MS-102 Manage compliance by using Microsoft Purview Practice Test 5 — 15 Questions

Question 1

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive email. You have a DLP policy that blocks emails containing credit card numbers. However, users report that some legitimate emails with credit card numbers are being blocked, while others with similar content are allowed. You need to investigate the discrepancy and ensure consistent enforcement. What should you do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable policy tips in test mode for the DLP policy and instruct users to report false positives.. The best first step is to enable policy tips in test mode (Option D). Policy tips in test mode allow users to see a warning but do not block the email, enabling them to report false positives. This provides direct feedback on which legitimate emails are being flagged, helping to refine the policy without disrupting business. Option A (message trace) shows transport events but not DLP rule matches directly. Option B (audit log) records DLP actions but is time-consuming for initial investigation. Option C (DLP reports) shows aggregate data but lacks per-message details needed to identify false positives.

Answer

Use the Exchange admin center message trace to see if the emails were blocked by DLP.

Answer

Check the audit log for DLP rule matches to identify the specific emails blocked.

Answer

Review the DLP reports in the Microsoft Purview compliance portal to analyze the blocked emails.

Question 2

Your organization is deploying Microsoft Purview Data Lifecycle Management to manage data retention and deletion. You need to design a retention policy for SharePoint Online sites that automatically deletes documents after 7 years, but allows users to manually delete documents earlier if needed. Which THREE actions should you take? (Select THREE.)

Accepted Answer

Create a retention policy with a retention rule that retains content for 7 years and then deletes it.. A retention policy with a retention rule set to retain for 7 years then delete meets the requirement to automatically delete after 7 years. Option C is correct because using preservation lock prevents changes to the retention policy, ensuring the policy remains enforced. Option E is correct because configuring a retention label that allows manual deletion and publishing it to SharePoint enables users to delete documents earlier if needed, while the automatic deletion still occurs after 7 years if not manually deleted. Option B is incorrect because setting a default retention label would apply to all documents automatically, overriding the manual deletion capability. Option D is incorrect because a file plan is used for records management and is not needed for simple retention and deletion; the scenario requires a retention label with manual deletion, not a file plan.

Answer

Set a default retention label for the SharePoint document library.

Answer

Create a file plan in Microsoft Purview Records Management for the documents.

Question 3

You are reviewing a Conditional Access policy JSON for your Microsoft Entra ID tenant. The first policy blocks access from high-risk IP addresses. The second policy requires MFA for all users from trusted locations. You notice that users from high-risk IP addresses are still prompted for MFA instead of being blocked. What is the most likely cause?

Accepted Answer

The block policy is set to report-only mode, so it is not enforced.. The most likely cause is that the block policy is set to report-only mode. In Microsoft Entra ID, Conditional Access policies in report-only mode are evaluated but not enforced. This means the block policy's conditions are checked, but it does not block access. Meanwhile, the grant policy (requiring MFA) is active and enforces MFA for all users from trusted locations. Since the high-risk IP users are not blocked, they fall through to the grant policy and receive MFA prompts.

Answer

The block policy does not specify MFA, so it is ignored.

Answer

The block policy has a lower priority than the grant policy.

Answer

The grant policy requires MFA for all users, overriding the block.

Question 4

You are the compliance administrator for Contoso Ltd., a multinational corporation with 10,000 users. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Purview Compliance Manager. The legal department requires that all contracts be retained for 10 years after the contract ends, and then be permanently deleted. Contracts are stored in a SharePoint Online site named 'Contracts'. The site already has a retention policy that retains all documents for 5 years. You need to configure additional retention settings to meet the legal requirement without disrupting existing retention. What should you do?

Accepted Answer

Create a retention label with a retention period of 10 years after contract end, and automatically apply it to contract documents using a sensitive info type or a custom condition.. Creating a retention label with a 10-year retention period after contract end and automatically applying it to contract documents using a sensitive info type or custom condition meets the legal requirement without disrupting the existing 5-year retention policy. Retention labels can override or supplement existing policies, and the label ensures permanent deletion after the retention period.

Answer

Create a file plan in Microsoft Purview Records Management and attach it to the Contracts site.

Answer

Modify the existing retention policy to retain content for 10 years instead of 5.

Answer

Apply a preservation hold to the Contracts site to prevent deletion until 10 years.

Question 5

Your company, Wingtip Toys, uses Microsoft Purview Audit (Standard) to track user activity. The compliance officer needs to investigate a potential data leak involving a user who may have accessed sensitive files in SharePoint Online. You need to search the audit log for file access events for that specific user over the past 30 days. The audit log contains millions of records. What is the most efficient way to retrieve the required audit records?

