Select Two (Multi-Select) Questions

High availability

Why it fails: High availability is a service-level outcome an architecture may deliver, not one of the five NIST essential characteristics, which are on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. It is tempting because resilient cloud platforms do advertise availability, but that belongs to design quality rather than the definition itself.

Reserved capacity

Why it fails: Reserved capacity is a commercial purchasing model for compute instances, not a NIST essential characteristic; the definition requires on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. It is tempting because reservations genuinely reduce cost for steady workloads, but provisioning economics sit outside the cloud definition.

Microsoft Stream

Why it fails: Microsoft Stream is a video hosting and sharing service, not a security or access control component. It stores and streams recordings and has no mechanism to evaluate device health or enforce conditional entry to Microsoft 365. Relying on Stream would do nothing to limit access to compliant devices, so it is incorrect.

Microsoft Forms

Why it fails: Microsoft Forms is a lightweight survey and form-building application used to collect user input, not evaluate device posture. It offers no capabilities for checking compliance status or blocking access to Microsoft 365 services based on device attributes. Selecting Forms would ignore the core requirement of restricting access to compliant devices, so it is incorrect.

Detects and blocks phishing attacks.

Why it fails: Phishing detection and blocking is a security function performed by Microsoft Defender for Office 365 and Exchange Online Protection through SafeLinks, SafeAttachments, and anti-spam filtering. Viva, however, is an employee experience platform focused on communication, insights, learning, and culture—not threat defense. Thus, this capability does not qualify as a Viva benefit, even though it is included in many Microsoft 365 enterprise subscriptions.

Backs up user data automatically.

Why it fails: Automatic backup of user data is a data protection and governance capability, provided by Microsoft 365 Backup, SharePoint/OneDrive version history, retention policies, or third-party backup services—not by Viva. Viva modules neither create nor manage backup copies; they focus on engagement, communication, and wellbeing. Consequently, this option describes a different Microsoft 365 workload and should not be chosen as a Viva benefit.

Scalability

Why it fails: Scalability refers to the ability of a system to handle increased load by adding or removing resources, but this process is often manual or requires pre-planning. Unlike elasticity, scalability does not inherently involve automatic adjustments based on real-time demand, nor does it imply a pay-per-use billing model. The scenario emphasizes both automatic scaling and usage-based pricing, which are defining attributes of elasticity, making scalability an incomplete answer.

High availability

Why it fails: High availability is focused on ensuring a system remains operational and accessible to users in the event of component failures, typically through redundancy and failover mechanisms. It does not directly address the dynamic scaling of resources or the pay-as-you-go billing model described in the scenario. Since the business's requirements center on variable resource usage and corresponding billing, high availability is unrelated to the core need.

On-demand self-service

Why it fails: On-demand self-service is a cloud characteristic where a consumer can unilaterally provision computing resources, such as virtual machines or storage, automatically without requiring human interaction with the service provider. While the company may be using this capability to scale VMs, the specific detail about paying only for hours used and scaling based on demand highlights billing and elasticity rather than the provisioning mechanism itself. The central focus of self-service is the 'no human interaction' aspect, not the metered billing or dynamic scaling described in the scenario.

Resource pooling

Why it fails: Resource pooling describes the provider's multi-tenant model, where computing resources are pooled to serve multiple customers, with physical and virtual resources dynamically assigned and reassigned according to demand. This characteristic gives rise to location independence, as customers typically do not control the exact resource location. However, the scenario's details about paying per hour and scaling VMs on demand do not illustrate resource pooling; they instead demonstrate metering and elasticity, which are customer-visible consumption traits rather than the provider's internal sharing architecture.

All subscription plans include the full desktop version of Office applications.

Why it fails: The claim that every Microsoft 365 plan bundles the full desktop Office suite is false. For example, Microsoft 365 Business Basic includes only Exchange Online, SharePoint, Teams, and the web/mobile versions of Office, while full desktop applications like Outlook and Word are included only in plans such as Business Standard, E3, or E5. Thus, the desktop apps are a differentiator between plan levels, not a universal inclusion across all subscriptions.

Plans can be upgraded or downgraded at any time without any restrictions.

Why it fails: While Microsoft 365 allows admin self-service upgrades between many eligible plans, downgrades are not unrestricted. A downgrade to a plan with fewer licenses or features usually requires manual license removal and often contacting support, and Microsoft may restrict changes when add-ons are attached or seat counts fall below certain thresholds. No provider offers unlimited, unrestrained plan switching at any time without consequences, so the phrase “without any restrictions” is inaccurate.

Enterprise plans are licensed on a per-user basis with a minimum of 5 seats.

