MS-102 Manage compliance by using Microsoft Purview Practice Test 11 — 15 Questions

Question 1

You need to monitor which users have accessed a specific document stored in SharePoint Online over the last 90 days. What should you use?

Accepted Answer

Audit log search in Microsoft Purview.. Audit log search in Microsoft Purview is the correct tool because it queries the unified audit log, which records user activities such as file access, download, and sharing events across SharePoint Online and OneDrive for Business. The 'Accessed file' and 'FileAccessed' operations are captured with the user identity, timestamp, and item path, allowing you to filter by date range (up to 90 days by default, extendable to 1 year with the right license) and by the specific document URL. This directly answers the requirement to see *who* accessed a *specific document* over a defined period.

Answer

Data Loss Prevention reports.

Answer

eDiscovery (Premium) case.

Answer

Content search in Microsoft Purview.

Question 2

Which TWO actions can you perform using Microsoft Purview Data Loss Prevention (DLP) policies?

Accepted Answer

Show a policy tip to users when they attempt to share sensitive data.. Option B is correct because Microsoft Purview DLP policies can display policy tips to users in supported apps (for example, Outlook, Word, Excel, and SharePoint) when their actions match a DLP rule, warning them before they share sensitive data. Option C is correct because DLP policies can enforce blocking actions, such as preventing users from sending emails containing sensitive information like credit card or Social Security numbers, via Exchange/Outlook and other workloads. Option A is not a DLP function; retention periods are configured with retention labels and retention policies in Microsoft Purview Data Lifecycle Management (or records management), not DLP. Option D is not a DLP action; watermarks are applied through sensitivity labels with content marking (or Azure Information Protection), not DLP policies. Option E is not a DLP action; automatic encryption is achieved through sensitivity labels with encryption settings, not DLP, which focuses on detecting and restricting/blocking sharing rather than encrypting files.

Answer

Set retention periods for documents containing credit card numbers.

Answer

Add a watermark to sensitive documents.

Answer

Automatically encrypt sensitive files when shared.

Question 3

Which THREE components are required to implement auto-labeling for sensitivity labels in Microsoft 365?

Accepted Answer

A sensitivity label configured for auto-labeling.. Auto-labeling in Microsoft 365 requires three core components. Option A is correct because a sensitivity label must be configured for auto-labeling (i.e., its auto-labeling setting enabled) so it can be applied automatically to matching content. Option C is correct because the auto-labeling policy must reference a sensitive info type (such as a built-in SIT or a custom SIT) or a trainable classifier to detect the content to label. Option D is correct because an auto-labeling policy is the container that binds the label to the detection rules and specifies the workloads/locations (Exchange, SharePoint, OneDrive) where labeling runs. Option B is not required: a DLP policy is a separate data loss prevention control and is not a prerequisite for auto-labeling, even if it uses the same sensitive info type. Option E is not required: information barrier policies restrict communication between groups and are unrelated to sensitivity label auto-labeling.

Answer

A DLP policy for the same sensitive info type.

Answer

An information barrier policy.

Question 4

Which TWO features are part of Microsoft Purview Communication Compliance?

Accepted Answer

Policy tips to notify users of policy violations.. Option C is correct because Communication Compliance policies can display policy tips to users in supported clients (for example, Outlook and Teams) to warn them in real time when their message may violate an organizational policy, helping deter risky communications. Option D is correct because Communication Compliance uses trainable classifiers and built-in sensitive information types to detect inappropriate or offensive language, harassment, threats, and other policy-violating content in emails and other communications. Option A is not a Communication Compliance feature; restricting communication between specific groups is handled by Exchange transport rules or information barriers. Option B is not part of Communication Compliance; retention labels are applied through Microsoft Purview Data Lifecycle Management and Records Management. Option E is not part of Communication Compliance; automatic encryption of sensitive communications is provided by sensitivity labels with encryption or Exchange data loss prevention/transport rules.

Answer

Restricting communication between specific groups.

Answer

Applying retention labels to communications.

Answer

Automatic encryption of sensitive communications.

