How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 12 Refer to the Exhibit Practice Questions scenario questions for the MS-900 exam, each with detailed explanations and wrong-answer analysis.

How should I approach MS-900 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft 365 Fundamentals MS-900 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise Microsoft 365 Fundamentals MS-900 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

MS-900

exam code

Microsoft

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

Refer to the exhibit. The JSON snippet represents a Microsoft Purview sensitivity label policy. An administrator wants to prevent external users from accessing documents labeled 'Highly Confidential'. Which element in the policy achieves this?

Exhibit

{
  "name": "CompanyPolicy",
  "description": "Block external sharing for sensitive data",
  "labels": ["Highly Confidential"],
  "actions": {
    "blockAccess": true,
    "encrypt": true,
    "applyWatermark": true
  }
}

A
blockAccess
blockAccess is set to true, preventing unauthorized access.
B
encrypt
Why wrong: encrypt deals with encryption, not access control.
C
applyWatermark
Why wrong: applyWatermark adds a watermark.
D
labels
Why wrong: labels is the label reference, not an action.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. An admin creates a Microsoft Purview Data Loss Prevention (DLP) policy rule as shown. When will the rule block access?

Exhibit

Refer to the exhibit.
```json
{
  "version": "1.0",
  "rules": [
    {
      "name": "Block sensitive data sharing",
      "condition": {
        "sensitiveInformationTypes": [
          {
            "id": "Credit Card Number",
            "confidenceLevel": "high"
          }
        ]
      },
      "actions": {
        "blockAccess": true,
        "notifyUser": true
      }
    }
  ]
}
```

A
When a credit card number is detected with high confidence
The condition specifies credit card number with high confidence.
B
When the document is shared externally
Why wrong: The condition is based on content, not sharing context.
C
When any sensitive information type is detected
Why wrong: Only credit card numbers with high confidence trigger the rule.
D
Never, because the rule is not applied to any location
Why wrong: The rule is defined but location scope is not shown; typically it's applied.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

Refer to the exhibit. A device management report from Microsoft Intune shows a device with non-compliant status. Which action should the administrator take to bring the device into compliance?

Exhibit

Device Name: LAPTOP-1234
Compliance State: Non-compliant
Last Check-in: 2026-03-10T14:30:00Z
Primary User: user@contoso.com
OS: Windows 11
Threat Level: High
Jailbroken: No
Encryption: Not Encrypted

A
Enable BitLocker encryption
The device is not encrypted, so enabling BitLocker will address the compliance issue.
B
Force a check-in
Why wrong: The device checked in recently; check-in is not the issue.
C
Remediate jailbreak status
Why wrong: Jailbreak is not applicable to Windows devices.
D
Install antivirus software
Why wrong: Antivirus may be needed, but the specific non-compliance is encryption.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

Refer to the exhibit. The ARM template is used to deploy an Azure resource. Which Microsoft 365 service is most likely to use this template for storing data?

Exhibit

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2021-02-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[resourceGroup().location]",
      "kind": "StorageV2",
      "sku": {
        "name": "Standard_LRS"
      }
    }
  ]
}

A
Microsoft Teams
Why wrong: Microsoft Teams uses SharePoint for files.
B
Exchange Online
Why wrong: Exchange Online uses its own store.
C
SharePoint Online
SharePoint Online uses Azure Storage for its content databases.
D
OneDrive for Business
Why wrong: OneDrive for Business also uses SharePoint.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

Refer to the exhibit. You are reviewing a role definition in Microsoft Purview compliance portal. Which actions can a user assigned this role perform?

Exhibit

{
  "roleName": "Compliance Administrator",
  "permissions": [
    "microsoft.office365.securityComplianceCenter/allEntities/allTasks",
    "microsoft.office365.protectionCenter/allEntities/allTasks"
  ]
}

A
Manage compliance and data governance tasks in Microsoft Purview
The role has full permissions in the Security & Compliance Center and Protection Center, which are part of Purview.
B
Manage user accounts in Microsoft Entra ID
Why wrong: This role is scoped to compliance and protection, not identity management.
C
Manage security settings in Microsoft Defender XDR
Why wrong: The role is for compliance and protection, not security settings.
D
View only compliance reports without making changes
Why wrong: The role includes 'allTasks', which means full control, not read-only.

