MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
During a Microsoft 365 planning workshop, show security recommendations and a score for Microsoft 365 posture. Microsoft security, identity, or compliance capability should it use?
⚠ Common exam trap
Many candidates confuse Microsoft Secure Score with other Microsoft 365 tools that have 'score' or 'recommendations' in their names, but only Secure Score is specifically designed for security posture assessment and scoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Secure Score
Microsoft Secure Score is the correct tool because it provides a numerical score and actionable security recommendations based on your tenant's security posture. It analyzes configurations across Microsoft 365 services (e.g., Exchange Online, Microsoft Entra ID, Intune) and suggests improvements to reduce risk, directly matching the workshop requirement for showing recommendations and a score.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Secure Score
Why this is correct
Microsoft Secure Score (available in the Microsoft 365 Defender portal) assigns a numeric score based on how closely the tenant's security configurations match recommended baselines across identities, devices, apps, and email. Its improvement actions include both the maximum attainable points and a list of controls to remediate, making it the right tool during a planning workshop to evaluate the organization's current security posture and prioritize remediation. It is specifically designed to assess and increase security, unlike the other options.
- ✗
Microsoft Forms
Why it's wrong here
Microsoft Forms is a data-collection service for building surveys, quizzes, and polls; it does not provide any security assessment or compliance monitoring of the tenant itself. While responses can be governed by broader Microsoft 365 data-loss-prevention policies, the tool has no capability to produce a security score, recommend hardening actions, or evaluate configuration baselines. Therefore, it cannot be used to show or improve an organization's security posture.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner is a collaboration and task-management application that organizes work into plans, buckets, and tasks; it is not connected to security configuration or threat telemetry. Although you could use Planner to manually track security remediation work items, it does not analyze endpoint, identity, or app configurations and provides no automated security scoring or compliance insights. Its purpose is productivity, not security evaluation.
- ✗
Microsoft Stream
Why it's wrong here
Microsoft Stream is an enterprise video hosting and sharing service, primarily designed for storing, processing, and playing video content. Stream videos can be protected by Microsoft 365 retention labels and DLP rules, but the platform itself exposes no security-scoring dashboards or compliance posture assessments. It cannot generate recommendations or a quantitative security metric, so it is irrelevant to a security-focused planning session.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID (Azure AD) in M365
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.