is correct because Microsoft Defender for Identity is part of Defender XDR.

Option D is incorrect because Microsoft Sentinel is a separate SIEM. Option E is incorrect because Microsoft Purview is a compliance solution.

Full explanation →

307

MCQhard

A legal team needs to preserve all data belonging to a former employee who is involved in litigation. The preservation must cover Exchange Online email, SharePoint sites, Teams messages, and OneDrive files. Which Microsoft Purview solution should they use to enforce the preservation?

A.eDiscovery (Standard) case hold

B.Data Lifecycle Management retention policy

C.Sensitivity label with retention marking

D.Audit log search

AnswerA

eDiscovery (Standard) enables creating a case and placing a hold on custodians' mailboxes, SharePoint sites, OneDrive, and Teams, preserving all data for legal purposes.

Why this answer

eDiscovery (Standard) case hold is the correct solution because it allows legal teams to place a legal hold on all data sources associated with a specific user, including Exchange Online mailboxes, SharePoint sites, OneDrive accounts, and Teams messages. This preserves the data in its current state, preventing modification or deletion, which is essential for litigation. Unlike other options, eDiscovery holds are designed specifically for legal preservation scenarios and can target multiple workloads simultaneously.

Exam trap

The trap here is that candidates often confuse a retention policy (which is automated and rule-based) with a legal hold (which is manual, case-specific, and preserves data for litigation), leading them to choose Data Lifecycle Management instead of eDiscovery.

How to eliminate wrong answers

Option B is wrong because Data Lifecycle Management retention policies are designed for automated data retention and deletion based on regulatory or business rules, not for ad-hoc legal holds triggered by litigation. Option C is wrong because sensitivity labels with retention markings are used to classify and optionally retain data based on sensitivity, but they cannot enforce a comprehensive legal hold across all user data sources like eDiscovery can. Option D is wrong because Audit log search is a tool for reviewing historical activity logs, not for preserving data; it does not prevent data modification or deletion.

Full explanation →

308

MCQmedium

A school uses Microsoft 365 A3 for faculty and staff. They want to create a hub for teachers to share lesson plans, collaborate on documents, and communicate via instant messaging. They also need to integrate with third-party educational apps. Which Microsoft 365 service should they use as the primary platform?

A.Yammer

B.SharePoint Online

C.OneNote for Windows 10

D.Microsoft Teams

AnswerD

Teams integrates chat, files, and apps in a single hub.

Why this answer

Microsoft Teams is the correct primary platform because it integrates chat, document collaboration (via SharePoint and OneDrive), and third-party app connectors into a single hub. For teachers sharing lesson plans, collaborating on documents, and using instant messaging, Teams provides persistent chat, file sharing, and a rich app ecosystem that supports third-party educational app integration through tabs, connectors, and bots.

Exam trap

The trap here is that candidates often confuse Yammer's social networking features with Teams' real-time collaboration capabilities, or they assume SharePoint alone can fulfill all communication needs, missing the requirement for instant messaging and integrated third-party apps.

How to eliminate wrong answers

Option A is wrong because Yammer is an enterprise social network focused on broad organizational conversations and communities, not a real-time collaboration hub for instant messaging and document co-authoring. Option B is wrong because SharePoint Online is a document management and intranet platform; while it stores and shares files, it lacks native instant messaging and real-time chat capabilities. Option C is wrong because OneNote for Windows 10 is a digital note-taking app, not a platform for instant messaging, collaborative document editing, or third-party app integration.

Full explanation →

309

MCQmedium

During requirements gathering, an IT manager says the organization must view service health and create support requests without broad user management. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Stream

B.Microsoft Forms

C.Microsoft Whiteboard

D.Service Support Administrator

AnswerD

Service Support Administrator can manage support-related tasks.

Why this answer

The Service Support Administrator role in Microsoft 365 is specifically designed to allow users to view service health and create support requests without granting broader user management permissions. This aligns directly with the IT manager's requirement for limited administrative access focused on support functions, making it the most relevant concept among the options.

Exam trap

The trap here is that candidates may confuse the Service Support Administrator role with other Microsoft 365 services like Stream or Forms, which are unrelated to administrative support functions, or assume that any 'support' feature requires broad admin privileges.

How to eliminate wrong answers

Option A is wrong because Microsoft Stream is a video service for uploading, sharing, and managing videos, not an admin role or support concept for viewing service health or creating support tickets. Option B is wrong because Microsoft Forms is a survey and quiz creation tool, unrelated to administrative or support functions for service health monitoring. Option C is wrong because Microsoft Whiteboard is a collaborative digital canvas for brainstorming and visual work, not a licensing, admin, or support concept for service health or support requests.

Full explanation →

310

MCQhard

An organization uses Microsoft 365 Copilot for Microsoft 365. The security team wants to ensure that Copilot responses are based only on data that users already have permission to access. Which principle does this enforce?

A.Least privilege

B.Defense in depth

C.Privileged Identity Management

D.Zero Trust

AnswerA

Copilot respects existing permissions, enforcing least privilege.

Why this answer

The principle of least privilege ensures users only access data they need. In Copilot, responses are grounded in the user's existing permissions. Option C is correct.

Option A (Zero Trust) is broader, Option B (Defense in depth) is layered security, and Option D (Privileged Access) is for elevated roles.

Full explanation →

311

MCQeasy

A company needs to ensure that all email and document content is preserved for legal purposes, even if users permanently delete items. This requirement demands that content be kept indefinitely until the legal hold is released. Which Microsoft 365 feature should they enable?

A.Retention policy

B.Litigation hold

C.eDiscovery

D.Data Loss Prevention (DLP)

AnswerB

Litigation hold preserves all data indefinitely (or until the hold is removed) even if users delete items. It is the correct feature for legal preservation requirements.

Why this answer

Litigation hold is the correct feature because it preserves all mailbox and document content in its original state indefinitely until the hold is explicitly released. Unlike a retention policy, which can delete content after a specified period, Litigation hold ensures that even permanently deleted items are retained in the Recoverable Items folder, meeting the legal preservation requirement.

Exam trap

The trap here is that candidates often confuse a retention policy (which can preserve content but also delete it after a period) with Litigation hold, which is the only option that guarantees indefinite preservation regardless of user actions or time limits.

How to eliminate wrong answers

Option A is wrong because a retention policy can be configured to delete content after a set period, which conflicts with the requirement to keep content indefinitely; it also does not guarantee preservation against user deletion. Option C is wrong because eDiscovery is a search and export tool used to find content already preserved under holds or policies, not a mechanism to enforce preservation itself. Option D is wrong because Data Loss Prevention (DLP) is designed to prevent sensitive information from being shared or leaked, not to preserve content for legal purposes.

Full explanation →

312

MCQmedium

A service owner is comparing Microsoft 365 capabilities and needs to use a lightweight Kanban-style task board with assignments and due dates inside Teams. Microsoft 365 app or service is the best fit?

A.Microsoft Planner

B.Microsoft Purview Audit

D.Microsoft Forms

AnswerA

Planner provides task boards, assignments, due dates, and Teams integration.

Why this answer

Microsoft Planner is the correct choice because it provides a lightweight Kanban-style task board that integrates directly into Microsoft Teams via the Planner tab. It supports task assignments, due dates, and progress tracking, making it ideal for a service owner needing a simple visual task management tool within Teams.

Exam trap

The trap here is that candidates may confuse Microsoft Planner with Microsoft To Do, but To Do is a personal task list without Kanban boards or team collaboration features, while Planner is designed for team-based project management with visual boards.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Audit is a compliance and auditing service for tracking user and admin activities across Microsoft 365, not a task management tool with Kanban boards. Option D is wrong because Microsoft Forms is used for creating surveys, quizzes, and polls, not for managing tasks with assignments and due dates in a Kanban-style board.

Full explanation →

313

MCQmedium

Adventure Works is a non-profit with 200 users. They use Microsoft 365 for Nonprofits. They need to: (1) Restrict access to sensitive donor information to only specific users; (2) Automatically archive emails older than 5 years; (3) Allow volunteers to access shared files from their personal devices without enrolling them in device management; (4) Use AI to summarize long email threads and suggest replies. Which Microsoft 365 services or features should they use?

A.Sensitivity labels, Exchange Online archiving, SharePoint Online, Microsoft Copilot for Microsoft 365

B.Sensitivity labels, Exchange Online in-place hold, SharePoint Online, Microsoft Editor

C.Microsoft Purview Data Loss Prevention, Exchange Online archiving, Microsoft Teams, Microsoft Copilot for Microsoft 365

D.Azure Information Protection, Exchange Online retention policies, OneDrive, Microsoft Copilot for Microsoft 365

AnswerA

Correct: Sensitivity labels for access restriction, archiving for email retention, SharePoint for file sharing without device management, Copilot for AI assistance.

Why this answer

Microsoft Purview sensitivity labels can restrict access to sensitive data. Exchange Online archiving can archive emails older than 5 years. SharePoint Online allows external sharing with expiration and permissions, without device enrollment.

Microsoft Copilot for Microsoft 365 provides AI email summaries and suggested replies. Microsoft Intune requires device enrollment, which is not desired.

Full explanation →

314

Multi-Selecthard

Your company is adopting Microsoft 365 Copilot and wants to ensure that data security and compliance requirements are met. Which THREE considerations should be addressed? (Choose three.)

Select 3 answers

A.Configure policies in the Microsoft 365 admin center to manage Copilot features.

B.Disable Copilot for all users if any compliance requirement cannot be met.

C.Use sensitivity labels to control what data Copilot can access.

D.Verify that data processed by Copilot is stored in the same geographic region as the tenant.

E.Ensure that Microsoft 365 Copilot inherits the compliance settings from the underlying Microsoft 365 services.

AnswersA, C, E

Admins can enable/disable Copilot features for specific users or groups.

Why this answer

Options A, C, and D are correct. Copilot inherits compliance settings, respects sensitivity labels, and can be managed via policies. Reviewing data residency (B) is important for data storage, but Copilot processing follows existing data residency.

Disabling Copilot for compliance (E) is not a consideration but an extreme measure.

Full explanation →

315

Multi-Selecthard

Your organization is required to retain all customer emails for 7 years due to industry regulations. The legal team also needs to be able to search and hold relevant emails during active litigation. Which two Microsoft Purview features should you implement? (Choose two.)

Select 2 answers

A.Data Loss Prevention policy

B.Retention policy

C.Litigation hold

D.eDiscovery (Standard)

E.Sensitivity labels

AnswersB, C

Retention policies retain data for a specified period.

