MS-102 Manage compliance by using Microsoft Purview Practice Test 11 — 15 Questions

Question 1

Your organization uses Microsoft Purview Communication Compliance to detect inappropriate messages in Microsoft Teams. You need to define policies that automatically detect and review messages containing profanity or harassment. Which built-in classifier should you use?

Accepted Answer

Harassment classifier. Option B is correct because the 'Harassment' classifier is specifically designed to detect harassing or threatening language. Option A is incorrect because the 'Profanity' classifier only detects swear words, not harassment. Option C is incorrect because the 'Sensitive info types' classifier detects sensitive data like credit cards, not harassment. Option D is incorrect because the 'Threat' classifier detects threats, which is narrower than harassment.

Answer

Sensitive info types classifier

Answer

Profanity classifier

Answer

Threat classifier

Question 2

Which TWO actions can you perform using Microsoft Purview eDiscovery (Premium)? (Choose two.)

Accepted Answer

Place a legal hold on custodians' mailboxes and sites.. Options A and D are correct because eDiscovery (Premium) allows you to hold content in place (legal hold) and export search results for review. Option B is incorrect because eDiscovery does not automatically delete content; that is retention. Option C is incorrect because eDiscovery does not create retention labels. Option E is incorrect because eDiscovery does not manage sensitivity labels.

Answer

Create and apply retention labels to documents.

Answer

Automatically delete emails older than a specified date.

Answer

Configure sensitivity labels to encrypt documents.

Question 3

Which THREE components are required to implement Microsoft Purview Data Lifecycle Management for Microsoft 365? (Choose three.)

Accepted Answer

Retention labels. Options A, B, and C are correct because retention labels, policies, and file plan are core components. Option D is incorrect because sensitivity labels are part of Information Protection, not Data Lifecycle Management. Option E is incorrect because DLP is a separate solution.

Answer

Sensitivity labels

Answer

Data loss prevention policies

Question 4

Which TWO types of content can be reviewed using Microsoft Purview Communication Compliance? (Choose two.)

Accepted Answer

Exchange Online emails. Options B and E are correct because Communication Compliance can review Microsoft Teams messages and email messages. Option A is incorrect because SharePoint files are not directly reviewed by Communication Compliance; they are covered by DLP. Option C is incorrect because Yammer is not currently supported. Option D is incorrect because Viva Engage messages may be reviewed if they are part of Teams or email, but not as a standalone source.

Answer

Files stored in SharePoint Online

Answer

Yammer private messages

Answer

Viva Engage conversations

Question 5

Refer to the exhibit. You are a Microsoft Purview administrator. The exhibit shows the configuration of a sensitivity label. Users report that when they create a document containing a credit card number, the label is automatically applied, but the document is not encrypted. What is the most likely cause?

Accepted Answer

Auto-labeling does not apply encryption; encryption is only applied when the label is applied manually or via a client-side policy.. Option C is correct because auto-labeling does not automatically encrypt documents; encryption is applied only when the user manually selects the label or when the label is applied via a client-side auto-labeling policy that supports encryption. Option A is incorrect because the encryption setting is enabled in the label configuration. Option B is incorrect because the Rights Management template ID is specified. Option D is incorrect because auto-labeling is enabled.

Answer

Auto-labeling is not enabled for the label.

Answer

The Rights Management template ID is missing or invalid.

Answer

The encryption setting is not enabled in the label configuration.

Question 6

You are the compliance administrator for Contoso Ltd., a multinational corporation with 10,000 users. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Purview. The legal department requires that all email communications related to ongoing litigation be preserved for the duration of the case. You have identified the custodians and relevant keywords. You need to ensure that all relevant emails are preserved, regardless of whether users delete them. Additionally, you need to allow authorized reviewers to search and export the preserved emails without affecting the original data. Finally, you must ensure that the preservation is lifted automatically when the case is closed. What should you do?

Accepted Answer

Create an eDiscovery (Premium) case, add custodians, place them on hold, and use the case to search and export. Close the case to release the hold.. Option A is correct because eDiscovery (Premium) provides case-based preservation (legal hold) that can be lifted when the case is closed. Option B is incorrect because retention labels require manual application or auto-labeling, which may not capture all relevant emails. Option C is incorrect because DLP does not preserve data. Option D is incorrect because litigation hold in Exchange is per-mailbox and not case-based.

Answer

Configure a DLP policy to protect sensitive data and preserve the emails.

Answer

Create a retention label with a preservation action and publish it to the entire organization.

Answer

Place an in-place hold on all mailboxes using the Exchange admin center.

Question 7

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You have a DLP policy that blocks sharing of documents containing personally identifiable information (PII) with external users. However, the HR department needs to share PII with a third-party benefits administrator for open enrollment. They request an exception that allows sharing only with the specific external domain 'benefits.contoso.com'. You need to implement the exception without weakening the overall policy. The solution must be centrally managed and auditable. What should you do?

