MS-102 Practice Test 42 — 15 Questions

Question 1

Your organization uses Microsoft Purview Data Lifecycle Management. You need to ensure that after an employee leaves, their OneDrive content is retained for 7 years and then automatically deleted. The retention label must be applied automatically when the employee is marked as inactive in Microsoft Entra ID. What should you configure?

Accepted Answer

Create an auto-apply retention label with adaptive scope for inactive users.. A retention label auto-applied based on a Microsoft Entra ID attribute can target inactive users. Option D is correct because you can create an adaptive scope for inactive users and apply a retention label. Option A is wrong because retention policies apply to all content, not selectively. Option B is wrong because default labels apply to new content, not existing. Option C is wrong because manual labels require user action.

Answer

Instruct users to manually apply a retention label to their OneDrive.

Answer

Configure a default retention label on the OneDrive library.

Answer

Create a retention policy for OneDrive with a 7-year retention period.

Question 2

Refer to the exhibit. You are a compliance administrator. You need to ensure that documents in the Project X site are retained for 365 days after the last modification and then deleted. The current configuration is shown. What is the outcome?

Accepted Answer

The label is applied automatically to all items in the site, retaining them for 365 days from last modification.. The retention label is configured with RetentionType set to 'ModificationAgeInDays', which means the retention period starts from the item's last modification date. However, the policy applies the label to the site via an adaptive scope. The label will automatically apply to all items in the site and retain them for 365 days from the last modification, then delete. Option B is correct because the label applies automatically via the policy. Option A is wrong because the policy applies the label. Option C is wrong because the retention is based on modification age, not creation. Option D is wrong because the label is applied automatically.

Answer

The label is applied only to new items, not existing.

Answer

The label is not applied automatically; users must apply it manually.

Answer

The label is applied, but the retention period starts from the creation date.

Question 3

Your company uses Microsoft Purview to manage compliance. You need to set up a process that allows users to request permission to access a document labeled 'Confidential' and automatically grants access if the user's manager approves. Which feature should you use?

Accepted Answer

Microsoft Entra ID Access Reviews with a connected organization. Option C is correct because Microsoft Entra ID Access Reviews can be integrated with Microsoft Purview to manage access requests with approval workflows. Option A is wrong because DLP doesn't handle access requests. Option B is wrong because labels don't include approval workflows. Option D is wrong because Privileged Access Management is for elevated admin roles, not document access.

Answer

Microsoft Purview Privileged Access Management

Answer

Microsoft Purview Data Loss Prevention with a custom policy

Answer

Microsoft Purview sensitivity label with a custom permission

Question 4

Your organization uses Microsoft Purview Data Lifecycle Management and has a retention policy that retains all SharePoint documents for three years. However, for a specific research project, you need to retain documents for five years after the project ends. Some documents are already marked with a different retention label. What should you do?

Accepted Answer

Apply a retention label with a five-year retention period to the research documents.. Option D is correct because a retention label applied at the item level takes precedence over a broader retention policy. Option A is incorrect because a new policy would not override an existing label unless the label is removed. Option B is incorrect because you cannot exclude specific documents from a policy; you must use labels. Option C is incorrect because labels have precedence over policies.

Answer

Modify the existing retention policy to exclude the research project site.

Answer

Remove the existing retention labels from the research documents and rely on the policy.

Answer

Create a new retention policy that applies to the research project site and set the retention period to five years.

Question 5

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They recently deployed Microsoft Copilot for Microsoft 365. Users can now ask Copilot to summarize documents that contain sensitive information. How should the company extend DLP protection to Copilot interactions?

Accepted Answer

Enable DLP for Copilot in the DLP policy settings.. Microsoft Purview DLP can now cover Microsoft Copilot for Microsoft 365 interactions. This is done by enabling DLP for Copilot in the DLP policy settings. Option B is incorrect because sensitivity labels alone don't block Copilot. Option C is incorrect because Communication Compliance monitors internal communications, not Copilot. Option D is incorrect because Information Barriers are for restricting communication between groups.

Answer

Apply a sensitivity label that restricts Copilot access.

Answer

Implement Information Barriers for Copilot.

Answer

Configure a Communication Compliance policy to monitor Copilot.