Why this answer

Retention policies (A) enforce the 7-year retention. Litigation hold (C) preserves emails for legal cases. Option B (eDiscovery) is for search and export, not hold.

Option D (DLP) prevents data leaks. Option E (MIP labels) classify data.

Full explanation →

316

MCQmedium

A compliance-aware administrator is selecting the right Microsoft 365 capability to guide assignment of Microsoft 365 admin roles. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Whiteboard

B.Microsoft Stream

C.Least privilege

D.Microsoft Forms

AnswerC

Least privilege means assigning only the permissions required for a task.

Why this answer

The principle of least privilege is the most relevant concept for guiding assignment of Microsoft 365 admin roles because it dictates that administrators should be granted only the permissions necessary to perform their job functions, minimizing security risks. This directly aligns with compliance requirements by ensuring that no user has excessive access to sensitive administrative functions. The other options (Whiteboard, Stream, Forms) are productivity or collaboration tools unrelated to role-based access control or compliance.

Exam trap

The trap here is that candidates may confuse productivity tools (like Whiteboard, Stream, or Forms) with governance concepts, failing to recognize that 'least privilege' is the only option directly tied to role assignment and compliance in Microsoft 365.

How to eliminate wrong answers

Option A is wrong because Microsoft Whiteboard is a digital canvas collaboration tool, not a concept for assigning admin roles or managing permissions. Option B is wrong because Microsoft Stream is a video service for recording and sharing content, unrelated to role-based access control or least privilege. Option D is wrong because Microsoft Forms is a survey and quiz creation tool, which has no bearing on admin role assignment or compliance-driven access management.

Full explanation →

317

MCQmedium

A product design team wants to conduct remote brainstorming sessions where participants can draw, write sticky notes, and add images on a shared canvas in real time. Which Microsoft 365 app should they use?

A.Microsoft To Do

B.Microsoft Whiteboard

C.Microsoft Forms

D.Microsoft Planner

AnswerB

Provides a flexible digital canvas for real-time collaborative drawing, sticky notes, and images.

Why this answer

Microsoft Whiteboard is the correct choice because it provides a free-form digital canvas that supports real-time collaboration, including drawing, sticky notes, and image insertion. This directly meets the requirement for remote brainstorming sessions where participants need to interact on a shared canvas simultaneously.

Exam trap

The trap here is that candidates may confuse Microsoft Planner's task boards with a collaborative canvas, but Planner is strictly for task tracking, not for free-form drawing or sticky note brainstorming.

How to eliminate wrong answers

Option A is wrong because Microsoft To Do is a task management app focused on personal to-do lists and reminders, not a collaborative canvas for drawing or sticky notes. Option C is wrong because Microsoft Forms is used for creating surveys, quizzes, and polls, not for real-time visual collaboration or drawing. Option D is wrong because Microsoft Planner is a project management tool for organizing tasks and plans with boards, not a shared canvas for brainstorming activities.

Full explanation →

318

MCQeasy

Refer to the exhibit. The ARM template is used to deploy an Azure resource. Which Microsoft 365 service is most likely to use this template for storing data?

A.Microsoft Teams

B.Exchange Online

C.SharePoint Online

D.OneDrive for Business

AnswerC

SharePoint Online uses Azure Storage for its content databases.

Why this answer

The ARM template in the exhibit deploys an Azure resource, and SharePoint Online is the Microsoft 365 service that most commonly uses Azure Resource Manager (ARM) templates for provisioning and managing its storage infrastructure, such as Azure SQL Database or Azure Storage accounts that back SharePoint's content databases. SharePoint Online relies on Azure services for scalable storage, and ARM templates are the standard deployment mechanism for these underlying Azure resources.

Exam trap

The trap here is that candidates may assume OneDrive for Business is the correct answer because it is a personal storage service, but they overlook that SharePoint Online is the underlying platform that provisions the Azure storage resources via ARM templates, making it the most likely service to use such templates for data storage.

How to eliminate wrong answers

Option A is wrong because Microsoft Teams uses Azure services for chat, meetings, and media, but its primary data storage is in Exchange Online for chat history and SharePoint Online for files, not directly via ARM templates for its own service. Option B is wrong because Exchange Online stores mailbox data in its own proprietary databases and uses Azure for some infrastructure, but ARM templates are not the typical method for deploying Exchange Online storage resources; Exchange Online is managed through Microsoft's own provisioning systems. Option D is wrong because OneDrive for Business is built on SharePoint Online's storage infrastructure, so while it uses the same underlying Azure storage, the ARM template is more directly associated with SharePoint Online as the service that provisions and manages the storage layer.

Full explanation →

319

Multi-Selecteasy

A company uses Microsoft 365 Business Premium. They want to deploy a cloud-based phone system for their employees. Which TWO services should they use?

Select 2 answers

A.Teams Audio Conferencing

B.Direct Routing

C.Calling Plan

D.Microsoft Bookings

E.Microsoft Teams Phone System

AnswersC, E

Correct. Calling Plans provide PSTN minutes and phone numbers.

Why this answer

Microsoft Teams Phone System (formerly Cloud PBX) provides the core PBX functionality—call control, voicemail, and auto attendants—while a Calling Plan (Microsoft's first-party PSTN connectivity) supplies the phone numbers and minutes to make/receive external calls. Together they form a complete cloud phone system without any on-premises infrastructure.

Exam trap

The trap here is that candidates confuse Teams Audio Conferencing (meeting dial-in) with the phone system, or think Direct Routing is a cloud-only option when it actually requires on-premises hardware.

Full explanation →

320

MCQmedium

A help desk lead is documenting the correct Microsoft 365 approach to allow browser access to SharePoint from unmanaged devices but restrict downloads. Microsoft security, identity, or compliance capability should it use?

A.Conditional Access access/session controls

B.Microsoft Forms

C.Microsoft Stream

D.Microsoft Planner

AnswerA

Conditional Access can apply access or session controls based on device state.

Why this answer

Conditional Access access/session controls allow administrators to enforce granular restrictions on browser access to SharePoint from unmanaged devices, such as blocking download of sensitive content while still permitting view-only access. This is achieved through session policies that integrate with Microsoft Defender for Cloud Apps (formerly Cloud App Security) to apply real-time controls at the protocol level, without requiring device enrollment or compliance.

Exam trap

The trap here is that candidates often confuse Conditional Access with device compliance policies or Intune, but session controls are specifically designed for unmanaged devices where you cannot enforce device-level restrictions, and they operate at the application layer rather than requiring device enrollment.

How to eliminate wrong answers

Option B (Microsoft Forms) is wrong because it is a survey and data collection tool, not a security or access control mechanism for SharePoint. Option C (Microsoft Stream) is wrong because it is a video hosting and sharing service, unrelated to managing device access or download restrictions for SharePoint. Option D (Microsoft Planner) is wrong because it is a task management and planning tool, lacking any capability to enforce conditional access or session-level policies.

Full explanation →

321

MCQmedium

A cloud provider serves thousands of customers using the same physical hardware. Each customer's data and applications are isolated from one another through virtualization. The provider can dynamically allocate resources to customers based on demand. Which cloud characteristic does this describe?

A.Resource pooling

B.On-demand self-service

C.Rapid elasticity

D.Measured service

AnswerA

Correct. Resource pooling allows the provider to aggregate physical resources and serve multiple tenants (multi-tenancy).

Why this answer

This scenario describes resource pooling, where the cloud provider's computing resources (e.g., storage, processing, memory, network bandwidth) are pooled to serve multiple customers using a multi-tenant model. Virtualization isolates each customer's data and applications, while physical and virtual resources are dynamically assigned and reassigned according to consumer demand. This is a core characteristic of cloud computing as defined by NIST SP 800-145.

Exam trap

The trap here is that candidates often confuse 'resource pooling' with 'rapid elasticity' because both involve dynamic allocation, but resource pooling is about the multi-tenant sharing of physical infrastructure, while elasticity is about the speed and automation of scaling resources up or down.

How to eliminate wrong answers

Option B (On-demand self-service) is wrong because that characteristic describes a user's ability to provision computing capabilities automatically without requiring human interaction with the service provider, not the sharing of physical hardware. Option C (Rapid elasticity) is wrong because elasticity refers to the ability to scale resources up or down quickly and automatically in response to demand, not the underlying pooling of resources across tenants. Option D (Measured service) is wrong because measured service involves metering and monitoring resource usage for billing and optimization, not the isolation and dynamic allocation of shared physical hardware.

Full explanation →

322

MCQmedium

While preparing a Microsoft 365 adoption plan, a consultant is asked to use provider-managed infrastructure shared by multiple customers. Cloud concept or benefit best matches this requirement?

A.Public cloud

B.Data Loss Prevention (DLP)

C.Sensitivity labels

D.Microsoft Planner

AnswerA

Public cloud services run on provider-managed shared infrastructure with logical separation between customers.

Why this answer

The requirement for provider-managed infrastructure shared by multiple customers directly maps to the public cloud deployment model. In a public cloud, the cloud provider owns and manages the physical hardware, software, and supporting infrastructure, which is shared across multiple tenants (multi-tenancy). This is the core definition of public cloud as opposed to private or hybrid models.

Exam trap

The trap here is that candidates may confuse a specific Microsoft 365 feature (like DLP or sensitivity labels) with a cloud deployment model, failing to recognize that the question is asking about the fundamental cloud concept of shared, provider-managed infrastructure, not a security or productivity tool.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) is a security policy feature within Microsoft 365 that helps prevent sensitive information from being shared or leaked; it does not describe a cloud deployment model or infrastructure sharing concept. Option C is wrong because sensitivity labels are classification and protection tools applied to documents and emails to enforce access controls and encryption; they are not a cloud concept related to shared infrastructure. Option D is wrong because Microsoft Planner is a task management and collaboration application within Microsoft 365; it is a specific service, not a cloud concept or benefit describing how infrastructure is deployed or shared.

Full explanation →

323

MCQhard

A global organization with 20,000 users is migrating from on-premises Exchange to Exchange Online. They have a mix of Microsoft 365 E3 and E5 licenses. The compliance team requires that all mailboxes be placed on litigation hold within 24 hours of the migration. Which licensing consideration is critical?

A.All users must have Microsoft 365 E5 licenses to use litigation hold

B.Downgrade E5 users to E3 to simplify licensing

C.Litigation hold is automatically enabled for all mailboxes in Exchange Online

D.Users with E3 licenses need an Exchange Online Plan 2 add-on for litigation hold

AnswerD

Exchange Online Plan 2 is required for litigation hold and can be added to E3.