Accepted Answer

Configure the existing DLP policy to allow override for the specific external domain by using an allow list.. Option B is correct because you can create a DLP policy override that allows sharing with the specific domain by configuring an allow list. Option A is incorrect because creating a separate policy with lower priority does not create an exception; all policies apply. Option C is incorrect because modifying the sensitivity label does not affect DLP. Option D is incorrect because excluding HR from the policy would remove protection for all HR data, not just for the specific scenario.

Answer

Create a separate DLP policy with a lower priority that allows sharing with the external domain.

Answer

Remove the HR department from the scope of the DLP policy.

Answer

Modify the sensitivity label used by HR to remove the encryption requirement.

Question 8

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive email. You have a DLP policy that blocks emails containing credit card numbers. However, users report that some legitimate emails with credit card numbers are being blocked, while others with similar content are allowed. You need to investigate the discrepancy and ensure consistent enforcement. What should you do first?

Accepted Answer

Enable policy tips in test mode for the DLP policy and instruct users to report false positives.. Option A is correct because DLP policy tips in test mode allow you to see what would be blocked without actually blocking, helping identify false positives. Option B (DLP reports in Purview compliance portal) shows aggregate data but not per-user false positives. Option C (Message trace) does not show DLP policy matches. Option D (Audit log) records DLP actions but is not the most efficient first step for troubleshooting false positives.

Answer

Use the Exchange admin center message trace to see if the emails were blocked by DLP.

Answer

Check the audit log for DLP rule matches to identify the specific emails blocked.

Answer

Review the DLP reports in the Microsoft Purview compliance portal to analyze the blocked emails.

Question 9

Your company is implementing Microsoft Purview Information Protection to classify and protect sensitive documents. You need to ensure that all documents containing personally identifiable information (PII) are automatically labeled. Which TWO actions should you take? (Select TWO.)

Accepted Answer

Define a custom sensitive info type in Microsoft Purview that matches your organization's PII patterns.. Option A is correct because automatic labeling policies can apply sensitivity labels based on sensitive info types. Option D is correct because creating a sensitive info type for PII (e.g., using custom patterns) ensures the policy can detect the data. Option B is wrong because encryption is a protection action, not a labeling requirement. Option C is wrong because manual labeling does not meet the requirement for automatic labeling. Option E is wrong because retention labels are for retention, not classification.

Answer

Train users to manually apply a sensitivity label to documents containing PII.

Answer

Configure a sensitivity label to encrypt documents containing PII.

Answer

Create a retention label for documents containing PII.

Question 10

Your organization is deploying Microsoft Purview Data Lifecycle Management to manage data retention and deletion. You need to design a retention policy for SharePoint Online sites that automatically deletes documents after 7 years, but allows users to manually delete documents earlier if needed. Which THREE actions should you take? (Select THREE.)

Accepted Answer

Create a retention policy with a retention rule that retains content for 7 years and then deletes it.. Option A is correct because a retention policy with a retention rule set to 7 years and then delete meets the requirement. Option C is correct because using preservation lock prevents changes to the policy. Option D is correct because enabling a retention label for manual application allows users to override the policy by applying a label that allows deletion. Option B is wrong because a file plan is used for records management, not for this scenario. Option E is wrong because a default label would apply automatically, conflicting with the manual override requirement.

Answer

Set a default retention label for the SharePoint document library.

Answer

Create a file plan in Microsoft Purview Records Management for the documents.

Question 11

You are reviewing a Conditional Access policy JSON for your Microsoft Entra ID tenant. The first policy blocks access from high-risk IP addresses. The second policy requires MFA for all users from trusted locations. You notice that users from high-risk IP addresses are still prompted for MFA instead of being blocked. What is the most likely cause?

Accepted Answer

The block policy is set to report-only mode, so it is not enforced.. Option B is correct because Conditional Access policies are evaluated in priority order; if the block policy has a lower priority than the grant policy, the grant policy could apply first. However, in this exhibit, the block policy has priority 1 and the grant policy has priority 2, so the block should apply first. But the issue is that the grant policy's condition includes locations 'AllTrusted', and the block policy's condition includes 'HighRiskIP'. If a user is from a high-risk IP that is also considered 'trusted'? That is unlikely. Another possibility: the block policy action is 'BlockAccess' but if the user is not meeting the conditions? Actually, the exhibit shows that the block policy has priority 1, which is lower number (higher priority). So the block should apply. But the user is getting MFA prompt instead of block. This could happen if the block policy is in report-only mode, but the JSON doesn't show a state. In real exam, they might expect that the block policy has a higher priority (lower number) but the grant policy might be evaluated first due to scope? Actually, Conditional Access evaluates all policies that apply. If both apply, block takes precedence. However, if the block policy's condition does not match (e.g., the location is not recognized as HighRiskIP), then only the grant policy applies. So the most likely cause is that the location condition in the block policy is not correctly matching the user's IP. But option B says the block policy is set to report-only mode, which is a common reason for not enforcing. Since the JSON does not include a state, it could be report-only. Option A (priority) is wrong because priority 1 is higher than 2. Option C (MFA required) is not the cause. Option D (block policy missing MFA) is irrelevant. So B is plausible. However, in real scenario, if the block policy is in report-only, it won't block. So I'll go with B.

