How many Troubleshooting Scenario Questions questions are on this page?

This page has 5 Troubleshooting Scenario Questions scenario questions for the MS-900 exam, each with detailed explanations and wrong-answer analysis.

How should I approach MS-900 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft 365 Fundamentals MS-900 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Microsoft 365 Fundamentals MS-900 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

MS-900

exam code

Microsoft

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummulti select

Full question →

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

A
Threat Explorer in Microsoft Defender for Office 365
Threat Explorer supports investigation of email threats, campaigns, and delivery actions.
B
It replaces the need for identity and access management
Why wrong: Compliance controls complement identity controls rather than replacing them.
C
It requires every document to be made public
Why wrong: Security and compliance controls do not require public access.
D
The policy should be tested with a limited group before broad rollout
Testing reduces the risk of blocking legitimate work or applying unintended restrictions.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

An administrator needs to monitor and investigate potential data breaches by reviewing detailed records of file access and sharing activities across Microsoft 365. They require a centralized report showing who accessed what, from where, and any unusual patterns. Which tool should they use?

A
Microsoft 365 Defender
Why wrong: Microsoft 365 Defender is an extended detection and response (XDR) platform that correlates signals from endpoints, email, identities, and cloud apps to detect and automatically respond to active attacks. However, it does not provide the granular, per-user audit trail of activities such as file access, permission changes, or sharing events that is needed to reconstruct a data breach timeline. Its alerts and incident telemetry complement an investigation but do not substitute for the historical activity records found in Purview Audit.
B
Microsoft Purview Audit (Standard)
Microsoft Purview Audit (Standard) is the correct tool because it records timestamped events for user and admin actions across Exchange, SharePoint, OneDrive, Teams, and Azure AD. Investigators can query the unified audit log to identify exactly when a file was accessed, downloaded, shared, or deleted and which account performed the action. This historical, activity-level evidence is essential for monitoring, triaging, and thoroughly investigating a potential data breach, with default retention of 90 days for standard events.
C
Microsoft Purview eDiscovery
Why wrong: Microsoft Purview eDiscovery is built for legal and regulatory workflows, such as content search, legal hold, and exporting documents as evidence in litigation. It does not continuously capture or display user activity events like who opened or shared a file over time; instead, it locates and preserves existing content at rest. Therefore, while eDiscovery may be used after a breach is detected to preserve trial evidence, it is not the mechanism for proactively monitoring or investigating suspicious activities, as it has no audit timeline.
D
Microsoft Secure Score
Why wrong: Microsoft Secure Score is a configuration-based security posture metric that recommends and scores improvements like enforcing MFA, enabling conditional access, and reducing attack surface. It tracks whether security controls are implemented, not what user or admin actions occurred over time, so it contains no log data to review when investigating a breach. In short, Secure Score answers 'how secure is my tenant configuration?' but cannot answer 'what did a user access or share?'—those details live in audit logs.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

A company currently has Microsoft 365 E5 licenses for all users. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a potential security incident. Which of the following capabilities is already included in their existing license?

A
Microsoft Defender for Microsoft 365 Plan 1
Why wrong: Microsoft Defender for Microsoft 365 Plan 1 provides essential email and collaboration security such as anti-phishing, safe attachments, and safe links, but it lacks the advanced hunting capability built into the full Microsoft 365 Defender suite. It cannot run raw Kusto Query Language (KQL) queries across emails, endpoints, or identity telemetry, and therefore cannot perform the cross-domain incident investigation described in the scenario. Plan 1 is a foundation, not a hunting platform.
B
Microsoft Entra ID Premium P1
Why wrong: Microsoft Entra ID Premium P1 adds identity governance features like Conditional Access, MFA, and self-service password reset, but it is not a security analytics or threat-hunting product. While it strengthens access control and identity posture, it offers no query interface for investigating raw telemetry or correlating events across your tenant. Threat hunting requires dedicated security data stores, not identity policy engines.
C
Microsoft 365 Defender (including advanced hunting)
Microsoft 365 Defender (including advanced hunting) is the correct choice because E5 includes the full unified security operations experience, enabling investigators to use KQL to query over email, endpoints, identities, and applications in one portal. Advanced hunting allows proactive, multi-domain searches for indicators of compromise, exactly what is needed when hunting for a cross-domain attack. This capability is exclusive to the combined Microsoft 365 Defender product, not to individual add-ons.
D
Microsoft Cloud App Security
Why wrong: Microsoft Cloud App Security (now Defender for Cloud Apps) is centered on Shadow IT discovery and applying access and session policies to SaaS apps, rather than on deep threat hunting. It can generate alerts and provide app risk scores, but it lacks the unified, advanced hunting schema that spans email and endpoint telemetry. Its role is more about cloud governance and app control, which is not the primary tool for investigating a potential incident across multiple domains.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