Why this answer

Litigation hold in Exchange Online requires an Exchange Online Plan 2 license or an Exchange Online Plan 1 license with the Exchange Online Archiving add-on. Microsoft 365 E3 includes Exchange Online Plan 1, which does not support litigation hold by itself. Therefore, users with E3 licenses need the Exchange Online Plan 2 add-on (or the equivalent Archiving add-on) to enable litigation hold.

E5 licenses include Exchange Online Plan 2, so those users already have the necessary licensing.

Exam trap

The trap here is that candidates often assume litigation hold is a standard feature available with any Exchange Online license, but Microsoft specifically requires Exchange Online Plan 2 (included in E5 or as an add-on to E3) for this capability.

How to eliminate wrong answers

Option A is wrong because Microsoft 365 E5 licenses include Exchange Online Plan 2, which supports litigation hold, but E3 users can also get litigation hold via an add-on; E5 is not mandatory for all users. Option B is wrong because downgrading E5 users to E3 would remove their built-in litigation hold capability, requiring additional add-ons and complicating compliance. Option C is wrong because litigation hold is not automatically enabled for all mailboxes; it must be explicitly configured by an administrator, and it requires appropriate licensing.

Full explanation →

324

Multi-Selectmedium

An organization wants to retain mailbox content for legal investigation. Which two statements are accurate about the Microsoft 365 capability involved?

Select 2 answers

A.It requires every document to be made public

B.eDiscovery and retention capabilities in Microsoft Purview

C.The policy should be tested with a limited group before broad rollout

D.It replaces the need for identity and access management

AnswersB, C

Purview eDiscovery and retention help preserve and search content for investigations.

Why this answer

Security and compliance controls should be selected by risk scenario and tested before tenant-wide enforcement.

Full explanation →

325

MCQeasy

Your organization has a Microsoft 365 E5 subscription and wants to use Microsoft Purview to identify and protect sensitive data. Which feature should you use to automatically discover sensitive data across Exchange Online, SharePoint Online, and OneDrive?

A.Content explorer

B.Data Loss Prevention (DLP) policies

C.Sensitivity labels

D.Activity explorer

AnswerA

Content explorer displays sensitive data locations across workloads.

Why this answer

Option B is correct: Content explorer shows where sensitive data is stored. Option A is incorrect because Activity explorer shows user activity. Option C is incorrect because Data Loss Prevention policies prevent sharing.

Option D is incorrect because Sensitivity labels classify data.

Full explanation →

326

MCQmedium

An organization uses Microsoft Defender XDR and wants to investigate a potential ransomware attack. Which portal should the security team use to see the full attack timeline?

A.Microsoft Purview compliance portal

B.Microsoft Sentinel

C.Azure portal

D.Microsoft 365 Defender portal

AnswerD

The Defender portal aggregates alerts and incidents from across Microsoft 365.

Why this answer

Option A is correct. The Microsoft 365 Defender portal provides a unified incident view with the full attack timeline. Option B is wrong because Microsoft Sentinel is a SIEM, not the primary portal for Microsoft 365 Defender.

Option C is wrong because the Microsoft Purview portal is for compliance. Option D is wrong because the Azure portal is for Azure resources.

Full explanation →

327

MCQmedium

A business stakeholder asks how Microsoft 365 can help them guide assignment of Microsoft 365 admin roles. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Whiteboard

B.Microsoft Stream

C.Least privilege

D.Microsoft Forms

AnswerC

Least privilege means assigning only the permissions required for a task.

Why this answer

The principle of least privilege is the most relevant concept for guiding assignment of Microsoft 365 admin roles. It dictates that users should be granted only the minimum permissions necessary to perform their job functions, which directly applies to assigning admin roles to reduce security risks. This is a core security and identity concept within Microsoft 365, not a specific application or service.

Exam trap

The trap here is that candidates may confuse productivity tools (Whiteboard, Stream, Forms) with security or administrative concepts, failing to recognize that 'least privilege' is a fundamental security principle directly tied to role assignment in Microsoft 365.

How to eliminate wrong answers

Option A is wrong because Microsoft Whiteboard is a digital canvas application for collaboration, not related to admin role assignment or security principles. Option B is wrong because Microsoft Stream is a video service for recording and sharing content, not a tool for managing admin permissions. Option D is wrong because Microsoft Forms is a survey and quiz creation tool, irrelevant to the principle of assigning admin roles with minimal permissions.

Full explanation →

328

MCQmedium

A department asks for the Microsoft 365 service best suited for forms-based surveys and quizzes. Which service should they use?

A.Microsoft Entra Privileged Identity Management

B.Microsoft Forms

C.Microsoft Purview Compliance Manager

D.Microsoft Defender for Endpoint

AnswerB

Forms is used to create surveys, quizzes, and polls.

Why this answer

Microsoft Forms is the correct service because it is specifically designed for creating forms-based surveys, quizzes, and polls. It provides real-time response tracking, automatic grading for quizzes, and seamless integration with Microsoft 365 apps like Excel and Teams, making it the ideal choice for the department's request.

Exam trap

The trap here is that candidates may confuse Microsoft Forms with other Microsoft 365 services that have 'management' or 'compliance' in their names, assuming they include survey capabilities, but only Forms is purpose-built for forms-based data collection and quizzes.

How to eliminate wrong answers

Option A is wrong because Microsoft Entra Privileged Identity Management is an identity governance tool for managing, controlling, and monitoring access to Azure AD resources, not for creating surveys or quizzes. Option C is wrong because Microsoft Purview Compliance Manager is a compliance management solution that helps organizations assess and manage their compliance posture, not a forms-based survey tool. Option D is wrong because Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to protect devices from threats, not for building forms or quizzes.

Full explanation →

329

MCQmedium

A compliance-aware administrator is selecting the right Microsoft 365 capability to brainstorm using a shared digital canvas during Teams meetings. Microsoft 365 app or service is the best fit?

A.Microsoft Planner

B.Microsoft Purview Audit

C.Microsoft Forms

D.Microsoft Whiteboard

AnswerD

Whiteboard provides a collaborative digital canvas.

Why this answer

Microsoft Whiteboard is the best fit because it provides a shared digital canvas that allows meeting participants to brainstorm, draw, and collaborate in real time during Teams meetings. It integrates directly with Teams, supports ink and sticky notes, and persists content across sessions, making it ideal for interactive brainstorming.

Exam trap

The trap here is that candidates may confuse Microsoft Planner's board view with a canvas, but Planner is strictly for task tracking, not freeform drawing or brainstorming.

How to eliminate wrong answers

Option A is wrong because Microsoft Planner is a task management tool for organizing work with boards and checklists, not a real-time shared canvas for brainstorming. Option B is wrong because Microsoft Purview Audit is a compliance and auditing solution that tracks user and admin activities, not a collaborative whiteboarding tool. Option C is wrong because Microsoft Forms is used to create surveys, quizzes, and polls, not a freeform digital canvas for brainstorming.

Full explanation →

330

MCQmedium

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. The AppId 00000003-0000-0ff1-ce00-000000000000 corresponds to Microsoft Graph. The policy requires MFA for all users accessing Microsoft Graph. However, users report that they are not prompted for MFA when using Microsoft Teams. What is the most likely reason?

A.The policy applies only to Microsoft Graph, not to the Teams service itself.

B.The policy is not enabled.

C.The policy should include the app ID for Office 365 Exchange Online.

D.The GrantControls should be set to RequireMFA for all resources.

AnswerA

Teams uses multiple app IDs; the policy targets only Graph, so Teams may not trigger MFA.

Why this answer

Teams does not exclusively use Microsoft Graph for all operations; it also uses other endpoints. The policy only applies to Microsoft Graph, not Teams service endpoints. Option B is correct.

Options A, C, and D are incorrect.

Full explanation →

331

Multi-Selectmedium

Which THREE Microsoft 365 services are part of Microsoft Purview compliance suite?

Select 3 answers

A.Microsoft Entra ID

B.Microsoft Defender for Cloud Apps

C.Data Lifecycle Management

D.Communication Compliance

E.Audit

AnswersC, D, E

Data Lifecycle Management is part of Purview for governing data retention and deletion.

Why this answer

Data Lifecycle Management (C) is part of Microsoft Purview because it provides automated retention and deletion policies for sensitive data across Exchange, SharePoint, OneDrive, and Teams. It helps organizations comply with regulatory requirements by governing data from creation to disposal, directly supporting the Purview compliance portal's governance capabilities.

Exam trap

The trap here is that candidates often confuse Microsoft Defender for Cloud Apps (a security tool) with a compliance service, but Purview focuses on data governance, audit, and communication monitoring, not threat detection or identity management.

Full explanation →

332

MCQmedium

An administrator is reviewing a request from users who need to analyze attachments in a protected environment before delivery. Microsoft security, identity, or compliance capability should it use?

A.Safe Attachments

B.Microsoft Forms

C.Microsoft Stream

D.Microsoft Planner

AnswerA

Safe Attachments analyzes email attachments for malicious content.

Why this answer

Safe Attachments is the correct Microsoft 365 Defender capability that detonates email attachments in a virtual, protected environment before delivery. It uses behavioral analysis and machine learning to detect malicious content, ensuring that only safe attachments reach the user's inbox. This directly addresses the requirement to analyze attachments in a protected environment.

Exam trap

The trap here is that candidates may confuse Safe Attachments with other Microsoft 365 security features like Safe Links or anti-malware policies, but the question specifically requires a capability that analyzes attachments in a protected environment before delivery, which is uniquely provided by Safe Attachments.

How to eliminate wrong answers

Option B (Microsoft Forms) is wrong because it is a survey and data collection tool, not a security feature for analyzing attachments. Option C (Microsoft Stream) is wrong because it is a video sharing and management platform, unrelated to email attachment security. Option D (Microsoft Planner) is wrong because it is a task management and planning tool, with no capability to scan or detonate attachments.

Full explanation →

333

Multi-Selectmedium

Which TWO of the following are required to use Microsoft 365 Apps for enterprise?

Select 2 answers

A.A supported operating system

B.Exchange Online mailbox

C.Persistent internet connectivity

D.A valid Microsoft 365 license

E.Microsoft Entra ID

AnswersA, D

A supported OS (Windows, macOS) is required.

Why this answer

A supported operating system is required because Microsoft 365 Apps for enterprise (e.g., Word, Excel, Outlook) must be installed on a compatible OS such as Windows 10/11, macOS, or a supported Linux distribution via browser-based access. Without a supported OS, the applications cannot run or receive updates, as Microsoft enforces minimum OS version requirements for security and feature compatibility.