Answer

The block policy does not specify MFA, so it is ignored.

Answer

The block policy has a lower priority than the grant policy.

Answer

The grant policy requires MFA for all users, overriding the block.

Question 12

You are the compliance administrator for Contoso Ltd., a multinational corporation with 10,000 users. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Purview Compliance Manager. The legal department requires that all contracts be retained for 10 years after the contract ends, and then be permanently deleted. Contracts are stored in a SharePoint Online site named 'Contracts'. The site already has a retention policy that retains all documents for 5 years. You need to configure additional retention settings to meet the legal requirement without disrupting existing retention. What should you do?

Accepted Answer

Create a retention label with a retention period of 10 years after contract end, and automatically apply it to contract documents using a sensitive info type or a custom condition.. Option A is correct because a retention label can be applied automatically or manually to contracts, and it can have a longer retention period than the policy; the policy still applies for 5 years, but the label's retention takes precedence and extends to 10 years. Option B is wrong because creating a new policy would conflict and might cause unintended retention. Option C is wrong because a file plan is used for records management, not for extending retention. Option D is wrong because preservation lock prevents deletion but does not set retention period.

Answer

Create a file plan in Microsoft Purview Records Management and attach it to the Contracts site.

Answer

Modify the existing retention policy to retain content for 10 years instead of 5.

Answer

Apply a preservation hold to the Contracts site to prevent deletion until 10 years.

Question 13

Your organization, Fabrikam Inc., uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You have a DLP policy that blocks sharing of credit card numbers in Teams messages. Recently, users have reported that they cannot share legitimate credit card numbers for business purposes, even with customers. You need to allow users to override the block for legitimate sharing, but require them to provide a business justification. What should you configure?

Accepted Answer

Configure the DLP policy to show a policy tip that allows users to override the block with a business justification, and enable audit logging for overrides.. Option B is correct because policy tips with override options allow users to override the block and provide justification, and the admin can review the override in audit logs. Option A is wrong because allowing all overrides without justification defeats the purpose. Option C is wrong because a separate policy for exceptions would be complex and not user-friendly. Option D is wrong because exempting specific users does not allow per-message override.

Answer

Create a second DLP policy with a lower priority that allows credit card sharing, and assign it to a security group containing authorized users.

Answer

Add the users to an exempt group in the DLP policy so they are not blocked.

Answer

Configure the DLP policy to allow overrides without justification, and monitor usage.

Question 14

Your company, Wingtip Toys, uses Microsoft Purview Audit (Standard) to track user activity. The compliance officer needs to investigate a potential data leak involving a user who may have accessed sensitive files in SharePoint Online. You need to search the audit log for file access events for that specific user over the past 30 days. The audit log contains millions of records. What is the most efficient way to retrieve the required audit records?

Accepted Answer

Use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell with the -UserIds and -StartDate/-EndDate parameters.. Option A is correct because using Search-UnifiedAuditLog with the UserIds and StartDate/EndDate parameters efficiently filters for the specific user and time range. Option B is wrong because exporting all records is inefficient. Option C is wrong because the Purview compliance portal's audit log search allows filtering but is less efficient than PowerShell for large volumes. Option D is wrong because Security & Compliance Center PowerShell is deprecated in favor of Exchange Online PowerShell.

Answer

Use the Microsoft Purview compliance portal audit log search page to filter by user and date range.

Answer

Export the entire audit log to a CSV file using the New-UnifiedAuditLog cmdlet, then filter in Excel.

Answer

Use the Security & Compliance Center PowerShell module with the Search-MailboxAuditLog cmdlet.

Question 15

Your organization, Contoso, uses Microsoft Purview Data Lifecycle Management to manage data retention. You have a retention policy that deletes emails in Exchange Online after 3 years. The legal department has started a litigation hold for a specific user, requiring that all the user's emails be preserved indefinitely. You need to ensure that the litigation hold takes precedence over the retention policy, and that no emails are deleted. What should you do?

Accepted Answer

Place the user's mailbox on litigation hold in the Exchange admin center.. Option A is correct because placing a user on litigation hold in Exchange Online preserves all mailbox content, including items subject to deletion policies; retention policies do not delete items under hold. Option B is wrong because preservation lock is for SharePoint/OneDrive, not for litigation hold. Option C is wrong because changing the retention policy would affect all users. Option D is wrong because a retention label does not override litigation hold; the hold already preserves.

Answer

Apply a retention label to all emails in the user's mailbox that prevents deletion.

Answer

Apply a preservation hold to the user's mailbox using Microsoft Purview Data Lifecycle Management.

Answer

Modify the retention policy to exclude the user's mailbox from the deletion action.