A multinational organization with 500 users currently has Microsoft 365 E3 licenses. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a security incident. They also need the ability to automatically isolate infected endpoints. What is the most cost-effective licensing addition?

A
Microsoft 365 E5 Security
Microsoft 365 E5 Security is a targeted add-on for organizations on Microsoft 365 E3 that unlocks the full Microsoft 365 Defender stack. This includes Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity, and Defender for Cloud Apps, enabling advanced threat hunting via KQL, automated investigation and response, and automated endpoint isolation. It provides comprehensive security operations capabilities without the extra cost of non-security features found in the full E5 suite.
B
Microsoft 365 E5
Why wrong: Selecting Microsoft 365 E5 would upgrade the entire tenant to the premium suite, which is substantially more expensive than the E5 Security add-on. While full E5 does include all the E5 Security components, it also bundles E5 Compliance, Power BI Pro, and telephony features that are not required for the stated threat-hunting and endpoint-isolation needs. This over-provisioning increases license costs without delivering any additional security benefit beyond what the add-on already provides.
C
Microsoft 365 E5 Compliance
Why wrong: Microsoft 365 E5 Compliance is designed for information governance, eDiscovery, legal hold, audit, and retention policies, not for active threat hunting or endpoint response. Its capabilities such as communication compliance and insider risk management address regulatory and investigation workflows, whereas the requested scenario requires Defender's real-time detection and automated endpoint isolation. Relying on Compliance for this need would leave the organization without the necessary incident response and threat-hunting tools.
D
Enterprise Mobility + Security (EMS) E5
Why wrong: Incorrect. EMS E5 is an older bundle that includes Microsoft Entra ID P2 and Intune but does not include Microsoft 365 Defender for threat hunting. It is no longer the recommended add-on for this purpose.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

An administrator is reviewing a request from users who need to let support staff troubleshoot without tenant-wide change permissions. Microsoft 365 licensing, admin, or support concept is most relevant?

A
Microsoft Stream
Why wrong: Stream hosts video content and does not address this licensing or support need.
B
Assign least-privileged support or reader roles
Support roles should be scoped to the minimum access needed.
C
Microsoft Forms
Why wrong: Forms collects survey responses and does not meet this requirement.
D
Microsoft Whiteboard
Why wrong: Whiteboard is for visual collaboration, not this licensing or admin requirement.

Full breakdown with real-world context →

These MS-900 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style MS-900 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related MS-900 topic practice pages

Describe Microsoft 365 apps and services practice questions

Describe Microsoft 365 pricing, licensing, and support practice questions

Describe cloud concepts practice questions

Describe security, compliance, privacy, and trust in Microsoft 365 practice questions

MS-900 fundamentals practice questions

MS-900 scenario practice questions

MS-900 troubleshooting practice questions

Practice scenarios

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

An administrator needs to monitor and investigate potential data breaches by reviewing detailed records of file access and sharing activities across Microsoft 365. They require a centralized report showing who accessed what, from where, and any unusual patterns. Which tool should they use?

A company currently has Microsoft 365 E5 licenses for all users. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a potential security incident. Which of the following capabilities is already included in their existing license?

An administrator is reviewing a request from users who need to let support staff troubleshoot without tenant-wide change permissions. Microsoft 365 licensing, admin, or support concept is most relevant?