Exam trap

The trap here is that candidates often confuse 'required for activation' with 'required for usage,' mistakenly thinking persistent internet or an Exchange mailbox is mandatory, when in fact the apps can be used offline and without email services as long as a valid license and supported OS are present.

Full explanation →

334

Multi-Selecteasy

Which TWO Microsoft 365 apps are included in Microsoft 365 Business Basic?

Select 2 answers

A.Microsoft Teams

B.Exchange Online

C.Microsoft Power BI Pro

D.Microsoft Project Online Plan 3

E.Microsoft Word (desktop app)

AnswersA, B

Teams is included in Business Basic.

Why this answer

Microsoft Teams is included in Microsoft 365 Business Basic as a core app for chat, meetings, and collaboration. Exchange Online is also included, providing hosted email, calendars, and contacts with a 50 GB mailbox per user. Both are cloud-only services in this plan, with no desktop Office apps.

Exam trap

The trap here is that candidates often assume all Microsoft 365 plans include desktop Office apps, but Business Basic explicitly excludes them, offering only web and mobile versions.

Full explanation →

335

MCQmedium

Refer to the exhibit. A Microsoft 365 administrator runs the PowerShell script against Microsoft Entra ID. The script outputs several enabled Conditional Access policies. However, users report they are not prompted for MFA even though there is an enabled policy that should require MFA for all users. What is the most likely reason?

A.The policy is set to 'report-only' mode.

B.The script is not executed with administrative privileges.

C.The script does not run against all policies.

D.The script disables the MFA policy inadvertently.

AnswerA

A policy in report-only mode does not enforce MFA.

Why this answer

Option D is correct because the script checks if the policy state is enabled, but does not check if the policy is in 'report-only' mode. A policy can be enabled but set to report-only, which does not enforce MFA. Option A is wrong because the script checks all enabled policies.

Option B is wrong because the script is used for policy listing, not enforcement. Option C is wrong because the script does not modify policies.

Full explanation →

336

MCQmedium

A business stakeholder asks how Microsoft 365 can help them host an intranet landing page with news, navigation links, and department content. Microsoft 365 app or service is the best fit?

A.SharePoint Online

B.Microsoft Purview Audit

C.Microsoft Forms

D.Microsoft Planner

AnswerA

SharePoint Online is the primary Microsoft 365 service for intranet pages and structured content.

Why this answer

SharePoint Online is the correct answer because it is a web-based platform specifically designed for creating intranet portals, team sites, and communication sites. It provides built-in web parts for news feeds, navigation links, and department content pages, making it the ideal service for hosting a company intranet landing page.

Exam trap

The trap here is that candidates may confuse Microsoft Planner's task lists with content organization, or assume Microsoft Forms can publish content, when in fact only SharePoint Online provides the structured site hierarchy and web part capabilities needed for an intranet landing page.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Audit is a compliance and auditing solution that tracks user and admin activities across Microsoft 365, not a tool for building intranet pages. Option C is wrong because Microsoft Forms is a survey and quiz creation tool, not a content management or intranet hosting platform. Option D is wrong because Microsoft Planner is a task management and project tracking application, not designed for publishing news or organizing department content.

Full explanation →

337

MCQmedium

A business wants predictable annual subscription pricing and centralized license assignment. Which option best matches the requirement?

A.Microsoft Defender for Cloud only

B.Microsoft 365 admin center license management

C.A free personal Microsoft account only

D.Azure Virtual Desktop only

AnswerB

The admin center is used to buy, assign, and manage Microsoft 365 licenses.

Why this answer

The Microsoft 365 admin center provides centralized license assignment and management, allowing administrators to assign, revoke, and track licenses across users. It also supports predictable annual subscription pricing through Enterprise Agreement or CSP annual commitments, ensuring fixed costs for the billing period.

Exam trap

The trap here is that candidates may confuse a security or virtualization service (like Defender for Cloud or Azure Virtual Desktop) with a licensing management tool, overlooking that only the admin center directly handles subscription pricing and centralized license assignment.

How to eliminate wrong answers

Option A is wrong because Microsoft Defender for Cloud is a security solution for threat protection and compliance, not a licensing or subscription management tool; it does not handle license assignment or pricing. Option C is wrong because a free personal Microsoft account offers no subscription pricing or centralized license management; it is limited to individual use of free services. Option D is wrong because Azure Virtual Desktop is a desktop virtualization service that requires separate licensing (e.g., Microsoft 365 or Windows per-user licenses) and does not itself provide predictable annual subscription pricing or centralized license assignment.

Full explanation →

338

Multi-Selectmedium

Which TWO actions should you take to protect against ransomware attacks in Microsoft 365?

Select 2 answers

A.Enable anti-malware policies in Microsoft Defender for Office 365.

B.Deploy attack simulation training to educate users.

C.Apply sensitivity labels with auto-labeling.

D.Configure Data Loss Prevention (DLP) policies.

E.Use SharePoint and OneDrive restricted access and permissions.

AnswersA, E

Anti-malware blocks malicious attachments that could deliver ransomware.

Why this answer

Options B and D are correct: Anti-malware policies block known malware, and restricted permissions in SharePoint prevent unauthorized encryption. Option A is incorrect because attack simulation is for training, not prevention. Option C is incorrect because DLP policies prevent data loss, not ransomware.

Option E is incorrect because auto-labeling is for classification, not protection.

Full explanation →

339

MCQmedium

A company with 250 users has Microsoft 365 E3 licenses. They want to add advanced anti-phishing and anti-malware protection for email and also deploy endpoint detection and response (EDR) for all devices. What is the most cost-effective licensing add-on?

A.Microsoft 365 E5 Security add-on

B.Microsoft Defender for Microsoft 365 Plan 1 and Microsoft Defender for Endpoint Plan 1 add-ons

C.Microsoft 365 E5 Compliance add-on

D.Upgrade all users to Microsoft 365 E5

AnswerA

This add-on bundles Defender for Microsoft 365 Plan 2 and Defender for Endpoint Plan 1 at a lower combined price than purchasing them individually.

Why this answer

Microsoft 365 E5 Security add-on provides advanced anti-phishing and anti-malware protection via Microsoft Defender for Office 365 Plan 2 and includes Microsoft Defender for Endpoint Plan 2 for EDR capabilities. This is the most cost-effective option because it adds exactly the required security features to existing E3 licenses without the higher cost of a full E5 upgrade or the redundancy of separate plan 1 add-ons.

Exam trap

The trap here is that candidates often confuse the 'Plan 1' vs 'Plan 2' tiers, assuming that any Defender add-on provides full EDR and advanced anti-phishing, when in reality Plan 1 lacks key features like automated investigation and advanced threat hunting.

How to eliminate wrong answers

Option B is wrong because Microsoft Defender for Office 365 Plan 1 and Microsoft Defender for Endpoint Plan 1 do not include advanced anti-phishing (e.g., impersonation protection, campaign views) or full EDR capabilities (e.g., automated investigation and response, threat analytics) — those require Plan 2. Option C is wrong because Microsoft 365 E5 Compliance add-on focuses on data governance, eDiscovery, and information protection (e.g., DLP, retention labels), not on anti-phishing/anti-malware for email or endpoint EDR. Option D is wrong because upgrading all users to Microsoft 365 E5 is more expensive than adding the E5 Security add-on, which provides the same security features without the extra compliance and analytics features of full E5.

Full explanation →

340

MCQeasy

Which characteristic of cloud computing allows a user to provision resources automatically without requiring human interaction with the service provider?

A.Rapid elasticity

B.Resource pooling

C.On-demand self-service

D.Measured service

AnswerC

On-demand self-service allows users to automatically get resources as needed without manual intervention.

Why this answer

Option C is correct because on-demand self-service is a fundamental characteristic of cloud computing defined by NIST (SP 800-145) that allows a user to unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider. This is typically implemented through a web portal or API (e.g., AWS Console, Azure Portal, or RESTful APIs) that enables instant resource creation and configuration.

Exam trap

The trap here is that candidates often confuse 'rapid elasticity' with 'on-demand self-service' because both involve automation, but rapid elasticity focuses on scaling existing resources while on-demand self-service is about the initial provisioning without human intervention.

How to eliminate wrong answers

Option A is wrong because rapid elasticity refers to the ability to scale resources up or down quickly and automatically in response to demand, not to the initial provisioning without human interaction. Option B is wrong because resource pooling describes the provider's multi-tenant model where physical and virtual resources are dynamically assigned and reassigned according to consumer demand, not the user's ability to self-provision. Option D is wrong because measured service involves metering and monitoring resource usage (e.g., CPU hours, bandwidth, storage) for billing and optimization, not the automated provisioning process.

Full explanation →

341

MCQmedium

A company uses Microsoft 365 Copilot to summarize a long email thread. Where does Copilot retrieve the email content from?

A.SharePoint Online

B.Exchange Online

C.OneDrive for Business

D.Microsoft Viva Topics

AnswerB

Copilot retrieves email content from the user's Exchange Online mailbox.

Why this answer

Microsoft 365 Copilot retrieves email content directly from Exchange Online, which is the Microsoft 365 service that stores and manages mailboxes, emails, and calendar items. When summarizing a long email thread, Copilot accesses the user's mailbox via Exchange Web Services (EWS) or the Microsoft Graph API, which provides programmatic access to email data. This allows Copilot to read the thread's messages and generate a concise summary without needing to store or index the content elsewhere.

Exam trap

The trap here is that candidates often confuse where email content is stored versus where documents or files are stored, mistakenly selecting SharePoint Online or OneDrive for Business because they associate Copilot with summarizing content from those services, but email specifically resides in Exchange Online.

How to eliminate wrong answers

Option A is wrong because SharePoint Online is a document management and collaboration platform for files, lists, and sites, not for storing individual email messages or threads. Option C is wrong because OneDrive for Business is a personal cloud storage service for files and documents, not for email content, which resides in Exchange Online mailboxes. Option D is wrong because Microsoft Viva Topics is a knowledge discovery service that uses AI to organize and surface topics from content across Microsoft 365, but it does not directly store or provide raw email thread data for Copilot summarization.

Full explanation →

342

Multi-Selectmedium

Which THREE are benefits of using cloud services compared to on-premises infrastructure?

Select 3 answers

A.Limited scalability due to resource constraints

B.Elasticity to scale resources up or down automatically

C.High availability through redundant infrastructure

D.Built-in disaster recovery capabilities

E.Capital expenditure (CapEx) is eliminated

AnswersB, C, D

Cloud resources can be scaled automatically based on demand.