Accepted Answer

Use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell with the -UserIds and -StartDate/-EndDate parameters.. Using Search-UnifiedAuditLog with the UserIds and StartDate/EndDate parameters efficiently filters for the specific user and time range. Option B is wrong because the Microsoft Purview compliance portal's audit log search page, while allowing filtering, can be less efficient than PowerShell for large volumes of records. Option C is wrong because exporting the entire audit log to a CSV file is inefficient and not recommended. Option D is wrong because Security & Compliance Center PowerShell is deprecated in favor of Exchange Online PowerShell.

Answer

Use the Microsoft Purview compliance portal audit log search page to filter by user and date range.

Answer

Export the entire audit log to a CSV file using the New-UnifiedAuditLog cmdlet, then filter in Excel.

Answer

Use the Security & Compliance Center PowerShell module with the Search-MailboxAuditLog cmdlet.

Question 6

Your organization, Contoso, uses Microsoft Purview Data Lifecycle Management to manage data retention. You have a retention policy that deletes emails in Exchange Online after 3 years. The legal department has started a litigation hold for a specific user, requiring that all the user's emails be preserved indefinitely. You need to ensure that the litigation hold takes precedence over the retention policy, and that no emails are deleted. What should you do?

Accepted Answer

Place the user's mailbox on litigation hold in the Exchange admin center.. In Exchange Online, placing a mailbox on litigation hold (via the Exchange admin center or PowerShell) preserves all mailbox content indefinitely, even if a retention policy would otherwise delete items. Litigation hold takes precedence over retention policies because it is a legal hold that overrides automated deletion. This ensures no emails are deleted.

Answer

Apply a retention label to all emails in the user's mailbox that prevents deletion.

Answer

Apply a preservation hold to the user's mailbox using Microsoft Purview Data Lifecycle Management.

Answer

Modify the retention policy to exclude the user's mailbox from the deletion action.

Question 7

You are the Microsoft 365 administrator for Contoso Ltd. The compliance team creates a sensitivity label named 'Confidential' in Microsoft Purview. They need the label to be available in Office apps on the web and desktop for all users, and to automatically apply to documents that contain the term 'ProjectX' when users save them to SharePoint Online. The team has already published the label to all users. You need to configure the label to meet the automatic application requirement. What should you do?

Accepted Answer

Enable auto-labeling for the sensitivity label and create an auto-labeling policy in Microsoft Purview that uses a custom sensitive info type or trainable classifier to detect 'ProjectX' in SharePoint Online locations.. Auto-labeling policies in Microsoft Purview are designed to automatically apply sensitivity labels to content based on sensitive information types or trainable classifiers. By creating such a policy targeting SharePoint Online and using a custom sensitive info type or classifier to detect 'ProjectX', the label is applied seamlessly when documents are saved or modified.

Answer

Configure a data loss prevention (DLP) policy in Microsoft Purview that detects 'ProjectX' and applies the 'Confidential' sensitivity label as a remediation action.

Answer

Create a retention label that automatically applies to content containing 'ProjectX' and then map the retention label to the 'Confidential' sensitivity label.

Answer

Use a PowerShell script that scans SharePoint Online document libraries for the term 'ProjectX' and applies the 'Confidential' sensitivity label via the Microsoft Graph API.

Question 8

You are the Microsoft 365 administrator for Litware Inc. The security team wants to detect when users share files from SharePoint Online with anonymous guest links that contain documents labeled 'Confidential'. You need to configure a Microsoft Purview solution that triggers an alert when such sharing occurs. What should you create?

Accepted Answer

An alert policy in Microsoft Purview that uses the 'Shared file with external user' activity and a sensitive information type condition.. The requirement is to detect and alert when a labeled document is shared via anonymous guest links from SharePoint Online. Microsoft Purview alert policies can monitor the 'Shared file with external user' activity and apply conditions based on sensitive information types or sensitivity labels. This provides the exact detection capability needed without blocking user actions, unlike DLP or communication compliance.

Answer

A communication compliance policy that monitors Teams messages for confidential keywords.

Answer

A data loss prevention (DLP) policy for SharePoint sites and OneDrive accounts.

Answer

An insider risk management policy with a 'Data leaks' template.

Question 9

You are the Microsoft 365 administrator for Contoso Ltd. The legal team must ensure that all email messages sent and received by the CEO are preserved for exactly seven years, after which they can be permanently deleted. The CEO uses Exchange Online with an E5 license. You need to implement a solution that meets these requirements with minimal administrative effort. What should you do?

Accepted Answer

Create a retention policy in Microsoft Purview that applies a 7-year retain-then-delete rule to the CEO's mailbox.. A retention policy applied directly to the CEO's mailbox enforces a consistent retain-then-delete rule across all mailbox content without user action. It automatically removes items after seven years, meeting both legal preservation and disposal needs. This is the simplest, most reliable method for a single-mailbox scope.