Question 5

Refer to the exhibit. You run the PowerShell command shown. The output shows no results. The user confirms they downloaded files from SharePoint last week. What is the most likely cause?

Accepted Answer

Audit logging is not enabled for the user.. The PowerShell command shown is likely Search-UnifiedAuditLog, which queries the unified audit log. If the output is empty despite the user having downloaded files from SharePoint, the most likely cause is that audit logging (specifically, mailbox or SharePoint audit logging) is not enabled for that user or workload. Without audit logging turned on, no events are recorded, so the search returns nothing.

Answer

The UserIds parameter is misspelled.

Answer

The RecordType parameter is incorrect.

Answer

The Operations parameter is incorrect.

Question 6

Your organization needs to implement a Microsoft Purview data classification solution that scans data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the foundational metadata and scanning service that discovers and classifies data across sources including Microsoft 365, Azure SQL Database, and Amazon S3. It registers sources, runs scans, applies classification rules, and builds the data estate catalog that other Purview solutions consume. Because the requirement spans multi-cloud and on-prem sources, the Data Map is the correct feature.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Information Protection sensitivity labels

Answer

Microsoft Purview eDiscovery

Question 7

Your organization uses Microsoft Purview to classify and protect data. You need to create a custom sensitive info type that detects employee IDs formatted as 'EMP-XXXXX' where X is a digit. Which approach should you use?

Accepted Answer

Create a custom sensitive info type using a regular expression.. A custom sensitive info type using a regular expression is the best way to define the pattern 'EMP-XXXXX' (where X is a digit). Option B is incorrect because a keyword dictionary is used for exact word matching, not pattern matching. Option C is incorrect because Exact Data Match (EDM) requires a source of exact data values, not a pattern. Option D is incorrect because the built-in 'Employee ID' sensitive info type may not match this specific format.

Answer

Use a keyword dictionary for the pattern.

Answer

Use exact data match (EDM) based classification.

Answer

Use the built-in 'Employee ID' sensitive info type.

Question 8

Refer to the exhibit. You have a DLP policy in test mode as shown. A user reports that they received a notification that sharing credit card numbers is blocked, but they were still able to share them. What is the most likely reason?

Accepted Answer

The policy is in test mode, which does not enforce actions.. A DLP policy in test mode (also called simulation mode) evaluates rules and generates alerts, notifications, and activity reports, but it does not enforce the configured actions such as BlockAccess or Block. Therefore the user sees the policy tip/notification indicating the content is sensitive, yet the sharing is still allowed because the block action is not applied. This is the intended behavior for validating a policy before turning it on.

Answer

The rule action 'BlockAccess' is not included in the policy.

Answer

The condition 'SensitiveInformation' is not configured correctly.

Answer

The notification is not enabled in the policy.

Question 9

You need to ensure that all documents in a SharePoint Online site are automatically labeled with a 'Confidential' sensitivity label. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview auto-labeling policy. Auto-labeling policies can automatically apply sensitivity labels to documents in SharePoint Online based on conditions. Option B is wrong because Data Loss Prevention policies detect and protect sensitive data but do not apply labels. Option C is wrong because retention policies manage data retention and deletion, not sensitivity labels. Option D is wrong because manual labeling requires user action, not automatic application.

Answer

Microsoft Purview Data Loss Prevention policy

Answer

Microsoft Purview retention policy

Answer

Microsoft Purview manual labeling

Question 10

Your organization receives a data subject request (DSR) to export personal data of a user. Which Microsoft Purview solution should you use to search for and export the data?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery allows you to search for content across Microsoft 365 and export it, which is necessary to fulfill a data subject request (DSR) to export personal data. Option A is incorrect because retention policies are used to retain data for a specified period, not to export it. Option B is incorrect because audit logs track activities but do not provide content search or export capabilities. Option D is incorrect because Data Loss Prevention (DLP) is designed to prevent data leaks, not to export data.