Why this answer

Options A, B, and D are correct. Cloud provides high availability, elasticity, and disaster recovery capabilities. Option C (Capital expenditure reduction) is also a benefit, but the question asks for benefits; however, note that cloud shifts capex to opex, so it reduces capital expenditure.

But we need to select exactly three. Option E (Limited scalability) is false; cloud offers scalable resources.

Full explanation →

343

MCQhard

A company uses a third-party Human Resources (HR) system. Whenever a new employee is added to the HR system, they want to automatically create a user account in Microsoft 365, assign the appropriate license, and send a welcome email. Which Microsoft 365 service should be used to orchestrate this automation?

A.Microsoft Power Automate

B.Microsoft Identity Manager

C.Microsoft Entra ID Connect

D.Microsoft Graph API

AnswerA

Power Automate provides triggers and actions to automate workflows across services, perfect for HR-driven user provisioning.

Why this answer

Microsoft Power Automate is the correct service because it provides a low-code workflow automation platform that can trigger actions based on events in external systems (e.g., a new employee record in a third-party HR system) and then orchestrate a sequence of tasks in Microsoft 365, such as creating a user account via the Microsoft Graph API, assigning a license, and sending a welcome email. It integrates seamlessly with hundreds of connectors, including HR systems and Microsoft 365 services, making it the ideal tool for this cross-system automation scenario.

Exam trap

The trap here is that candidates often confuse the Microsoft Graph API (a development tool) with Power Automate (a no-code/low-code orchestration service), mistakenly thinking that because the Graph API can perform the individual actions, it is the correct answer for orchestrating the entire automated workflow.

How to eliminate wrong answers

Option B (Microsoft Identity Manager) is wrong because it is an on-premises identity and access management solution focused on synchronizing identities between on-premises directories and cloud directories, not on orchestrating event-driven workflows like creating users and sending emails. Option C (Microsoft Entra ID Connect) is wrong because it is a synchronization tool that replicates on-premises Active Directory objects to Microsoft Entra ID for hybrid identity scenarios; it does not provide workflow automation or trigger actions based on external HR system events. Option D (Microsoft Graph API) is wrong because while it can be used to programmatically create users, assign licenses, and send emails, it is a RESTful API that requires custom code and does not provide the orchestration, scheduling, or low-code workflow capabilities that Power Automate offers for automating a multi-step process triggered by an external system.

Full explanation →

344

MCQeasy

Which cloud characteristic allows an organization to increase or decrease computing resources quickly based on demand, without requiring manual intervention?

A.Measured service

B.Rapid elasticity

C.Resource pooling

D.Broad network access

AnswerB

Rapid elasticity allows resources to be provisioned and released quickly, often automatically, to scale with demand.

Why this answer

Rapid elasticity is the cloud characteristic that enables automatic, on-demand scaling of computing resources (such as virtual machines, storage, or network bandwidth) in response to fluctuating workload demands, without requiring manual provisioning or de-provisioning. This is a core feature of cloud computing defined by NIST SP 800-145, allowing resources to scale out (increase) or scale in (decrease) dynamically, often using orchestration tools like Azure Autoscale or AWS Auto Scaling. The key distinction is that the scaling happens quickly and automatically, based on predefined rules or metrics like CPU utilization or request count.

Exam trap

The trap here is that candidates often confuse 'rapid elasticity' with 'resource pooling' because both involve dynamic allocation, but resource pooling is about sharing resources among multiple tenants, not about automatically scaling a single tenant's resources on demand.

How to eliminate wrong answers

Option A (Measured service) is wrong because it refers to the metering and billing of cloud resource usage (e.g., pay-per-use or consumption-based pricing), not the ability to scale resources up or down automatically. Option C (Resource pooling) is wrong because it describes the multi-tenant model where provider resources are pooled to serve multiple customers, with physical and virtual resources dynamically assigned and reassigned according to demand, but it does not inherently provide automatic scaling of individual customer resources. Option D (Broad network access) is wrong because it defines the capability for resources to be accessed over the network via standard protocols (e.g., HTTPS, SSH) from a wide range of devices (e.g., laptops, smartphones), not the ability to adjust resource capacity on demand.

Full explanation →

345

MCQhard

A compliance team needs to implement a Data Loss Prevention (DLP) policy to protect credit card information. What is the correct order of steps for a successful implementation?

A.Create policy, Identify locations, Deploy in production, Monitor alerts and refine

B.Identify locations, Create policy, Deploy in production, Monitor alerts and refine

C.Deploy in production, Monitor alerts and refine, Identify locations, Create policy

D.Identify locations, Deploy in production, Create policy, Monitor alerts and refine

AnswerB

This order follows industry best practices: first understand where sensitive data lives, then build the policy, deploy it, and finally monitor and refine.

Why this answer

Best practice for DLP implementation: first identify where sensitive data resides (locations), then create the DLP policy with conditions and actions, test the policy in simulation mode before deploying to production, and finally monitor alerts and refine the policy. The option starting with 'Identify locations' followed by 'Create policy', 'Deploy in production', and 'Monitor' matches this sequence.

Full explanation →

346

MCQeasy

A training department wants to create interactive learning paths and track employee progress. Which Microsoft 365 service should they use?

A.Microsoft Viva Learning

B.Microsoft Viva Topics

C.Microsoft Stream

D.SharePoint Online

AnswerA

Viva Learning provides learning paths and progress tracking.

Why this answer

Option A is correct because Viva Learning is designed for learning and training. Option B is incorrect because SharePoint Online is for document management. Option C is incorrect because Stream is for videos.

Option D is incorrect because Viva Topics is for knowledge management.

Full explanation →

347

MCQmedium

While preparing a Microsoft 365 adoption plan, a consultant is asked to manage billing without granting full tenant control. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Stream

B.Microsoft Forms

C.Billing Administrator

D.Microsoft Whiteboard

AnswerC

Billing Administrator manages subscriptions, purchases, and billing-related tasks.

Why this answer

The Billing Administrator role in Microsoft 365 is specifically designed to manage billing tasks—such as invoices, payment methods, and subscription purchases—without granting broader tenant-wide administrative privileges. This aligns directly with the scenario of managing billing while avoiding full tenant control, making it the most relevant concept for the adoption plan.

Exam trap

The trap here is that candidates may confuse a Microsoft 365 service or application (like Stream, Forms, or Whiteboard) with an administrative role, failing to recognize that the question specifically asks for a licensing, admin, or support concept rather than a feature or app.

How to eliminate wrong answers

Option A (Microsoft Stream) is wrong because it is a video management and sharing service, not an administrative role or billing concept; it has no capability to manage billing or tenant permissions. Option B (Microsoft Forms) is wrong because it is a survey and data collection tool, unrelated to billing administration or tenant-level access control. Option D (Microsoft Whiteboard) is wrong because it is a collaborative digital canvas application, with no role in billing management or administrative delegation.

Full explanation →

348

MCQmedium

A 200-user company needs desktop Office apps, Exchange Online mailboxes, Microsoft Teams, and Intune-based device management. Which Microsoft 365 plan is the best fit from the listed options?

A.Microsoft 365 Business Premium.

B.Microsoft 365 Business Basic.

C.Exchange Online Plan 1.

D.Microsoft Teams Essentials.

AnswerA

It includes productivity apps plus device and security management capabilities.

Why this answer

Microsoft 365 Business Premium is the correct choice because it bundles desktop Office apps (e.g., Word, Excel, Outlook), Exchange Online mailboxes, Microsoft Teams, and Intune-based device management into a single subscription. This plan is specifically designed for small-to-medium businesses needing full productivity, communication, and security/compliance capabilities, including mobile device management (MDM) via Intune.

Exam trap

The trap here is that candidates often confuse Microsoft 365 Business Basic (which lacks desktop apps) with Business Premium, or mistakenly think standalone plans like Exchange Online Plan 1 or Teams Essentials can cover all requirements, ignoring the need for integrated desktop apps and device management.

How to eliminate wrong answers

Option B (Microsoft 365 Business Basic) is wrong because it provides only web and mobile versions of Office apps, not the desktop Office apps required by the question. Option C (Exchange Online Plan 1) is wrong because it offers only Exchange Online mailboxes and lacks desktop Office apps, Microsoft Teams, and Intune-based device management. Option D (Microsoft Teams Essentials) is wrong because it is a standalone Teams-only plan with no Exchange Online mailboxes, desktop Office apps, or Intune device management.

Full explanation →

349

MCQeasy

Which cloud deployment model exclusively uses resources that are owned and managed by a single organization, and is often chosen for its high level of control and compliance?

A.Public cloud

B.Private cloud

C.Hybrid cloud

D.Community cloud

AnswerB

Private cloud provides exclusive use to a single organization, offering full control and compliance adherence.

Why this answer

The private cloud deployment model is correct because it is defined as a cloud infrastructure that is provisioned for exclusive use by a single organization. This model provides the highest level of control over data, security, and compliance, as the organization owns and manages the underlying hardware and software, often within its own data center or via a dedicated hosted environment.

Exam trap

The trap here is that candidates often confuse 'private cloud' with 'on-premises infrastructure' and may incorrectly select 'hybrid cloud' thinking it offers the same control, but the question specifically asks for a model that exclusively uses resources owned by a single organization, which is the defining characteristic of a private cloud.

How to eliminate wrong answers

Option A is wrong because the public cloud model uses resources owned and operated by a third-party cloud service provider (e.g., Microsoft Azure, AWS, Google Cloud) and is shared across multiple tenants, offering less control and compliance isolation. Option C is wrong because the hybrid cloud model combines both public and private clouds, allowing data and applications to be shared between them, which does not exclusively use resources owned by a single organization. Option D is wrong because the community cloud model is shared by several organizations with common concerns (e.g., compliance, security, policy), not exclusively owned and managed by a single organization.

Full explanation →

350

MCQeasy

A user wants to access company email and documents from any device, anywhere. Which cloud model is Microsoft 365?

A.Platform as a Service (PaaS)

B.Software as a Service (SaaS)

C.Infrastructure as a Service (IaaS)

D.Desktop as a Service (DaaS)

AnswerB

Microsoft 365 is SaaS, providing subscription-based access to email, documents, and collaboration tools.

Why this answer

Option C is correct because Microsoft 365 is a Software as a Service (SaaS) offering where users subscribe to software like Exchange Online and SharePoint Online. Option A (IaaS) provides infrastructure like VMs. Option B (PaaS) provides development platforms.

Option D (DaaS) provides virtual desktops.