Full breakdown with real-world context →

Question 6easymultiple choice

Full question →

Refer to the exhibit. You have a Conditional Access policy as shown. A user reports they cannot access Exchange Online from a non-compliant device. What is the most likely reason?

Exhibit

Refer to the exhibit.
```json
{
  "displayName": "Block access for non-Microsoft Entra ID users",
  "state": "enabled",
  "conditions": {
    "applications": {
      "includeApplications": ["Office365"]
    },
    "users": {
      "includeUsers": ["All"]
    }
  },
  "grantControls": {
    "builtInControls": ["mfa", "compliantDevice"]
  }
}
```

A
The device is not marked as compliant
The grant control requires a compliant device.
B
The policy only applies to administrators
Why wrong: The policy includes all users.
C
The user has not registered for MFA
Why wrong: MFA is required, but non-compliant device is the immediate issue.
D
The policy is disabled
Why wrong: The policy state is enabled.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud Apps access policy configuration. What does this policy do?

Exhibit

{
  "IsEnabled": true,
  "Urls": ["https://contoso.sharepoint.com/sites/ProjectX"],
  "BlockDownload": true,
  "AccessType": "Block",
  "IPRange": ["192.168.1.0/24"]
}

A
Allows access but prevents downloads from the specified IP range
Why wrong: Access is blocked entirely, not just downloads.
B
Allows access to the SharePoint site only from the specified IP range
Why wrong: The policy is set to 'Block', not 'Allow'.
C
Blocks access from the specified IP range to the SharePoint site and prevents downloads
The policy blocks access from the IP range and blocks downloads.
D
Disables the policy for the SharePoint site
Why wrong: The 'IsEnabled' is true, so the policy is active.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

Refer to the exhibit. A JSON snippet from a Microsoft Purview compliance policy. What is the effect of this policy when applied to a document?

Exhibit

{
  "appliedIntents": ["encrypt", "watermark"],
  "sensitivityLabelId": "S12345",
  "encryption": {
    "encryptedWith": "Microsoft Purview",
    "protectionEnabled": true
  },
  "watermark": {
    "text": "CONFIDENTIAL",
    "visible": true
  }
}

A
It encrypts the document and adds a watermark.
Both intents are present and enabled.
B
It prevents any sharing of the document.
Why wrong: No sharing restriction is defined.
C
It only adds a watermark.
Why wrong: Both are applied.
D
It only encrypts the document.
Why wrong: Both encrypt and watermark are applied.

Full breakdown with real-world context →

Question 9easymultiple choice

Full question →

Refer to the exhibit. The PowerShell script retrieves compliance tags from Microsoft Purview. What does the script do?

Exhibit

Refer to the exhibit.

$policies = Get-ComplianceTag
foreach ($policy in $policies) {
    if ($policy.RetentionAction -eq "Delete") {
        Write-Host "Policy $($policy.Name) will delete data after $($policy.RetentionDuration) days"
    }
}

A
Changes the retention action from Delete to Archive
Why wrong: The script only reads, not modifies.
B
Deletes compliance tags that have a Delete retention action
Why wrong: It only writes to console, does not delete.
C
Outputs the name and retention duration for compliance tags that delete data
The script filters tags with Delete action and outputs name and duration.
D
Lists all compliance tags and their retention actions
Why wrong: It only outputs tags with delete action.

Full breakdown with real-world context →

Question 10mediummultiple choice

Full question →

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. The AppId 00000003-0000-0ff1-ce00-000000000000 corresponds to Microsoft Graph. The policy requires MFA for all users accessing Microsoft Graph. However, users report that they are not prompted for MFA when using Microsoft Teams. What is the most likely reason?

