MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
While preparing a Microsoft 365 adoption plan, a consultant is asked to identify risky user behaviour such as unusual downloads or policy violations. Microsoft security, identity, or compliance capability should it use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Purview Insider Risk Management with general compliance tools like Microsoft Purview Compliance Manager or DLP, but the question specifically targets risky user behavior detection, which is the unique domain of Insider Risk Management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Insider Risk Management
Microsoft Purview Insider Risk Management is the correct capability because it is specifically designed to identify, detect, and act on risky user behaviors such as unusual downloads, data leaks, and policy violations. It uses machine learning models and predefined indicators to correlate user activities (e.g., mass file downloads, unauthorized sharing) with risk signals, enabling organizations to investigate and mitigate insider threats. This aligns directly with the consultant's need to monitor and address risky behavior in a Microsoft 365 adoption plan.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner is a project management and task assignment tool that organizes work into boards, buckets, and tasks for team collaboration. While it supports team productivity, its backend does not include the Purview audit log, data classification, or risk analytics needed to detect or investigate insider threats. Planner simply lacks the security and compliance controls necessary to identify risky user activity.
- ✓
Microsoft Purview Insider Risk Management
Why this is correct
Microsoft Purview Insider Risk Management is a compliance solution that uses behavioral analytics and machine learning to identify, triage, and investigate risky user activities aligned with data exfiltration, leaks, and policy violations. It integrates with the Microsoft 365 activity logs and provides alerts, case management, and contextual evidence for administrators to mitigate internal threats. This direct focus on risky behavior makes it the correct service for a Microsoft 365 adoption plan addressing security and compliance.
- ✗
Microsoft Stream
Why it's wrong here
Microsoft Stream is an enterprise video platform for uploading, sharing, and managing recordings with features like permissions, transcripts, and comments. It does not ingest or analyze user activity across Microsoft 365 workloads, nor does it offer policy templates for insider risk detection or data loss prevention. Stream's scope is limited to media content management, not the behavioral monitoring required for this adoption plan.
- ✗
Microsoft Forms
Why it's wrong here
Microsoft Forms is a lightweight data-gathering tool used to create surveys, quizzes, and forms, with responses stored in Excel and sharing controls for external users. It provides no capabilities for tracking or analyzing thousands of user actions across Exchange, SharePoint, or Teams, and its admin settings cannot trigger insider risk alerts or investigations. Forms is entirely a data-collection service without any integrated security or compliance monitoring for risky activities.
Go deeper
Related to this question
Learn chapter
External Sharing in SharePoint and OneDrive
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.