MS-900 Describe Microsoft 365 apps and services Practice Question
Contoso Ltd. is a global manufacturing company with 10,000 users. They are deploying Microsoft 365 E5 and require: (1) All Microsoft 365 data must be encrypted at rest and in transit using customer-managed keys; (2) Email must be archived for 10 years; (3) Users must be able to access files offline on mobile devices and sync changes when online; (4) The IT team must monitor and respond to threats across email, endpoints, and identities from a single console. You need to recommend the appropriate Microsoft 365 services. Which combination should you choose?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Purview Customer Key (which encrypts all data at rest with customer-managed keys) with Double Key Encryption (which only protects a subset of data) or Azure Information Protection (which is a labeling solution, not encryption at rest).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Customer Key, Exchange Online Archiving, OneDrive, Microsoft Defender XDR
Microsoft Purview Customer Key provides customer-managed encryption keys for data at rest in Microsoft 365, meeting the first requirement. Exchange Online Archiving with a 10-year retention policy satisfies the email archiving requirement. OneDrive enables offline file access on mobile devices with sync capabilities. Microsoft Defender XDR (Extended Detection and Response) offers a unified console to monitor and respond to threats across email, endpoints, and identities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Double Key Encryption, Exchange Online Archiving, SharePoint Online, Microsoft Sentinel
Why it's wrong here
Microsoft Purview Double Key Encryption is a specialized feature for protecting specific files or emails with a key you hold, not a tenant-wide encryption solution for all data at rest, so it doesn't satisfy a general encryption-at-rest requirement. SharePoint Online can sync files offline through OneDrive sync client, but this requires per-library manual setup and is less streamlined than OneDrive for all users. Microsoft Sentinel is a cloud-native SIEM/SOAR that ingests logs and provides threat detection across cloud resources, but it is not a unified endpoint, email, and identity threat response console like Microsoft Defender XDR.
- ✓
Microsoft Purview Customer Key, Exchange Online Archiving, OneDrive, Microsoft Defender XDR
Why this is correct
Microsoft Purview Customer Key gives the tenant control over the root encryption keys that encrypt data at rest across Microsoft 365 services, meeting a strict encryption-at-rest requirement. Exchange Online Archiving provides unlimited archiving and supports retention policies with Preservation Lock that can be configured for 10 years, satisfying long-term regulatory retention. OneDrive for Business offers automatic offline synchronization for user files without manual per-library configuration. Microsoft Defender XDR unifies signals from endpoints, email, identity, and cloud apps into a single incident queue, providing the needed unified threat response and monitoring.
- ✗
Azure Information Protection, Exchange Online Archiving, Windows 365, Microsoft Defender for Endpoint
Why it's wrong here
Azure Information Protection (now part of Microsoft Purview Information Protection) focuses on classifying and labeling content with sensitivity labels, but it does not provide customer-managed encryption keys for data at rest across the entire tenant like Customer Key does. Windows 365 delivers cloud PCs streamed to any device, but it does not provide offline file synchronization; files are on the cloud PC and require connectivity (or offline files features are separate). Microsoft Defender for Endpoint protects only endpoints, so it misses email and identity threats that would be covered by Defender XDR's unified console.
- ✗
Microsoft Purview Customer Key, Exchange Online In-Place Hold, OneDrive, Microsoft 365 Defender for Cloud Apps
Why it's wrong here
Microsoft Purview Customer Key correctly provides customer-controlled encryption for data at rest, but Exchange Online In-Place Hold is a litigation hold feature designed to preserve mailbox items for eDiscovery or legal cases, not a proactive archiving solution with a 10-year retention policy—Exchange Online Archiving would be the fit. Microsoft 365 Defender for Cloud Apps (Defender for Cloud Apps) is a cloud access security broker that focuses on shadow IT and SaaS app risks, not a unified threat response console that covers endpoints, email, and identity alongside cloud apps. Thus the combination lacks the long-term archiving capability and unified monitoring scope the requirements demand.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
This MS-900 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.