Answer

Create a retention label with a 7-year retention period and publish it to the CEO.

Answer

Configure an Exchange Online mail flow rule to journal all CEO emails to a third-party archive.

Answer

Place the CEO's mailbox on Litigation Hold indefinitely.

Question 10

You are the Microsoft 365 administrator for Contoso Ltd. A compliance officer needs to ensure that all email messages sent by the legal department are retained for seven years, even if users delete them. The messages must be preserved in their original form and easily searchable by the compliance team. What should you create?

Accepted Answer

A Microsoft Purview retention policy that applies to the legal department's mailboxes with a retention period of seven years and no deletion at the end.. A retention policy in Microsoft Purview Data Lifecycle Management is the correct tool to retain Exchange Online email for a specified period regardless of user actions. By applying the policy to the legal department mailboxes and setting a seven-year retention period with no deletion, the organization ensures that messages are preserved and remain searchable for compliance purposes.

Answer

A Microsoft Purview eDiscovery hold on the legal department mailboxes.

Answer

A data loss prevention (DLP) policy that blocks deletion of emails containing legal keywords.

Answer

An Exchange Online journaling rule that sends copies of all legal department emails to a dedicated mailbox.

Question 11

A compliance officer needs to automatically retain emails that contain personally identifiable information (PII) for 10 years and then permanently delete them. Which Microsoft Purview feature should be configured?

Accepted Answer

Auto-apply retention labels based on sensitive information types. Auto-apply retention labels based on sensitive information types allow you to automatically classify and retain emails containing PII for a specified period (10 years) and then permanently delete them. This feature uses sensitive information types (e.g., Social Security Number, Credit Card Number) to detect PII and applies a retention label that enforces the retention and deletion actions at the item level, which is required for targeted compliance scenarios.

Answer

Data Lifecycle Management retention policy

Answer

Data classification

Answer

eDiscovery

Question 12

A compliance officer needs to prevent external users from printing or copying content from documents stored in a SharePoint Online site. Which Microsoft Purview feature should be configured to enforce this restriction?

Accepted Answer

Sensitivity labels with encryption and usage rights. Sensitivity labels with encryption and usage rights allow administrators to apply Azure Rights Management (Azure RMS) protection to documents, which can restrict actions such as printing and copying. By configuring a sensitivity label with specific usage rights (e.g., 'View Only' or disabling 'Extract' and 'Print'), external users are prevented from printing or copying content even after the document is downloaded or accessed in SharePoint Online. This is the only Purview feature that directly enforces persistent content-level restrictions on external users.

Answer

Data Loss Prevention (DLP) policy

Answer

Information Barriers

Answer

Microsoft Purview Information Protection without encryption

Question 13

A compliance officer needs to automatically classify documents in SharePoint Online that contain credit card numbers. The classification should apply a label that restricts access and adds a header. Which two Microsoft Purview features must be configured? (Choose two.)

Accepted Answer

Sensitivity labels. Sensitivity labels are correct because they are the Microsoft Purview feature that applies classification markings (such as headers and footers) and encryption or access restrictions to documents. For this scenario, a sensitivity label must be configured to enforce the required header and access restrictions on content containing credit card numbers.

Answer

Retention labels

Answer

Data Loss Prevention (DLP) policies

Question 14

A compliance administrator needs to ensure that all documents in a SharePoint library are retained for exactly 7 years and then allow users to manually dispose of them sooner after a review. What should they configure in Microsoft Purview?

Accepted Answer

Create a retention label with a retention period of 7 years and enable disposition review. The requirement specifies a fixed 7-year retention period followed by user-initiated disposal after a review. A retention label with a retention period of 7 years and disposition review enabled allows content to be retained for exactly 7 years, after which a disposition review triggers a manual approval process for disposal. This matches the need for both mandatory retention and manual disposal after review.

Answer

Create a retention label with a retention period of 7 years and no additional action

Answer

Create a sensitivity label that restricts access

Answer

Create a record label

Question 15

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to create a policy that blocks users from pasting credit card numbers into web forms in Microsoft Edge. Which type of DLP policy should they configure?

Accepted Answer

Endpoint DLP. Endpoint DLP is correct because it monitors and controls activities on Windows 10/11 and macOS endpoints, including the ability to block pasting sensitive data like credit card numbers into web forms in Microsoft Edge. This policy extends DLP protection to unmanaged browsers and specific user actions, such as paste, clipboard, and print, which are not covered by cloud-based DLP policies.

Answer

Exchange DLP

Answer

SharePoint DLP

Answer

Teams DLP