Full explanation →

351

MCQmedium

A business stakeholder asks how Microsoft 365 can help them identify what remains a customer responsibility in Microsoft 365. Cloud concept or benefit best matches this requirement?

A.Microsoft Planner

B.Data Loss Prevention (DLP)

C.Sensitivity labels

D.Managing users, permissions, and data governance

AnswerD

Microsoft operates the service, but customers manage identities, permissions, content, and governance choices.

Why this answer

Option D is correct because the question asks which cloud concept or benefit helps identify customer responsibilities in Microsoft 365. Managing users, permissions, and data governance directly aligns with the shared responsibility model, where the customer is always responsible for their own data, user identities, and access policies. This option encapsulates the customer's duty to control who has access and how data is governed, which is a core cloud concept.

Exam trap

The trap here is that candidates often confuse specific security features (like DLP or sensitivity labels) with the broader cloud concept of customer responsibility, which is defined by the shared responsibility model rather than any single tool.

How to eliminate wrong answers

Option A is wrong because Microsoft Planner is a task management and project planning tool, not a concept or benefit that defines customer responsibilities in the cloud. Option B is wrong because Data Loss Prevention (DLP) is a security feature that helps protect sensitive data from being shared inappropriately, but it does not define the customer's overall responsibility scope in the shared responsibility model. Option C is wrong because sensitivity labels are used to classify and protect data based on its sensitivity, but they are a tool for implementing governance, not the underlying concept that identifies what remains a customer responsibility.

Full explanation →

352

Multi-Selectmedium

Which TWO Microsoft 365 services provide real-time communication and collaboration features?

Select 2 answers

A.OneDrive for Business

B.Microsoft Teams

C.Exchange Online

D.Yammer

E.SharePoint

AnswersB, D

Teams provides real-time chat, meetings, and collaboration.

Why this answer

Microsoft Teams (B) is correct because it provides real-time communication and collaboration features such as instant messaging, voice/video calls, and online meetings, all integrated within a single hub. Yammer (D) is correct because it offers enterprise social networking with real-time conversations, live events, and community-based collaboration, enabling immediate communication across an organization.

Exam trap

The trap here is that candidates often confuse OneDrive for Business or SharePoint as collaboration tools because they allow co-authoring, but they lack real-time communication features like chat or video, which are the core focus of this question.

Full explanation →

353

MCQeasy

A startup with 25 employees needs business-grade email (50 GB mailbox per user), web versions of Office apps, and 1 TB of cloud storage per user. They do not need the desktop versions of Office or advanced security features. Which Microsoft 365 plan is the most cost-effective choice?

A.Microsoft 365 Business Basic

B.Microsoft 365 Business Standard

C.Microsoft 365 Business Premium

D.Microsoft 365 Apps for business

AnswerA

This plan provides business email (50 GB), web and mobile Office apps, and 1 TB of OneDrive storage per user—matching all stated needs at the lowest cost.

Why this answer

Microsoft 365 Business Basic provides business-grade email with 50 GB mailboxes, web versions of Office apps (Word, Excel, PowerPoint, etc.), and 1 TB of cloud storage per user via OneDrive for Business. Since the startup does not need desktop Office apps or advanced security features, this plan meets all stated requirements at the lowest cost.

Exam trap

The trap here is that candidates often confuse 'web versions of Office apps' with 'desktop versions' and select Business Standard, or they assume that business-grade email requires a higher-tier plan like Business Premium, when in fact Business Basic includes Exchange Online mailboxes.

How to eliminate wrong answers

Option B (Microsoft 365 Business Standard) is wrong because it includes desktop versions of Office apps, which the startup does not need, making it more expensive than necessary. Option C (Microsoft 365 Business Premium) is wrong because it adds advanced security features (e.g., Microsoft Defender for Office 365, Intune) and desktop Office apps, exceeding the stated requirements and increasing cost. Option D (Microsoft 365 Apps for business) is wrong because it provides only desktop and web versions of Office apps without Exchange Online mailboxes (no business-grade email) and offers only 1 TB of cloud storage per user but lacks the 50 GB mailbox requirement.

Full explanation →

354

MCQmedium

A compliance-aware administrator is selecting the right Microsoft 365 capability to evaluate Microsoft 365 before purchasing. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Stream

B.A Microsoft 365 trial subscription

C.Microsoft Whiteboard

D.Microsoft Forms

AnswerB

Trials allow evaluation before committing to a paid subscription.

Why this answer

A Microsoft 365 trial subscription is the correct choice because it allows an administrator to evaluate the full functionality of Microsoft 365 before making a purchase, directly addressing the requirement to 'evaluate Microsoft 365 before purchasing.' This aligns with the 'Describe Microsoft 365 pricing and support' domain, as trial subscriptions are a key licensing and evaluation concept. Other options like Stream, Whiteboard, and Forms are individual services within Microsoft 365, not mechanisms for pre-purchase evaluation.

Exam trap

The trap here is that candidates may confuse individual Microsoft 365 services (like Stream, Whiteboard, or Forms) with the licensing or evaluation concept, but the question specifically asks for the capability to evaluate the entire platform before purchasing, which only a trial subscription provides.

How to eliminate wrong answers

Option A is wrong because Microsoft Stream is a video service within Microsoft 365, not a licensing, admin, or support concept for evaluating the platform before purchase. Option C is wrong because Microsoft Whiteboard is a collaborative canvas app, unrelated to trial subscriptions or licensing evaluation. Option D is wrong because Microsoft Forms is a survey and quiz tool, not a mechanism for pre-purchase evaluation of Microsoft 365.

Full explanation →

355

MCQmedium

An organization uses Microsoft Teams and wants to ensure that external users from partner companies can access only specific channels and cannot initiate private chats with internal users. Which Microsoft 365 feature should they configure?

A.Microsoft Purview Communication Compliance

B.Teams External Access (Federation)

C.Microsoft Entra B2B collaboration

D.Teams Guest Access

AnswerB

Federation settings control what external users can do, including channel access and chat restrictions.

Why this answer

B is correct because Teams External Access (Federation) allows external users from partner organizations to be added to specific channels without granting them full tenant access. It uses the Session Initiation Protocol (SIP) federation model to enable limited collaboration, and administrators can control whether federated users can initiate private chats by disabling the 'External users can contact me' policy in the Teams admin center. This meets the requirement of restricting external users to only designated channels and preventing private chat initiation.

Exam trap

The trap here is that candidates often confuse Guest Access (which creates full Azure AD guest identities) with External Access (federation), assuming both provide the same level of control, but Guest Access actually grants broader permissions and requires more complex policy management to restrict private chats.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Communication Compliance is a supervision and policy-based solution for monitoring internal and external communications for compliance risks, not for controlling access or chat permissions. Option C is wrong because Microsoft Entra B2B collaboration (formerly Azure AD B2B) provides full guest user accounts with identities in the tenant, allowing them to access resources broadly and initiate private chats unless explicitly restricted via conditional access policies, which is more complex than the simple federation control needed. Option D is wrong because Teams Guest Access creates guest accounts in the tenant's Azure AD, giving them broader access to Teams features (including private chats by default) and requiring more granular policy configuration to restrict chat initiation, whereas federation is designed for limited, channel-specific collaboration without full guest identities.

Full explanation →

356

MCQmedium

An administrator is reviewing a request from users who need to avoid overprovisioning for a seasonal workload. Cloud concept or benefit best matches this requirement?

A.Data Loss Prevention (DLP)

B.Sensitivity labels

C.Microsoft Planner

D.Rapid elasticity

AnswerD

Rapid elasticity allows capacity to increase during peaks and reduce when demand falls.

Why this answer

Rapid elasticity is a core cloud computing characteristic defined by NIST (SP 800-145) that allows resources to scale out and in automatically based on demand. For a seasonal workload, this means the cloud can provision additional compute or storage capacity during peak periods and release it when demand drops, preventing overprovisioning and optimizing costs.

Exam trap

The trap here is that candidates confuse operational tools (like Planner) or security features (like DLP and sensitivity labels) with core cloud architectural benefits, failing to recognize that rapid elasticity is the specific NIST-defined characteristic that directly addresses overprovisioning for variable workloads.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) is a security feature in Microsoft Purview that monitors and protects sensitive data from unauthorized sharing or leakage, not a mechanism for scaling resources. Option B is wrong because sensitivity labels are classification and protection controls applied to documents and emails to enforce encryption or access restrictions, unrelated to workload elasticity. Option C is wrong because Microsoft Planner is a task management and collaboration tool within Microsoft 365, not a cloud infrastructure feature for dynamic resource allocation.

Full explanation →

357

MCQmedium

A company with 500 Microsoft 365 Business Premium users needs to add Microsoft Defender for Office 365 Plan 2 (advanced threat protection) and eDiscovery (Premium) for legal investigations. They want to keep their existing Business Premium subscriptions to retain current features. Which add-on licenses are required?

A.Microsoft 365 E5 Security add-on only

B.Microsoft 365 E5 Compliance add-on only

C.Both Microsoft 365 E5 Security and Microsoft 365 E5 Compliance add-ons

D.Upgrade all users to Microsoft 365 E5

AnswerC

Both add-ons are required because they each cover separate advanced capabilities: Security for Defender Plan 2 and Compliance for eDiscovery (Premium).

Why this answer

Microsoft 365 Business Premium includes basic security and compliance features, but Microsoft Defender for Office 365 Plan 2 requires the Microsoft 365 E5 Security add-on, and eDiscovery (Premium) requires the Microsoft 365 E5 Compliance add-on. Since both advanced capabilities are needed, both add-ons are required to supplement the existing Business Premium subscriptions without upgrading to full E5.

Exam trap

The trap here is that candidates assume Microsoft 365 E5 Security and Compliance add-ons are bundled or that one add-on covers both advanced security and compliance needs, but in reality each add-on is specific to its domain and both are required for the stated requirements.

How to eliminate wrong answers

Option A is wrong because the Microsoft 365 E5 Security add-on provides Defender for Office 365 Plan 2 but does not include eDiscovery (Premium), which is a compliance feature. Option B is wrong because the Microsoft 365 E5 Compliance add-on includes eDiscovery (Premium) but does not include Defender for Office 365 Plan 2, which is a security feature. Option D is wrong because upgrading all users to Microsoft 365 E5 is unnecessary and more expensive; the required features can be added via the specific add-ons while retaining Business Premium.

Full explanation →

358

Multi-Selectmedium

A company is planning to deploy Microsoft 365 and needs to meet the following requirements: enable secure remote access to on-premises applications, provide a unified search experience across SharePoint and external data sources, and allow users to create custom dashboards from multiple data sources. Which TWO Microsoft 365 services should the company use?