Exhibit

Refer to the exhibit.

```xml
<Policy Id="Contoso-ConditionalAccess">
  <Conditions>
    <Users>
      <Include>
        <AllUsers></AllUsers>
      </Include>
    </Users>
    <Applications>
      <Include>
        <AppId>00000003-0000-0ff1-ce00-000000000000</AppId>
      </Include>
    </Applications>
  </Conditions>
  <GrantControls>
    <RequireMFA>true</RequireMFA>
  </GrantControls>
</Policy>
```

A
The policy applies only to Microsoft Graph, not to the Teams service itself.
Teams uses multiple app IDs; the policy targets only Graph, so Teams may not trigger MFA.
B
The policy is not enabled.
Why wrong: The exhibit shows a policy definition, but we don't know if it's enabled; however, the most likely reason is the app mismatch.
C
The policy should include the app ID for Office 365 Exchange Online.
Why wrong: Exchange Online is not the issue.
D
The GrantControls should be set to RequireMFA for all resources.
Why wrong: The policy is correctly configured for Graph.

Full breakdown with real-world context →

Question 11mediummultiple choice

Full question →

Refer to the exhibit. A compliance admin runs the PowerShell command. What is the purpose of this command?

Exhibit

Security & Compliance PowerShell:
Get-ComplianceTag | Where-Object {$_.RetentionAction -eq "KeepAndDelete" -and $_.RetentionDuration -gt 365}

A
To find tags that keep and then delete content after more than 365 days.
KeepAndDelete means keep for a period then delete; duration >365 days.
B
To find tags that require a review after 365 days.
Why wrong: No review action is involved.
C
To find tags that delete content after more than 365 days.
Why wrong: The action is KeepAndDelete, not just Delete.
D
To find tags that keep content indefinitely.
Why wrong: The filter requires a duration greater than 365, not indefinite.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

Refer to the exhibit. A SharePoint admin is reviewing a policy JSON snippet. Which statement accurately describes the effect of this policy?

Exhibit

{
  "policy": {
    "name": "Block External Sharing",
    "type": "SharePoint Online Sharing Policy",
    "sharingCapability": "Disabled",
    "allowExternalSharing": false,
    "externalUserExpirationInDays": 30
  }
}

A
External sharing is allowed only for existing guests who expire in 30 days.
Why wrong: External sharing is disabled, so no guests can be added.
B
External sharing is allowed but guests expire after 30 days.
Why wrong: External sharing is disabled, not allowed.
C
External sharing is allowed but only for users in the same tenant.
Why wrong: External sharing is disabled entirely.
D
External sharing is completely disabled.
The policy sets sharingCapability to Disabled and allowExternalSharing to false.

Full breakdown with real-world context →

These MS-900 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style MS-900 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related MS-900 topic practice pages

Describe Microsoft 365 apps and services practice questions

Describe Microsoft 365 pricing, licensing, and support practice questions

Describe cloud concepts practice questions

Describe security, compliance, privacy, and trust in Microsoft 365 practice questions

Describe Microsoft 365 pricing and support practice questions

MS-900 fundamentals practice questions

MS-900 scenario practice questions

MS-900 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. The JSON snippet represents a Microsoft Purview sensitivity label policy. An administrator wants to prevent external users from accessing documents labeled 'Highly Confidential'. Which element in the policy achieves this?

Exhibit

Refer to the exhibit. An admin creates a Microsoft Purview Data Loss Prevention (DLP) policy rule as shown. When will the rule block access?

Exhibit

Refer to the exhibit. A device management report from Microsoft Intune shows a device with non-compliant status. Which action should the administrator take to bring the device into compliance?

Exhibit

Refer to the exhibit. The ARM template is used to deploy an Azure resource. Which Microsoft 365 service is most likely to use this template for storing data?

Exhibit

Refer to the exhibit. You are reviewing a role definition in Microsoft Purview compliance portal. Which actions can a user assigned this role perform?

Exhibit

Refer to the exhibit. You have a Conditional Access policy as shown. A user reports they cannot access Exchange Online from a non-compliant device. What is the most likely reason?

Exhibit

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud Apps access policy configuration. What does this policy do?

Exhibit

Refer to the exhibit. A JSON snippet from a Microsoft Purview compliance policy. What is the effect of this policy when applied to a document?

Exhibit

Refer to the exhibit. The PowerShell script retrieves compliance tags from Microsoft Purview. What does the script do?

Exhibit

Exhibit

Refer to the exhibit. A compliance admin runs the PowerShell command. What is the purpose of this command?

Exhibit

Refer to the exhibit. A SharePoint admin is reviewing a policy JSON snippet. Which statement accurately describes the effect of this policy?

Exhibit