Question 6

Which THREE actions can be taken by a Microsoft Purview Data Loss Prevention (DLP) policy in Exchange Online?

Accepted Answer

Block the email from being sent. DLP policies in Exchange Online can block sending, encrypt the message, and notify the sender with a policy tip. Justifying override is not an action; it's a user response. Blocking all emails is not granular; DLP actions are rule-based.

Answer

Allow the sender to override the block

Answer

Block all emails from the sender

Question 7

Your organization uses Microsoft Purview Records Management. You need to ensure that records are marked as regulatory records and cannot be deleted or modified by any user, including administrators. The records must be retained for 10 years. What should you do?

Accepted Answer

Use a retention label marked as a regulatory record.. Regulatory records provide the highest level of restriction, making content tamper-proof. Option D is correct. Option A is wrong because preservation lock applies to retention policies, not individual records. Option B is wrong because default labels can be changed. Option C is wrong because manual labels are not as restrictive.

Answer

Create a retention policy with a preservation lock.

Answer

Use a retention label marked as a record.

Answer

Apply a default retention label to the SharePoint library.

Question 8

Refer to the exhibit. You are configuring auto-labeling for sensitivity labels. The JSON snippet is part of the policy configuration. When a document containing a credit card number is detected, what will happen?

Accepted Answer

The document will be automatically encrypted.. The rule specifies an action to encrypt when a credit card number is detected. Option B is correct because the action is 'encrypt'. Option A is wrong because the action includes encrypt. Option C is wrong because no retention action is specified. Option D is wrong because it does not block sharing.

Answer

The document will be retained for a default period.

Answer

The document will be marked as a record.

Answer

The document will be blocked from sharing.

Question 9

Refer to the exhibit. You have a DLP policy in test mode as shown. A user reports that they received a notification that sharing credit card numbers is blocked, but they were still able to share them. What is the most likely reason?

Accepted Answer

The policy is in test mode, which does not enforce actions.. Option B is correct because when a DLP policy is in test mode, it notifies users but does not actually block the action. Option A is wrong because the rule includes the action BlockAccess, but test mode overrides it. Option C is wrong because the condition is valid. Option D is wrong because the notification is enabled in the rule and policy.

Answer

The rule action 'BlockAccess' is not included in the policy.

Answer

The condition 'SensitiveInformation' is not configured correctly.

Answer

The notification is not enabled in the policy.

Question 10

A company uses Microsoft Purview Information Protection to classify and protect sensitive data. They have configured auto-labeling policies for Microsoft 365 apps. However, users report that some documents containing credit card numbers are not being labeled automatically. You verify that the sensitive info type for credit cards is correctly defined. What is the most likely cause?

Accepted Answer

The documents are stored in on-premises file shares, not in SharePoint or OneDrive.. Option B is correct because auto-labeling policies can only label documents that are stored in Microsoft 365 (SharePoint Online, OneDrive for Business) or Exchange Online, not on-premises file shares. Option A is incorrect because auto-labeling is not limited to Word, Excel, PowerPoint; it also works for other formats. Option C is incorrect because sensitivity labels can be configured for auto-labeling. Option D is incorrect because the DLP policy does not affect auto-labeling.

Answer

The auto-labeling policy only applies to Word, Excel, and PowerPoint files.

Answer

The sensitivity label used for auto-labeling is not published to users.

Answer

The DLP policy for credit cards is blocking the auto-labeling process.

Question 11

You are reviewing a Conditional Access policy JSON for your Microsoft Entra ID tenant. The first policy blocks access from high-risk IP addresses. The second policy requires MFA for all users from trusted locations. You notice that users from high-risk IP addresses are still prompted for MFA instead of being blocked. What is the most likely cause?