Select 2 answers

A.Microsoft Loop

B.Microsoft Entra Application Proxy

C.Microsoft Search

D.Power BI

E.Microsoft Forms

AnswersB, D

Correct: Provides secure remote access to on-premises web applications.

Why this answer

Microsoft Entra Application Proxy (option B) enables secure remote access to on-premises web applications by publishing them through Azure AD, using pre-authentication and application-layer security without requiring a VPN. Power BI (option D) allows users to create custom dashboards and reports from multiple data sources, including SharePoint, SQL databases, and cloud services, meeting the requirement for custom dashboards from diverse data.

Exam trap

The trap here is that candidates may confuse Microsoft Search (option C) as fulfilling the unified search requirement while overlooking that it does not address secure remote access or custom dashboards, leading them to select it alongside a wrong pairing like Microsoft Loop.

Full explanation →

359

MCQmedium

A service owner is comparing Microsoft 365 capabilities and needs to make sign-in decisions based on risk, location, and device compliance. Microsoft security, identity, or compliance capability should it use?

A.Microsoft Forms

B.Microsoft Planner

C.Conditional Access policy

D.Microsoft Stream

AnswerC

Conditional Access evaluates identity signals and enforces access controls.

Why this answer

Conditional Access policy is the correct answer because it is the Microsoft Entra ID (formerly Azure AD) feature that enforces sign-in decisions based on risk, location, and device compliance. It allows administrators to create policies that require multi-factor authentication, block access from untrusted locations, or require compliant devices before granting access to Microsoft 365 resources.

Exam trap

The trap here is that candidates may confuse Microsoft 365 productivity tools (Forms, Planner, Stream) with security or identity services, failing to recognize that Conditional Access is the only option that directly controls sign-in decisions based on risk, location, and device compliance.

How to eliminate wrong answers

Option A is wrong because Microsoft Forms is a survey and data collection tool, not an identity or security policy engine; it cannot evaluate sign-in risk, location, or device compliance. Option B is wrong because Microsoft Planner is a task management and project tracking tool within Microsoft 365; it has no capability to enforce conditional access or evaluate authentication context. Option D is wrong because Microsoft Stream is a video hosting and sharing platform; it does not provide any identity-based access control logic beyond what is inherited from the underlying tenant policies.

Full explanation →

360

MCQmedium

During requirements gathering, an IT manager says the organization must manage users, licenses, billing, and tenant settings. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft 365 admin center

B.Microsoft Whiteboard

C.Microsoft Forms

D.Microsoft Stream

AnswerA

The Microsoft 365 admin center is the central location for common tenant administration.

Why this answer

The Microsoft 365 admin center is the centralized web portal for managing users, licenses, billing, and tenant-wide settings. It provides administrators with a single pane of glass to perform tasks such as adding or removing users, assigning licenses, viewing invoices, and configuring tenant-level policies. This directly matches the IT manager's stated requirements for managing users, licenses, billing, and tenant settings.

Exam trap

The trap here is that candidates may confuse collaboration tools (Whiteboard, Forms, Stream) with administrative tools, assuming any Microsoft 365 service can manage users and licenses, when only the admin center provides the required centralized management capabilities.

How to eliminate wrong answers

Option B is wrong because Microsoft Whiteboard is a digital canvas collaboration tool, not an administrative interface for managing users, licenses, billing, or tenant settings. Option C is wrong because Microsoft Forms is a survey and data collection tool, not a platform for administrative management of licensing or billing. Option D is wrong because Microsoft Stream is a video management and sharing service, not a tool for managing users, licenses, billing, or tenant configurations.

Full explanation →

361

MCQeasy

An organization is using Microsoft 365 Business Premium. They want to add Microsoft 365 Copilot for 10 users to enhance productivity with AI features. How should the administrator procure the Copilot licenses?

A.Purchase standalone Microsoft 365 Copilot licenses

B.Upgrade all users to Microsoft 365 E5 to get Copilot included

C.Add Microsoft 365 Copilot as an add-on to the existing subscription

D.Purchase a new Microsoft 365 E3 subscription and add Copilot

AnswerC

Copilot can be added as an add-on to Business Premium or other eligible plans.

Why this answer

Microsoft 365 Copilot is available as an add-on to qualifying Microsoft 365 subscriptions, including Business Premium. This allows the administrator to license only the 10 users who need Copilot without changing the base subscription for all users. Option C correctly identifies this add-on licensing model.

Exam trap

The trap here is that candidates often assume Copilot is included in higher-tier plans like E5 or that it can be purchased as a standalone product, but Microsoft requires it to be an add-on to a qualifying base subscription.

How to eliminate wrong answers

Option A is wrong because standalone Microsoft 365 Copilot licenses do not exist; Copilot is only available as an add-on to an existing qualifying subscription. Option B is wrong because Microsoft 365 E5 does not include Copilot; Copilot requires a separate add-on license even on E5. Option D is wrong because purchasing a new E3 subscription would not include Copilot and would require an unnecessary subscription change; the existing Business Premium subscription already qualifies for the Copilot add-on.

Full explanation →

362

Multi-Selectmedium

Which of the following are key characteristics of cloud computing as defined by the National Institute of Standards and Technology (NIST)? (Choose all that apply. There are four correct answers.)

Select 4 answers

.On-demand self-service

.Broad network access

.Resource pooling

.Rapid elasticity

.Fixed, non-scalable capacity

.Locally installed software only

Why this answer

The NIST SP 800-145 definition identifies five essential characteristics of cloud computing: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. On-demand self-service allows users to provision computing capabilities automatically without requiring human interaction with each service provider. Broad network access means capabilities are available over the network and accessed through standard mechanisms (e.g., mobile phones, laptops, workstations).

Resource pooling enables the provider's computing resources to serve multiple consumers using a multi-tenant model, with physical and virtual resources dynamically assigned and reassigned according to consumer demand. Rapid elasticity allows capabilities to be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand.

Exam trap

Microsoft often tests that candidates confuse 'measured service' (the fifth NIST characteristic) as one of the four correct answers, but the question explicitly asks for four correct answers and omits measured service, so the trap is to include it or to incorrectly select 'Fixed, non-scalable capacity' as a valid characteristic.

Full explanation →

363

MCQmedium

A company uses Microsoft 365 E5 licenses. The security team wants to automatically remediate advanced threats detected on endpoints without manual intervention. Which Microsoft 365 service should they use?

A.Microsoft Intune

B.Microsoft Purview

C.Microsoft Defender XDR

D.Microsoft Sentinel

AnswerC

Defender XDR provides automated investigation and remediation of advanced threats across endpoints.

Why this answer

Microsoft Defender XDR (Extended Detection and Response) is the correct service because it provides automated investigation and remediation capabilities for advanced threats detected on endpoints. It uses AI-driven playbooks to automatically contain or remove threats without manual intervention, which aligns directly with the security team's requirement.

Exam trap

The trap here is that candidates often confuse Microsoft Sentinel's SIEM/SOAR capabilities with automated endpoint remediation, but Sentinel requires integration with Defender XDR to execute such actions, whereas Defender XDR provides native automated remediation directly on endpoints.

How to eliminate wrong answers

Option A is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) service focused on policy enforcement and device compliance, not automated threat remediation. Option B is wrong because Microsoft Purview is a data governance, compliance, and risk management solution (formerly Microsoft 365 Compliance), not designed for endpoint threat detection or automated response. Option D is wrong because Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) service that aggregates logs and alerts from multiple sources, but it does not natively perform automated remediation on endpoints; it requires integration with other tools like Defender XDR for that capability.

Full explanation →

364

MCQeasy

A cloud user can access their files from a work desktop, a personal laptop at home, and a mobile phone while traveling. Which essential characteristic of cloud computing does this scenario best illustrate?

A.On-demand self-service

B.Broad network access

C.Resource pooling

D.Rapid elasticity

AnswerB

Broad network access describes the ability to access cloud services from a wide range of devices over the network.

Why this answer

Broad network access is the correct answer because it describes the ability to access cloud resources from diverse client platforms (work desktop, personal laptop, mobile phone) over the network using standard protocols such as HTTPS, SSH, or VPN. This characteristic ensures that services are available from any location with internet connectivity, not just from a single device or network.

Exam trap

The trap here is that candidates confuse 'access from multiple devices' with 'on-demand self-service' because both involve user-initiated actions, but on-demand self-service specifically means provisioning resources without provider intervention, not multi-device connectivity.

How to eliminate wrong answers

Option A is wrong because on-demand self-service refers to a user provisioning compute resources automatically without requiring human interaction with the cloud provider, not the ability to access files from multiple devices. Option C is wrong because resource pooling describes the provider's multi-tenant model where physical and virtual resources are dynamically assigned to serve multiple consumers, not the user's multi-device access. Option D is wrong because rapid elasticity focuses on the ability to scale resources up or down quickly based on demand, such as adding virtual machines during a traffic spike, not the user's ability to connect from different endpoints.

Full explanation →

365

MCQmedium

A company uses Microsoft 365 and wants to enable their sales team to draft emails using AI suggestions based on CRM data. Which capability should they use?

A.Microsoft Viva Sales

B.Microsoft Copilot for Sales

C.Dynamics 365 Sales

D.Microsoft Copilot for Microsoft 365

AnswerB

Copilot for Sales uses AI to draft emails and provide suggestions based on CRM data.

Why this answer

Option A is correct because Copilot for Sales integrates AI to help draft emails and summarize CRM data. Option B (Copilot for Microsoft 365) is a general AI assistant across Office apps but may not have CRM-specific integration. Option C (Microsoft Viva Sales) provides sales insights but not AI email drafting.

Option D (Dynamics 365 Sales) is a full CRM platform, not an AI email drafting tool.

Full explanation →

366

MCQhard

Refer to the exhibit. A SharePoint admin is reviewing a policy JSON snippet. Which statement accurately describes the effect of this policy?

A.External sharing is allowed only for existing guests who expire in 30 days.

B.External sharing is allowed but guests expire after 30 days.

C.External sharing is allowed but only for users in the same tenant.

D.External sharing is completely disabled.

AnswerD

The policy sets sharingCapability to Disabled and allowExternalSharing to false.

Why this answer

The policy JSON snippet sets the 'sharingCapability' to 'Disabled', which completely disables external sharing for the SharePoint environment. This means no external users can be invited, and any existing external sharing links will cease to function. The 'expirationTime' value of 30 days is irrelevant because sharing is disabled entirely.

