MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
You are the IT administrator for a non-profit organization that uses Microsoft 365 Business Basic. The organization has 50 volunteers who use their own personal devices to access email and SharePoint Online. The board of directors wants to ensure that if a volunteer's device is lost or stolen, the organization's data on that device can be removed remotely. They also want to ensure that volunteers use multi-factor authentication (MFA) to access corporate resources. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enroll devices in Microsoft Intune and configure a selective wipe policy. Set up a Conditional Access policy in Microsoft Entra ID to require MFA.
Microsoft Intune allows you to enroll devices and perform a selective wipe to remove only corporate data from personal devices. Conditional Access in Microsoft Entra ID can enforce MFA for accessing corporate resources. Option A is incorrect because Microsoft Defender for Cloud Apps provides cloud app security (e.g., session controls) but does not perform device wipe or manage device enrollment. Option B is incorrect because Microsoft Purview is for data governance, compliance, and labeling, not for device management or selective wipe. Option C is incorrect because Data Loss Prevention (DLP) policies control data sharing but cannot block access from unmanaged devices; that would require Conditional Access policies with device compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy Microsoft Defender for Cloud Apps and configure session controls.
Why it's wrong here
Defender for Cloud Apps does not perform device wipe.
- ✗
Use Microsoft Purview to label all corporate data and configure a policy to revoke access.
Why it's wrong here
Purview does not manage devices.
- ✗
Implement a Data Loss Prevention (DLP) policy that blocks access from unmanaged devices.
Why it's wrong here
DLP does not wipe devices.
- ✓
Enroll devices in Microsoft Intune and configure a selective wipe policy. Set up a Conditional Access policy in Microsoft Entra ID to require MFA.
Why this is correct
Intune can wipe corporate data; Conditional Access enforces MFA.
Go deeper
Related to this question
Learn chapter
External Sharing in SharePoint and OneDrive
Key term
Microsoft Entra ID
Microsoft Entra ID is a cloud-based identity and access management service that lets employees sign in and access resources both inside and outside of your organization.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.