Accepted Answer

The block policy is set to report-only mode, so it is not enforced.. Option B is correct because Conditional Access policies are evaluated in priority order; if the block policy has a lower priority than the grant policy, the grant policy could apply first. However, in this exhibit, the block policy has priority 1 and the grant policy has priority 2, so the block should apply first. But the issue is that the grant policy's condition includes locations 'AllTrusted', and the block policy's condition includes 'HighRiskIP'. If a user is from a high-risk IP that is also considered 'trusted'? That is unlikely. Another possibility: the block policy action is 'BlockAccess' but if the user is not meeting the conditions? Actually, the exhibit shows that the block policy has priority 1, which is lower number (higher priority). So the block should apply. But the user is getting MFA prompt instead of block. This could happen if the block policy is in report-only mode, but the JSON doesn't show a state. In real exam, they might expect that the block policy has a higher priority (lower number) but the grant policy might be evaluated first due to scope? Actually, Conditional Access evaluates all policies that apply. If both apply, block takes precedence. However, if the block policy's condition does not match (e.g., the location is not recognized as HighRiskIP), then only the grant policy applies. So the most likely cause is that the location condition in the block policy is not correctly matching the user's IP. But option B says the block policy is set to report-only mode, which is a common reason for not enforcing. Since the JSON does not include a state, it could be report-only. Option A (priority) is wrong because priority 1 is higher than 2. Option C (MFA required) is not the cause. Option D (block policy missing MFA) is irrelevant. So B is plausible. However, in real scenario, if the block policy is in report-only, it won't block. So I'll go with B.

Answer

The block policy does not specify MFA, so it is ignored.

Answer

The block policy has a lower priority than the grant policy.

Answer

The grant policy requires MFA for all users, overriding the block.

Question 12

Your organization uses Microsoft Purview Data Loss Prevention (DLP) policies to protect sensitive data. A user reports that they can still send credit card numbers via email despite the DLP policy being enabled. You verify that the policy is applied to the correct users and the rule includes the 'Credit Card Number' sensitive info type. What should you check next?

Accepted Answer

Check the priority of the DLP policy to ensure it is not overridden by a lower-priority policy that allows the action.. Option A is correct because DLP policies often fail due to incorrect priority order; the policy with the highest priority (lowest number) is applied first. Option B is wrong because the condition is already present. Option C is wrong because the policy is already enabled. Option D is wrong because end-user notifications are for policy tips, not enforcement.

Answer

Disable and re-enable the DLP policy to refresh its rules.

Answer

Add the 'Credit Card Number' sensitive info type to the policy rule again.

Answer

Configure end-user notifications for the DLP policy.

Question 13

You need to ensure that all documents in a SharePoint Online site are automatically labeled with a 'Confidential' sensitivity label. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview auto-labeling policy. Option C is correct because auto-labeling policies can automatically apply sensitivity labels to documents in SharePoint. Option A is wrong because DLP policies don't apply labels. Option B is wrong because manual labeling requires user action. Option D is wrong because retention policies don't apply sensitivity labels.

Answer

Microsoft Purview Data Loss Prevention policy

Answer

Microsoft Purview retention policy

Answer

Microsoft Purview manual labeling

Question 14

Your organization needs to prevent users from sharing documents containing personally identifiable information (PII) with external users. You have Microsoft Purview Data Loss Prevention (DLP) deployed. What should you configure?

Accepted Answer

Create a DLP policy that detects PII and restricts sharing to external users.. Option A is correct because a DLP policy can be configured to detect PII and block external sharing. Option B is incorrect because sensitivity labels do not block sharing; they classify data. Option C is incorrect because conditional access blocks access based on conditions, not content. Option D is incorrect because auditing only logs activity, it does not prevent sharing.

Answer

Apply a sensitivity label that blocks external sharing.

Answer

Configure a conditional access policy in Microsoft Entra ID to block external sharing.

Answer

Enable auditing for all document sharing activities.

Question 15

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive email. You have a DLP policy that blocks emails containing credit card numbers. However, users report that some legitimate emails with credit card numbers are being blocked, while others with similar content are allowed. You need to investigate the discrepancy and ensure consistent enforcement. What should you do first?

Accepted Answer

Enable policy tips in test mode for the DLP policy and instruct users to report false positives.. Option A is correct because DLP policy tips in test mode allow you to see what would be blocked without actually blocking, helping identify false positives. Option B (DLP reports in Purview compliance portal) shows aggregate data but not per-user false positives. Option C (Message trace) does not show DLP policy matches. Option D (Audit log) records DLP actions but is not the most efficient first step for troubleshooting false positives.

Answer

Use the Exchange admin center message trace to see if the emails were blocked by DLP.

Answer

Check the audit log for DLP rule matches to identify the specific emails blocked.

Answer

Review the DLP reports in the Microsoft Purview compliance portal to analyze the blocked emails.