How many Troubleshooting Scenario Questions questions are on this page?

This page has 12 Troubleshooting Scenario Questions scenario questions for the MS-900 exam, each with detailed explanations and wrong-answer analysis.

How should I approach MS-900 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft 365 Fundamentals MS-900 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Microsoft 365 Fundamentals MS-900 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

MS-900

exam code

Microsoft

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

A security analyst receives an alert about a user who downloaded a large number of files from a SharePoint document library in a short period. The analyst needs to investigate the user's activities across Exchange, SharePoint, and Teams to determine if data exfiltration is occurring. Which Microsoft Purview solution should the analyst use to review detailed activity logs?

A
Microsoft Purview Audit (Premium)
Audit (Premium) captures a comprehensive record of user activities, enabling investigation of potential data exfiltration.
B
Microsoft Purview eDiscovery (Premium)
Why wrong: eDiscovery is used to search for content (emails, documents) for legal cases, not for activity audit logs.
C
Microsoft Purview Communication Compliance
Why wrong: This solution monitors communications for inappropriate content, not general user activities like file downloads.
D
Microsoft Purview Data Loss Prevention (DLP)
Why wrong: DLP policies prevent data leakage; it does not provide a retrospective log of user activities.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

A company currently has Microsoft 365 E5 licenses for all users. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a potential security incident. Which of the following capabilities is already included in their existing license?

A
Microsoft Defender for Microsoft 365 Plan 1
Why wrong: Plan 1 includes basic anti-phishing and anti-malware for email but not advanced hunting across endpoints and identities.
B
Microsoft Entra ID Premium P1
Why wrong: Microsoft Entra ID P1 provides identity governance and security features like Conditional Access, but not threat hunting capabilities.
C
Microsoft 365 Defender (including advanced hunting)
E5 includes Microsoft 365 Defender, which provides advanced hunting across emails, endpoints, identities, and apps, enabling queries to investigate incidents.
D
Microsoft Cloud App Security
Why wrong: Cloud App Security focuses on discovering and controlling shadow IT across SaaS apps, but is not the primary tool for cross-domain threat hunting.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

An administrator is reviewing a request from users who need to let support staff troubleshoot without tenant-wide change permissions. Microsoft 365 licensing, admin, or support concept is most relevant?

A
Microsoft Stream
Why wrong: Stream hosts video content and does not address this licensing or support need.
B
Assign least-privileged support or reader roles
Support roles should be scoped to the minimum access needed.
C
Microsoft Forms
Why wrong: Forms collects survey responses and does not meet this requirement.
D
Microsoft Whiteboard
Why wrong: Whiteboard is for visual collaboration, not this licensing or admin requirement.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full NAT/PAT explanation →

An administrator needs to monitor and investigate potential data breaches by reviewing detailed records of file access and sharing activities across Microsoft 365. They require a centralized report showing who accessed what, from where, and any unusual patterns. Which tool should they use?

A
Microsoft 365 Defender
Why wrong: Microsoft 365 Defender is a threat protection suite that detects and responds to attacks, but it does not provide the granular audit logs of user activities needed for detailed investigation.
B
Microsoft Purview Audit (Standard)
Audit logs capture detailed records of user and admin activities, including file access and sharing, which can be searched and analyzed for potential breaches.
C
Microsoft Purview eDiscovery
Why wrong: eDiscovery is used for content search and legal hold in legal or regulatory investigations, not for proactive monitoring of suspicious activities.
D
Microsoft Secure Score
Why wrong: Secure Score provides a security posture assessment and recommendations, not historical activity logs.

Full breakdown with real-world context →

Question 5mediummulti select

Full question →

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

A
Threat Explorer in Microsoft Defender for Office 365
Threat Explorer supports investigation of email threats, campaigns, and delivery actions.
B
It replaces the need for identity and access management
Why wrong: Compliance controls complement identity controls rather than replacing them.
C
It requires every document to be made public
Why wrong: Security and compliance controls do not require public access.
D
The policy should be tested with a limited group before broad rollout
Testing reduces the risk of blocking legitimate work or applying unintended restrictions.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

A global company has a strict policy that any Microsoft 365 administrator who needs to access a user's mailbox for troubleshooting must first obtain explicit approval from the user. The company wants to implement a process that requires approval for such access and logs the activity. Which Microsoft Purview feature should they use?

A
Customer Lockbox
Why wrong: Customer Lockbox is designed for controlling Microsoft support personnel access to your data, not for internal admin access.
B
Privileged Access Management (PAM)
PAM provides approval-based, time-limited access for administrative tasks and logs all activities.
C
Data Loss Prevention (DLP)
Why wrong: DLP policies protect sensitive data from being shared, they do not control admin access to resources.
D
Microsoft Purview Audit
Why wrong: Audit logs record user and admin activities but does not provide an approval process for access.

Full breakdown with real-world context →

Question 7mediummultiple choice

Full question →

A compliance administrator needs to investigate emails that may be part of a phishing campaign. Which Microsoft 365 capability is the best fit?

A
Microsoft Bookings
Why wrong: Bookings schedules appointments and is unrelated to this security requirement.
B
Microsoft Teams live events
Why wrong: Teams events are for communication, not this compliance/security requirement.
C
OneDrive sync client
Why wrong: The sync client synchronizes files and does not implement this control by itself.
D
Threat Explorer in Microsoft Defender for Office 365
Threat Explorer supports investigation of email threats, campaigns, and delivery actions.