Why it fails: Enterprise plans such as Microsoft 365 E3 and E5 are sold per-user, but there is no mandatory minimum of 5 licenses—you can subscribe a single user to an E5 license. The 5-seat minimum is a common misconception, and any plan with such a threshold would be unusual for Microsoft 365 enterprise offerings. Per-user licensing simply means the license count must match the number of assigned users.

Data Lifecycle Management (via sensitivity labels)

Why it fails: Data Lifecycle Management is a feature of Microsoft Purview that uses retention labels and auto-labeling policies to classify and manage data, but it is not a complete substitute for retention policies. While sensitivity labels can trigger retention actions, they also apply encryption, access control, and visual markings — none of which directly enforce automated deletion. Configuring Data Lifecycle Management requires per-label policies and does not provide the same breadth of automatic, workload-wide retention and deletion as retention policies. Therefore, while it assists in lifecycle management, it is not the primary solution required for GDPR compliance.

Audit (Standard)

Why it fails: Audit (Standard) in Microsoft Purview records user and admin activity, such as document view, edit, and send events, but it only captures metadata about 'who did what, when, and where.' It does not allow searching the actual content of personal data, nor does it provide the ability to export that content to fulfill a DSAR. While audit logs are useful for demonstrating compliance and investigating security events, they cannot meet GDPR obligations for data access or deletion. Thus, relying on Audit (Standard) alone would fail to address GDPR requirements, making it incorrect for this purpose.

Power Automate

Why it fails: Power Automate is a cloud-based automation platform that builds workflows (e.g., sending approval requests, copying files, or posting messages) triggered by events or schedules. It does not provide a task-centric user interface with checklists, due dates, or assignments; while it can act on tasks from other services, it is not itself a service for creating and managing tasks.

Microsoft Word

Why it fails: Microsoft Word is a word-processing application used for creating documents such as reports, letters, and resumes. It has no built-in task management model—no task fields, assignment, due-date tracking, or status workflows—so it cannot be used to create and manage tasks in a functional sense; any to-do list typed into a document is static text without dynamic task behavior.

SharePoint

Why it fails: SharePoint is a content management and collaboration platform for sites, document libraries, and lists; while a SharePoint list can be customized with a Title and a Completed column to mimic task tracking, it is not primarily a task management service. It lacks purpose-built task features such as assignments, due-date reminders, and My Day integration, and its task functionality requires substantial configuration.

Exchange Online mailbox

Why it fails: Exchange Online is an email hosting service, but it is entirely separate from the Microsoft 365 productivity apps. You can install and use Word, Excel, and Teams with just a valid subscription license and a local or Microsoft Entra ID account; email is an optional workload. An Exchange Online mailbox is only needed if you want cloud-hosted email, not for the core applications.

Persistent internet connectivity

Why it fails: After a one-time activation, Microsoft 365 Apps enter a cached license state that permits full offline usage for 30 to 180 days, depending on the edition. Periodic connectivity is required for license renewal and updates, but a persistent or always-on connection is not. The apps will even warn before reverting to reduced functionality during prolonged disconnection.

Microsoft Entra ID

Why it fails: Microsoft Entra ID (formerly Azure AD) is the cloud identity service, but it is not mandatory for all Microsoft 365 scenarios. Consumer subscriptions can activate using a Microsoft Account, and on-premises Active Directory can be synchronized via hybrid identity without requiring a separate Entra ID tenant. It is only required when you choose cloud-native identity management for your tenant.

Services are used by a single organization

Why it fails: Public cloud services are shared across many tenants on pooled infrastructure, not dedicated to one organisation. Single-organisation use is tempting because it correctly describes a private cloud deployment, where resources are provisioned exclusively for that one entity.

Scalability is limited to existing hardware

Why it fails: Public cloud scalability is effectively elastic, constrained by provider capacity and quotas rather than the customer's own hardware. It is tempting because limited scalability does describe on-premises or private deployments, where growth requires purchasing and installing additional physical resources.

Infrastructure is located on-premises

Why it fails: Public cloud infrastructure is owned and operated by the provider in the provider's datacentres, not on the customer's premises. On-premises hosting is tempting because it describes the private cloud model, where the organisation owns and controls the hardware itself.

Mobile device management

Why it fails: Mobile device management enrols and configures devices, and is delivered by Microsoft Intune, not Microsoft Entra ID. Tempting because Entra ID registers devices and enables conditional access, it would be correct when the requirement is enforcing compliance policies, configuration profiles or remote wipe on enrolled endpoints.

Data Loss Prevention policies

Why it fails: Data Loss Prevention policies belong to Microsoft Purview, which inspects and protects sensitive content across Exchange, SharePoint and endpoints; Microsoft Entra ID governs identities, authentication and conditional access. It tempts because both are Microsoft 365 compliance-adjacent services, but DLP would be the answer for a question about classifying or blocking sensitive data.