Answer

Microsoft Purview retention policies

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Loss Prevention

Question 11

Refer to the exhibit. You have two DLP compliance rules as shown. A user sends an email containing both PII and credit card numbers. Which rule will be applied?

Accepted Answer

Both rules will be evaluated, and the most restrictive action will be applied.. When multiple DLP rules match the same email, Microsoft Purview evaluates all matching rules and applies the most restrictive action among them. In this case, both the PII rule and the Credit Cards rule match, so the action with the highest restriction (e.g., Block over Notify) is enforced. This ensures that sensitive data is protected even when multiple policies overlap.

Answer

Block PII rule only

Answer

Block Credit Cards rule only

Answer

Neither rule will apply because they conflict.

Question 12

Your company is implementing Microsoft Purview Records Management. You need to ensure that invoices are retained for seven years after they are paid, and then automatically deleted. Which type of label should you create?

Accepted Answer

Retention label with disposition review after the trigger event. A retention label with a disposition review after a trigger event can automate deletion after a specified period (7 years) triggered by an event (invoice payment). Option A is incorrect because a disposition review label requires manual review before deletion, whereas the requirement is automatic deletion. Option B is incorrect because a retention policy applies to all documents in a location and cannot be scoped to specific items based on metadata like payment date. Option D is incorrect because sensitivity labels are for classification and protection, not retention management.

Answer

Disposition review label assigned to invoices

Answer

Retention policy applied to all documents in SharePoint

Answer

Sensitivity label with auto-labeling

Question 13

Your organization needs to prevent users from sharing documents containing personally identifiable information (PII) with external users. You have Microsoft Purview Data Loss Prevention (DLP) deployed. What should you configure?

Accepted Answer

Create a DLP policy that detects PII and restricts sharing to external users.. Microsoft Purview DLP is specifically designed to detect sensitive information types (like PII) in documents and apply protective actions, such as blocking external sharing. A DLP policy can be scoped to locations like SharePoint, OneDrive, Exchange, and Teams, and can enforce rules that prevent users from sharing content containing PII with external users. This directly addresses the requirement by combining detection and enforcement.

Answer

Apply a sensitivity label that blocks external sharing.

Answer

Configure a conditional access policy in Microsoft Entra ID to block external sharing.

Answer

Enable auditing for all document sharing activities.

Question 14

Your organization uses Microsoft Purview Records Management and has a file plan that categorizes records by department. You need to ensure that HR records are retained for seven years after employee termination, while finance records are retained for ten years after the end of the fiscal year. What is the most efficient way to implement this?

Accepted Answer

Create two retention labels: one for HR with termination trigger and seven-year retention, and one for Finance with end-of-fiscal-year trigger and ten-year retention.. Retention labels in Microsoft Purview Records Management support event-based retention triggers, and each label can have its own retention period and trigger type. Creating one label for HR with a termination trigger and seven-year retention, and another for Finance with an end-of-fiscal-year trigger and ten-year retention, directly maps to the two distinct business requirements. Labels are the correct construct for file-plan-based records management because they can be published to specific locations and applied per-item.

Answer

Create a single retention label with a trigger event and adjust the retention period using PowerShell.

Answer

Define the retention settings in the file plan and apply them to both departments.

Answer

Create two retention policies, one for HR and one for Finance, each with the appropriate retention period.

Question 15

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. Users are sharing credit card numbers in Teams chat messages. You have a DLP policy that detects credit card numbers and blocks the message. However, users report that they can still send messages containing credit card numbers without any block. What is the most likely reason?

Accepted Answer

The DLP policy for Teams is only applied when external users are part of the chat.. DLP for Teams chat messages only scans messages that include at least one user from outside the organization (external users). If both sender and recipient are internal, the policy does not apply. Option B is incorrect because DLP policies can be scoped to specific users. Option C is incorrect because Teams DLP policies cover both chat and channel messages. Option D is incorrect because DLP policies apply to both persistent and transient messages.

Answer

The DLP policy does not apply to transient messages like chat.

Answer

The DLP policy is not configured to include the users' group.

Answer

The DLP policy only applies to channel messages, not private chats.