Full breakdown with real-world context →

Question 8mediummultiple choice

Full question →

A help desk lead is documenting the correct Microsoft 365 approach to troubleshoot why a licensed user cannot access a specific app. Microsoft 365 licensing, admin, or support concept is most relevant?

A
Microsoft Forms
Why wrong: Forms collects survey responses and does not meet this requirement.
B
The assigned license and enabled service plans
Access depends on license assignment and enabled service plans.
C
Microsoft Stream
Why wrong: Stream hosts video content and does not address this licensing or support need.
D
Microsoft Whiteboard
Why wrong: Whiteboard is for visual collaboration, not this licensing or admin requirement.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

A tenant administrator is advising a department that wants to investigate incidents across identities, email, endpoints, and cloud apps in one experience. Microsoft security, identity, or compliance capability should it use?

A
Microsoft Stream
Why wrong: Stream hosts video content and does not meet this requirement.
B
Microsoft Defender XDR
Microsoft Defender XDR correlates alerts and incidents across multiple Defender workloads.
C
Microsoft Forms
Why wrong: Forms creates surveys and quizzes, not this security or compliance capability.
D
Microsoft Planner
Why wrong: Planner manages tasks and does not provide this security or compliance control.

Full breakdown with real-world context →

Question 10hardmultiple choice

Read the full NAT/PAT explanation →

A multinational organization with 500 users currently has Microsoft 365 E3 licenses. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a security incident. They also need the ability to automatically isolate infected endpoints. What is the most cost-effective licensing addition?

A
Microsoft 365 E5 Security
Correct. The E5 Security add-on provides Microsoft 365 Defender for advanced threat hunting across multiple domains and includes automated endpoint isolation.
B
Microsoft 365 E5
Why wrong: Incorrect. Upgrading to full E5 is more expensive than the Security add-on and includes many features (e.g., advanced compliance) not required for this scenario.
C
Microsoft 365 E5 Compliance
Why wrong: Incorrect. The Compliance add-on focuses on eDiscovery, retention, and data governance, not threat hunting or endpoint security.
D
Enterprise Mobility + Security (EMS) E5
Why wrong: Incorrect. EMS E5 is an older bundle that includes Microsoft Entra ID P2 and Intune but does not include Microsoft 365 Defender for threat hunting. It is no longer the recommended add-on for this purpose.

Full breakdown with real-world context →

Question 11easymultiple choice

Full question →

A user is unable to access Microsoft Teams because the tenant's subscription has expired. The administrator wants to restore access as quickly as possible while minimizing costs. What should the administrator do?

A
Extend the trial period for 30 additional days
Why wrong: Trial extensions are only available before expiration, not after.
B
Wait for the subscription to automatically renew within 30 days
Why wrong: Subscriptions do not automatically renew after expiration; action is required.
C
Reactivate the expired subscription in the Microsoft 365 admin center
Reactivating restores service quickly without purchasing a new subscription.
D
Purchase a new subscription and assign licenses to users
Why wrong: This is slower and more costly than reactivating the existing subscription.

Full breakdown with real-world context →

Question 12mediummultiple choice

Full question →

Your company has deployed Microsoft Defender XDR. A security analyst needs to investigate a suspicious email that was reported by a user. Which Microsoft 365 service should the analyst use to view the email's details and analyze threats?

A
Microsoft Sentinel
Why wrong: SIEM, can be used but not the primary email investigation tool.
B
Microsoft Defender XDR
Unified security operations platform that includes email security.
C
Microsoft Intune
Why wrong: Device management.
D
Microsoft Purview
Why wrong: Compliance, not email threat investigation.

Full breakdown with real-world context →

These MS-900 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style MS-900 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related MS-900 topic practice pages

Describe Microsoft 365 apps and services practice questions

Describe Microsoft 365 pricing, licensing, and support practice questions

Describe cloud concepts practice questions

Describe security, compliance, privacy, and trust in Microsoft 365 practice questions

Describe Microsoft 365 pricing and support practice questions

MS-900 fundamentals practice questions

MS-900 scenario practice questions

MS-900 troubleshooting practice questions

Practice scenarios

A company currently has Microsoft 365 E5 licenses for all users. They need to perform advanced threat hunting using queries across email, endpoints, and identities to investigate a potential security incident. Which of the following capabilities is already included in their existing license?

An administrator is reviewing a request from users who need to let support staff troubleshoot without tenant-wide change permissions. Microsoft 365 licensing, admin, or support concept is most relevant?

An administrator needs to monitor and investigate potential data breaches by reviewing detailed records of file access and sharing activities across Microsoft 365. They require a centralized report showing who accessed what, from where, and any unusual patterns. Which tool should they use?

An organization wants to investigate emails that may be part of a phishing campaign. Which two statements are accurate about the Microsoft 365 capability involved?

A compliance administrator needs to investigate emails that may be part of a phishing campaign. Which Microsoft 365 capability is the best fit?

A help desk lead is documenting the correct Microsoft 365 approach to troubleshoot why a licensed user cannot access a specific app. Microsoft 365 licensing, admin, or support concept is most relevant?

A tenant administrator is advising a department that wants to investigate incidents across identities, email, endpoints, and cloud apps in one experience. Microsoft security, identity, or compliance capability should it use?

A user is unable to access Microsoft Teams because the tenant's subscription has expired. The administrator wants to restore access as quickly as possible while minimizing costs. What should the administrator do?

Your company has deployed Microsoft Defender XDR. A security analyst needs to investigate a suspicious email that was reported by a user. Which Microsoft 365 service should the analyst use to view the email's details and analyze threats?