Exam trap

The trap here is that candidates see the 'expirationTime' of 30 days and assume external sharing is allowed with an expiration, but they overlook that the 'sharingCapability' is set to 'Disabled', which nullifies any expiration settings.

How to eliminate wrong answers

Option A is wrong because it suggests external sharing is allowed only for existing guests with a 30-day expiration, but the policy disables sharing entirely, not just for new guests. Option B is wrong because it implies external sharing is allowed with a 30-day guest expiration, but the 'sharingCapability' is set to 'Disabled', overriding any expiration settings. Option C is wrong because it claims sharing is allowed only for users in the same tenant, which is the default behavior when external sharing is disabled; however, the policy explicitly disables all sharing, not just external.

Full explanation →

367

MCQhard

An organization uses Microsoft 365 E5 and wants to implement a solution that automatically detects and remediates security incidents across identities, endpoints, and email. Which Microsoft 365 service should they use?

A.Microsoft Defender XDR

B.Microsoft Defender for Endpoint

C.Microsoft Sentinel

D.Microsoft Entra ID Protection

AnswerA

Defender XDR correlates signals across identities, endpoints, email, and more to detect and remediate incidents.

Why this answer

Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified, cross-domain security solution that automatically correlates alerts and orchestrates remediation across identities, endpoints, email, and cloud apps. This aligns directly with the requirement to detect and remediate security incidents across identities, endpoints, and email, leveraging the Microsoft 365 Defender portal to break down silos between individual security products.

Exam trap

The trap here is that candidates often confuse Microsoft Defender XDR with its individual component products (like Defender for Endpoint or Defender for Office 365), mistakenly assuming that a single-domain solution can meet a cross-domain requirement, or they overestimate Microsoft Sentinel's out-of-the-box automation capabilities versus its actual SIEM-centric, custom-playbook nature.

How to eliminate wrong answers

Option B (Microsoft Defender for Endpoint) is wrong because it focuses solely on endpoint detection and response (EDR) for devices, lacking the cross-domain correlation and automated remediation for identities and email that the question specifies. Option C (Microsoft Sentinel) is wrong because it is a cloud-native SIEM (Security Information and Event Management) that ingests logs and requires custom analytics rules and playbooks for automation; it does not provide built-in, automatic cross-domain incident correlation and remediation across identities, endpoints, and email out of the box. Option D (Microsoft Entra ID Protection) is wrong because it is limited to identity-based risk detection and conditional access policies for user accounts, with no capability to monitor or remediate threats on endpoints or in email.

Full explanation →

368

Multi-Selecthard

Which TWO of the following are capabilities of Microsoft Priva? (Choose two.)

Select 2 answers

A.Automate subject rights requests

B.Configure retention labels

C.Assess privacy risks in data transfers

D.Monitor network traffic

E.Detect malware in email attachments

AnswersA, C

Priva helps manage DSRs.

Why this answer

Microsoft Priva helps organizations manage privacy risks by assessing data transfer risks and automating subject rights requests. Options A and C are correct.

Full explanation →

369

MCQmedium

A company wants to reduce capital expenditure on hardware and shift to an operational expense model for IT resources. Which cloud characteristic enables this?

A.On-demand self-service

B.Broad network access

C.Resource pooling

D.Measured service

AnswerD

Measured service enables pay-per-use billing, shifting from capital expenditure to operational expenditure.

Why this answer

Option B is correct because measured service allows cloud providers to meter usage and bill based on consumption, turning capex into opex. Option A (On-demand self-service) lets users provision resources without human interaction. Option C (Resource pooling) enables multi-tenancy.

Option D (Broad network access) ensures accessibility.

Full explanation →

370

MCQmedium

A company wants to securely share a large video file (2 GB) with an external partner without using email attachments. Which Microsoft 365 service should they use?

A.Microsoft SharePoint

B.Microsoft Teams

C.Microsoft Stream

D.Microsoft OneDrive

AnswerD

OneDrive allows sharing large files via secure link with options like expiration and password.

Why this answer

Microsoft OneDrive is the correct choice because it allows sharing large files (up to 250 GB per file) via secure, expiring links with external users, without relying on email attachments. It integrates with Azure AD for access control and supports granular permissions like view or edit, making it ideal for ad-hoc external file sharing.

Exam trap

The trap here is that candidates often confuse Microsoft Stream as the service for sharing video files because of the word 'video,' but Stream is for hosting and streaming, not for secure file sharing with external partners, which requires a storage and sharing service like OneDrive.

How to eliminate wrong answers

Option A is wrong because Microsoft SharePoint is designed for team collaboration and document management within a site, not for ad-hoc sharing of a single large file with an external partner; it requires setting up a site and managing permissions, which is overkill for this scenario. Option B is wrong because Microsoft Teams is a chat-based collaboration platform that uses SharePoint or OneDrive for file storage; sharing a 2 GB file via Teams would still rely on underlying storage and is not optimized for direct external sharing without a Teams guest account. Option C is wrong because Microsoft Stream is a video hosting and management service for enterprise video content, not for sharing raw video files; it is designed for streaming and playback, not secure file download or external partner access.

Full explanation →

371

MCQmedium

A team wants to build a custom business app to track inventory with minimal custom code. They need a cloud-based database that can store structured data and is tightly integrated with the low-code app platform. Which Microsoft 365 service should they use as the database?

A.Microsoft Dataverse

B.Microsoft SharePoint Online list

C.Microsoft Excel Online

D.Microsoft Forms

AnswerA

Dataverse is the underlying data platform for Power Platform, providing a secure, scalable database for custom business apps.

Why this answer

Microsoft Dataverse (formerly Common Data Service) is the cloud-scale database that stores data used by Power Apps, Power Automate, and Dynamics 365. It provides a relational data store with built-in security, business logic, and integration. Power Apps can connect directly to Dataverse to create custom apps with minimal code.

SharePoint lists or Excel Online are less suitable for scalable business apps requiring relationships and business rules.

Full explanation →

372

MCQhard

An organization uses Microsoft 365 Copilot and wants to ensure that AI-generated content is automatically labeled with a sensitivity label. What should they configure?

A.Microsoft Defender for Cloud Apps session policies

B.Microsoft Intune app protection policies

C.Conditional Access policies in Microsoft Entra ID

D.Microsoft Purview auto-labeling policies

AnswerD

Auto-labeling policies can automatically apply sensitivity labels to content based on criteria.

Why this answer

Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on conditions, including Copilot-generated content. Options A, C, and D are incorrect because they do not handle automatic labeling of Copilot output.

Full explanation →

373

MCQmedium

A compliance administrator needs to automatically protect sensitive data by applying a 'Confidential' label that encrypts documents and restricts access to a specific user group. The label must be applied when a document containing a credit card number is saved in SharePoint. Which Microsoft Purview feature should be configured?

A.Retention labels

B.Sensitivity labels with auto-labeling

C.Data Loss Prevention (DLP) policies

D.Data classification service

AnswerB

Sensitivity labels can be configured with auto-labeling policies to automatically apply encryption and access controls when sensitive data like credit card numbers is detected in SharePoint documents.

Why this answer

Sensitivity labels with auto-labeling are the correct choice because they allow you to automatically apply a 'Confidential' label that encrypts documents and restricts access based on sensitive content (e.g., credit card numbers) when documents are saved in SharePoint. This feature uses conditions like sensitive information types to trigger label application, ensuring data protection at rest and in use.

Exam trap

The trap here is that candidates often confuse DLP policies with auto-labeling, but DLP policies only block or alert on data sharing, not apply labels or encryption, which is the core requirement for protecting data at rest.

How to eliminate wrong answers

Option A is wrong because retention labels are designed to manage data lifecycle (retention and deletion) and do not provide encryption or access restrictions. Option C is wrong because Data Loss Prevention (DLP) policies detect and prevent sharing of sensitive data but do not apply labels or encrypt documents; they enforce rules on data in motion. Option D is wrong because the data classification service identifies and classifies data but does not automatically apply labels or enforce protection actions like encryption.

Full explanation →

374

MCQmedium

A service owner is comparing Microsoft 365 capabilities and needs to avoid license waste when employees change roles. Microsoft 365 licensing, admin, or support concept is most relevant?

A.Microsoft Whiteboard

B.Microsoft Stream

C.Microsoft Forms

D.License assignments against current user requirements

AnswerD

Regular review helps reclaim or adjust licenses as roles change.

Why this answer

Option D is correct because the core principle of avoiding license waste when employees change roles is to ensure that license assignments are aligned with current user requirements. Microsoft 365 licensing is user-based, and when a user's role changes, their assigned license should be updated or reassigned to reflect their new responsibilities, preventing unused or inappropriate licenses from being consumed.

Exam trap

The trap here is that candidates may confuse specific Microsoft 365 service features (like Whiteboard, Stream, or Forms) with the administrative licensing concept, but the question explicitly asks for the licensing, admin, or support concept most relevant to avoiding waste, which is license assignment management.

How to eliminate wrong answers

Option A is wrong because Microsoft Whiteboard is a collaboration tool for visual brainstorming and has no direct relevance to license management or role-based license optimization. Option B is wrong because Microsoft Stream is a video service for enterprise content management and does not address the administrative task of assigning or reassigning licenses based on role changes. Option C is wrong because Microsoft Forms is a survey and data collection tool, not a licensing or admin concept for managing user entitlements.

Full explanation →

375

Multi-Selectmedium

A company is evaluating a move to the cloud. Which three of the following are advantages of using a public cloud model compared to a private cloud? (Choose three.)

Select 3 answers

.No capital expenditure for hardware

.Elastic scaling of resources on demand

.Provider-managed infrastructure maintenance

.Full control over physical security of data centers

.Guaranteed data residency in a specific geographic location

.Lower total cost for all long-term workloads

Why this answer

In a public cloud model, the cloud provider owns and manages the physical hardware, eliminating the need for the customer to make capital expenditures (CapEx) on servers, storage, and networking equipment. Public clouds offer elastic scaling, allowing resources like virtual machines or containers to be automatically provisioned or deprovisioned based on real-time demand, which is a core benefit of cloud computing. Provider-managed infrastructure maintenance means the cloud vendor handles all hardware patching, firmware updates, and physical security, offloading these operational responsibilities from the customer.

Exam trap

Microsoft often tests the misconception that public cloud always reduces costs for all workloads, but the trap is that long-term, predictable workloads can be more expensive in public cloud due to ongoing operational costs and lack of reserved instance optimization, while private cloud may offer lower TCO for such scenarios.

Full explanation →

Microsoft 365 Fundamentals MS-900 (MS-900) — Questions 301–375