MS-900 Security, Compliance, & Privacy in Microsoft 5 — Questions and Answers
Question 1: Which Microsoft service provides a centralized portal where organizations can view their compliance posture, manage assessments, and access regulatory templates?
- Microsoft Purview Compliance Portal (Correct answer)
- Microsoft 365 Admin Center
- Azure Security Center
- Microsoft Defender Portal
Correct answer: Microsoft Purview Compliance Portal
The Microsoft Purview Compliance Portal is the unified hub for compliance tools including Compliance Manager, DLP, Information Protection, and eDiscovery.
Question 2: What does eDiscovery in Microsoft Purview allow legal and compliance teams to do?
- Encrypt documents for litigation
- Search, collect, and export Microsoft 365 content relevant to legal cases (Correct answer)
- Block user access during investigations
- Automatically classify documents by legal category
Correct answer: Search, collect, and export Microsoft 365 content relevant to legal cases
eDiscovery enables organizations to identify, collect, and export electronically stored information (ESI) from Microsoft 365 services to respond to legal matters.
Question 3: What is the main security benefit of enabling Self-Service Password Reset (SSPR) in Azure AD?
- It eliminates the need for MFA
- It reduces helpdesk burden while maintaining security through identity verification challenges (Correct answer)
- It allows users to bypass Conditional Access policies
- It stores passwords in plaintext for quick recovery
Correct answer: It reduces helpdesk burden while maintaining security through identity verification challenges
SSPR lets users reset their own passwords securely after verifying their identity, reducing IT helpdesk load without compromising security.
Question 4: Which Microsoft 365 feature allows administrators to restrict which cloud apps users can access based on user, device, location, and risk signals?
- Azure AD Conditional Access (Correct answer)
- Microsoft Intune App Protection Policies
- Microsoft Defender for Cloud Apps
- Azure AD Privileged Identity Management
Correct answer: Azure AD Conditional Access
Conditional Access uses signals like user identity, device compliance, location, and risk level to enforce granular access policies for cloud apps.
Question 5: An organization discovered that a former employee's account is still active 30 days after their departure. Which Microsoft 365 capability helps prevent this type of orphaned account risk?
- Microsoft Defender for Endpoint
- Azure AD Access Reviews and lifecycle workflows (Correct answer)
- Microsoft Purview Audit
- Sensitivity label automation
Correct answer: Azure AD Access Reviews and lifecycle workflows
Azure AD lifecycle workflows and Access Reviews automate user provisioning/deprovisioning and help identify stale or orphaned accounts that should be disabled.
Question 6: What type of encryption does Microsoft 365 use to protect data stored at rest in services like Exchange Online and SharePoint Online?
- RC4 encryption
- BitLocker and service-level encryption (including Customer Key option) (Correct answer)
- MD5 hashing
- SSL/TLS encryption only
Correct answer: BitLocker and service-level encryption (including Customer Key option)
Microsoft 365 uses BitLocker disk-level encryption and service-level encryption at rest; organizations can optionally manage their own keys using Customer Key.
Question 7: Which statement best describes how Microsoft handles law enforcement requests for customer data stored in Microsoft 365?
- Microsoft proactively shares customer data with law enforcement monthly
- Microsoft requires valid legal process and notifies customers when permitted before complying (Correct answer)
- Microsoft automatically grants law enforcement direct database access
- Microsoft never responds to any government data requests
Correct answer: Microsoft requires valid legal process and notifies customers when permitted before complying
Microsoft's Law Enforcement Requests Report documents that Microsoft requires valid legal process, challenges overbroad requests, and notifies customers when legally permitted.
MS-900 Security, Compliance, & Privacy in Microsoft 5
Which Microsoft service provides a centralized portal where organizations can view their compliance posture, manage assessments, and access regulatory templates?