MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
This MS-900 practice question tests your understanding of describe security, compliance, privacy, and trust in microsoft 365. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. A key principle to apply: defender for Office 365 (MDO) provides advanced threat protection for email.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
While preparing a Microsoft 365 adoption plan, a consultant is asked to let users report suspicious phishing messages from Outlook for investigation. Microsoft security, identity, or compliance capability should it use?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Office 365 user submissions
Microsoft Defender for Office 365 user submissions (Option A) is the correct capability because it allows users to report suspicious phishing messages directly from Outlook, which are then routed to the Microsoft 365 Defender portal for investigation and analysis. This feature integrates with the built-in Report Message or Report Phishing add-ins, enabling security teams to review and act on user-reported threats within the unified security operations framework.
Key principle: Defender for Office 365 (MDO) provides advanced threat protection for email.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Microsoft Defender for Office 365 user submissions
Why this is correct
Defender for Office 365 supports user submissions and investigation workflows for suspicious email.
Related concept
Defender for Office 365 (MDO) provides advanced threat protection for email.
✗
Microsoft Planner
Why it's wrong here
Planner manages tasks and does not provide this security or compliance control.
✗
Microsoft Forms
Why it's wrong here
Forms creates surveys and quizzes, not this security or compliance capability.
✗
Microsoft Stream
Why it's wrong here
Stream hosts video content and does not meet this requirement.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse Microsoft Forms (a generic survey tool) with a legitimate reporting mechanism, overlooking that Microsoft 365 provides a dedicated, integrated security solution (Defender for Office 365) for phishing submissions.
Detailed technical explanation
How to think about this question
Under the hood, user submissions leverage the Exchange Online Mail Flow and the Submissions API in Microsoft 365 Defender, which automatically parses the reported email headers and attachments for threat analysis. The system supports both the built-in Report Message add-in and third-party reporting tools via the Unified Submission experience, allowing administrators to configure custom mailboxes or automated remediation actions. In a real-world scenario, a user reporting a phishing email triggers an automated investigation that can quarantine the message across all tenants if a match is found in the threat intelligence database.
KKey Concepts to Remember
Defender for Office 365 (MDO) provides advanced threat protection for email.
MDO user submissions allow reporting suspicious emails directly from Outlook.
Reported emails trigger automated investigations within MDO.
MDO helps protect against phishing, malware, and other email-borne threats.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Defender for Office 365 (MDO) provides advanced threat protection for email.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-900 question in full detail.
Review defender for Office 365 (MDO) provides advanced threat protection for email., then practise related MS-900 questions on the same topic to reinforce the concept.
Describe security, compliance, privacy, and trust in Microsoft 365 — This question tests Describe security, compliance, privacy, and trust in Microsoft 365 — Defender for Office 365 (MDO) provides advanced threat protection for email..
What is the correct answer to this question?
The correct answer is: Microsoft Defender for Office 365 user submissions — Microsoft Defender for Office 365 user submissions (Option A) is the correct capability because it allows users to report suspicious phishing messages directly from Outlook, which are then routed to the Microsoft 365 Defender portal for investigation and analysis. This feature integrates with the built-in Report Message or Report Phishing add-ins, enabling security teams to review and act on user-reported threats within the unified security operations framework.
What should I do if I get this MS-900 question wrong?
Review defender for Office 365 (MDO) provides advanced threat protection for email., then practise related MS-900 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Defender for Office 365 (MDO) provides advanced threat protection for email.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.