Sensitivity labels

Why it fails: Sensitivity labels classify and protect content in Microsoft 365 workloads such as SharePoint, Exchange and Teams, and are configured through Microsoft Purview, not Microsoft Entra ID. Tempting because both govern data access, it would be correct when the requirement is applying encryption or marking documents and emails according to their confidentiality.

Manage user passwords and enforce multi-factor authentication

Why it fails: Managing user passwords and enforcing multi-factor authentication are identity and access management functions performed by Microsoft Entra ID (formerly Azure Active Directory), including Conditional Access policies. These activities govern who logs in and how authentication occurs, but they do not classify, retain, or discover data. Therefore, password management and MFA enforcement are not capabilities of Microsoft Purview.

Monitor network traffic to prevent DDoS attacks

Why it fails: Monitoring network traffic to mitigate distributed denial-of-service (DDoS) attacks is handled by network security services like Azure DDoS Protection, which operates at the infrastructure and network layers. Purview, in contrast, operates at the data and information governance layer, focusing on sensitivity, retention, and compliance. It has no visibility into or control over packet-level network traffic, so this option is not a Purview capability.

Provide anti-malware and phishing protection in email

Why it fails: Anti-malware and phishing protection for email are provided by Exchange Online Protection and Microsoft Defender for Office 365, which inspect message headers, attachments, and URLs before delivery. Purview does not filter inbound email threats; its role begins after data is stored—applying labels, retention, and eDiscovery. Thus, real-time threat protection in email lies outside Purview's scope.

Microsoft Power BI Pro

Why it fails: Microsoft Power BI Pro is not part of Microsoft 365 Business Basic; it is a standalone business analytics service that requires a separate Power BI Pro license or a Microsoft 365 plan that explicitly includes it, such as Power BI Premium per user. Although it integrates with Microsoft 365 data sources, the subscription cost is additional and is not bundled with the core Business Basic productivity suite.

Microsoft Project Online Plan 3

Why it fails: Microsoft Project Online Plan 3 is a dedicated project and portfolio management solution that is sold as a separate subscription, not included in Microsoft 365 Business Basic. It requires its own license and contains advanced features such as Gantt charts, resource management, and timesheets, while Business Basic users would need to purchase this add-on independently to access those capabilities.

Microsoft Word (desktop app)

Why it fails: The desktop version of Microsoft Word is not included in Microsoft 365 Business Basic; this plan provides only the web-based and mobile editions of Office applications, which offer core editing features but lack advanced offline functionality found in the full desktop client. To install Microsoft Word on a PC or Mac, users must subscribe to Microsoft 365 Business Standard or a similar plan that includes the Office desktop applications.

On-demand self-service

Why it fails: On-demand self-service allows a user to provision computing capabilities—such as VMs or storage—automatically, without needing manual intervention from the cloud provider. Although the company can scale its IaaS environment, the scenario emphasizes automatic elastic scaling triggered by traffic, not a user-initiated provisioning action, so this characteristic is not the one being highlighted.

Resource pooling

Why it fails: Resource pooling refers to the cloud provider's use of a multi-tenant model where compute, storage, and network resources are pooled and dynamically assigned to serve multiple consumers. The scenario describes a single company's scaling of its own VMs and does not illustrate shared infrastructure or multi-tenancy, making resource pooling an incorrect characterization of the situation.

Microsoft Defender for Cloud Apps

Why it fails: Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides real-time monitoring, conditional access control, and shadow IT discovery for sanctioned and unsanctioned cloud services. It operates under the Microsoft Defender security stack, not Microsoft Purview, so its focus is on session-level threat protection rather than compliance tasks like retention, classification, or data governance.

Microsoft Entra ID Protection

Why it fails: Microsoft Entra ID Protection is an identity security feature that detects and responds to identity-based risks including leaked credentials, unusual sign-in patterns, and compromised accounts. It enforces conditional access policies such as requiring multi-factor authentication or blocking suspicious sign-ins, but it operates within Microsoft Entra (formerly Azure Active Directory), not as a Microsoft Purview compliance feature for data governance and protection.

Microsoft Defender XDR

Why it fails: Microsoft Defender XDR, also known as Microsoft 365 Defender, is a unified security operations suite that integrates signals across endpoints, emails, identities, and cloud apps to detect, investigate, and remediate sophisticated attacks. Its purpose is threat hunting and incident response in the security domain, completely distinct from compliance capabilities like data lifecycle management, eDiscovery, and DLP that reside in the Microsoft Purview compliance portal.

Microsoft Intune

Why it fails: Microsoft Intune is a unified endpoint management service focused on device enrollment, compliance policies, and configuration profiles, including mobile device management (MDM) and mobile application management (MAM). While its app protection policies can restrict actions like save-as or copy-paste within managed apps, those restrictions are application-level controls, not content-aware classification or DLP enforcement. Intune is therefore incorrect for this question because it does not scan data payloads for sensitive information or apply data labels; its primary role is managing device and app lifecycle.

Microsoft Entra ID

Why it fails: Microsoft Entra ID (formerly Azure AD) is an identity and access management service that authenticates users and provides conditional access policies based on user, device, location, and risk signals. It never inspects file content or emails and cannot apply or enforce data classification labels or DLP actions; its role is to grant or deny access tokens, not to govern data after access is granted. Even though it can broker session controls with Defender for Cloud Apps, Entra ID itself is not a data classification or DLP service, making it a wrong answer.

Downgrade to Microsoft 365 E1 and add the features

Why it fails: Downgrading to Microsoft 365 E1 would actually remove the required DLP capability because E1 does not support the Microsoft Purview DLP add-on. E1 is a much lower licensing tier intended for basic email and collaboration, and it lacks the security and compliance features that are already present in E3, such as core eDiscovery, sensitivity labels, and DLP prerequisites. Even if you attempted to 'add the features' later, Microsoft does not offer a DLP add-on for E1, so this decision would not satisfy the requirement and would cause a loss of functionality.

Switch to Microsoft 365 Business Premium

Why it fails: Switching to Microsoft 365 Business Premium is not feasible for a 5,000-user organization because that plan is capped at 300 users. Business Premium is designed for small and medium-sized businesses, and it cannot scale to an enterprise-sized user base. Even though Business Premium includes some Defender and DLP-like capabilities, the strict 300-user licensing limit makes it impossible to license all 5,000 users, so this option fails as a practical solution.

Customers manage the operating system patching.

Why it fails: In SaaS, the customer does not manage operating system patching because it has no administrative access to the underlying servers or OS. The provider is responsible for patching, updating, and securing the OS, runtime, and infrastructure as part of the subscribed service. Attempting to patch an OS would require server-level access, which is not available in a true SaaS offering—this is a common responsibility in IaaS, where the customer controls the VM and its OS.

Customers deploy their own runtime environment.

Why it fails: In SaaS, customers do not deploy their own runtime environment because the runtime—such as the execution engine, libraries, and middleware—is preinstalled and maintained by the provider. A customer deploying or configuring a runtime would imply they have platform-level control, which is characteristic of PaaS or IaaS, not SaaS. The SaaS model abstracts away the entire environment so that customers only interact with the application itself.

Exchange anti-malware policy

Why it fails: Exchange anti-malware policies are security filters that scan inbound and outbound email messages for malicious software in transit, protecting the mail flow within Exchange Online. They do not provide a shared repository for project documents, nor do they support co-authoring or version control for Office files. While a project team may rely on email for communication, this policy is not a collaboration workspace for surveys or related deliverables.

Microsoft Purview eDiscovery case

Why it fails: A Microsoft Purview eDiscovery case is used to identify, hold, and export content as part of legal or regulatory investigations, with features like legal hold and search across mailboxes and sites. It is not a collaborative workspace for project teams to create or co-author Office files related to surveys. Using an eDiscovery case for this purpose would be both functionally inappropriate and a misuse of compliance tooling.

Block all external access in Teams admin center to prevent guests from joining.

Why it fails: Blocking external access in Teams admin center disables federation with other organizations, meaning users from different domains cannot find and communicate with users in Contoso. However, guests are invited via Microsoft Entra ID Business-to-Business (B2B) collaboration, which is a distinct identity mechanism that grants access to specific teams. Therefore, turning off external access will not prevent guest users from seeing or joining teams; instead, it only blocks cross-tenant communication.

Configure external sharing settings in SharePoint admin center to limit guest access.

Why it fails: Configuring external sharing settings in the SharePoint admin center governs how users can share sites and documents with people outside the organization, such as anonymous sharing or inviting external users as site members. This setting applies to SharePoint and OneDrive file-level collaboration, not to the Teams app experience or the visibility of team channels. The requirement about guests seeing teams they are not members of is managed within the Teams admin center, not via SharePoint's external sharing controls.

Enable external access in Teams admin center to allow guests to communicate with internal users.

Why it fails: Enabling external access in the Teams admin center is used to allow your users to chat and set up meetings with users in other Microsoft Entra ID tenants; this is known as federation and does not create guest accounts in Contoso. Guests are identity records added to your tenant, and they already have the ability to communicate with internal users once they are added to a team. This setting would broaden your organization's communication boundary rather than restrict guest visibility, so it does not address the stated requirement.