MS-102 Manage compliance by using Microsoft Purview Practice Test 8 — 15 Questions

Question 1

Which TWO actions can you perform using Microsoft Purview eDiscovery (Premium)? (Choose two.)

Accepted Answer

Place a legal hold on custodians' mailboxes and sites.. Options A and B are correct because Microsoft Purview eDiscovery (Premium) allows you to place a legal hold on custodians' mailboxes and sites (A), and export search results to a local computer for review (B). Option C is incorrect because creating and applying retention labels is a Records Management function, not eDiscovery. Option D is incorrect because automatically deleting emails is a retention policy feature, not eDiscovery. Option E is incorrect because configuring sensitivity labels is part of Information Protection, not eDiscovery.

Answer

Create and apply retention labels to documents.

Answer

Automatically delete emails older than a specified date.

Answer

Configure sensitivity labels to encrypt documents.

Question 2

Which TWO types of content can be reviewed using Microsoft Purview Communication Compliance? (Choose two.)

Accepted Answer

Exchange Online emails. Options A and D are correct because Microsoft Purview Communication Compliance can monitor Exchange Online emails and Yammer private messages for policy violations. Option B is incorrect because while Microsoft Teams chat messages are also monitored, they are not selected as one of the two in this question. Options C and E are incorrect: SharePoint Online files are not directly reviewed by Communication Compliance, and Viva Engage conversations are not supported as standalone sources.

Answer

Files stored in SharePoint Online

Answer

Yammer private messages

Answer

Viva Engage conversations

Question 3

Refer to the exhibit. You are a Microsoft Purview administrator. The exhibit shows the configuration of a sensitivity label. Users report that when they create a document containing a credit card number, the label is automatically applied, but the document is not encrypted. What is the most likely cause?

Accepted Answer

Auto-labeling does not apply encryption; encryption is only applied when the label is applied manually or via a client-side policy.. Auto-labeling in Microsoft Purview (server-side) does not automatically encrypt documents. Encryption via sensitivity labels is only applied when the label is applied manually by the user or through client-side auto-labeling (e.g., in Office apps). In this scenario, the auto-labeling is likely server-side, which applies the label but cannot enforce encryption. Therefore, option A is correct. Option B is incorrect because auto-labeling is enabled for the label (as shown in the exhibit). Option C is incorrect because a valid Rights Management template ID may be configured, but encryption is not applied due to the auto-labeling method. Option D is incorrect because the encryption setting is enabled in the label configuration.

Answer

Auto-labeling is not enabled for the label.

Answer

The Rights Management template ID is missing or invalid.

Answer

The encryption setting is not enabled in the label configuration.

Question 4

You are the compliance administrator for Contoso Ltd., a multinational corporation with 10,000 users. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Purview. The legal department requires that all email communications related to ongoing litigation be preserved for the duration of the case. You have identified the custodians and relevant keywords. You need to ensure that all relevant emails are preserved, regardless of whether users delete them. Additionally, you need to allow authorized reviewers to search and export the preserved emails without affecting the original data. Finally, you must ensure that the preservation is lifted automatically when the case is closed. What should you do?

Accepted Answer

Create an eDiscovery (Premium) case, add custodians, place them on hold, and use the case to search and export. Close the case to release the hold.. EDiscovery (Premium) provides case-based preservation (legal hold) that can be lifted when the case is closed. Option B is incorrect because retention labels require manual application or auto-labeling, which may not capture all relevant emails. Option C is incorrect because DLP does not preserve data. Option D is incorrect because litigation hold in Exchange is per-mailbox and not case-based.

Answer

Configure a DLP policy to protect sensitive data and preserve the emails.

Answer

Create a retention label with a preservation action and publish it to the entire organization.

Answer

Place an in-place hold on all mailboxes using the Exchange admin center.

Question 5

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You have a DLP policy that blocks sharing of documents containing personally identifiable information (PII) with external users. However, the HR department needs to share PII with a third-party benefits administrator for open enrollment. They request an exception that allows sharing only with the specific external domain 'benefits.contoso.com'. You need to implement the exception without weakening the overall policy. The solution must be centrally managed and auditable. What should you do?

Accepted Answer

Configure the existing DLP policy to allow override for the specific external domain by using an allow list.. You can configure an override in the existing DLP policy to allow sharing with the specific external domain 'benefits.contoso.com' by adding that domain to an allow list. This creates a centrally managed, auditable exception without weakening the overall policy. Option A is incorrect because creating a separate DLP policy with lower priority does not create an exception; all policies apply and may still block the sharing. Option B is incorrect because removing the HR department from the scope would disable all DLP protection for HR data, not just for the specific scenario. Option C is incorrect because modifying the sensitivity label affects encryption and classification, not DLP policy actions directly.

Answer

Create a separate DLP policy with a lower priority that allows sharing with the external domain.

Answer

Remove the HR department from the scope of the DLP policy.

Answer

Modify the sensitivity label used by HR to remove the encryption requirement.

Question 6

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive email. You have a DLP policy that blocks emails containing credit card numbers. However, users report that some legitimate emails with credit card numbers are being blocked, while others with similar content are allowed. You need to investigate the discrepancy and ensure consistent enforcement. What should you do first?

Accepted Answer

Enable policy tips in test mode for the DLP policy and instruct users to report false positives.. The best first step is to enable policy tips in test mode (Option D). Policy tips in test mode allow users to see a warning but do not block the email, enabling them to report false positives. This provides direct feedback on which legitimate emails are being flagged, helping to refine the policy without disrupting business. Option A (message trace) shows transport events but not DLP rule matches directly. Option B (audit log) records DLP actions but is time-consuming for initial investigation. Option C (DLP reports) shows aggregate data but lacks per-message details needed to identify false positives.

Answer

Use the Exchange admin center message trace to see if the emails were blocked by DLP.

Answer

Check the audit log for DLP rule matches to identify the specific emails blocked.

Answer

Review the DLP reports in the Microsoft Purview compliance portal to analyze the blocked emails.

Question 7

Your company is implementing Microsoft Purview Information Protection to classify and protect sensitive documents. You need to ensure that all documents containing personally identifiable information (PII) are automatically labeled. Which TWO actions should you take? (Select TWO.)

Accepted Answer

Define a custom sensitive info type in Microsoft Purview that matches your organization's PII patterns.. A custom sensitive info type allows the auto-labeling policy to detect PII patterns specific to your organization. Option E is correct because an auto-labeling policy automatically applies a sensitivity label to documents containing PII, meeting the requirement for automatic labeling. Option B is incorrect because manual labeling does not fulfill the need for automatic labeling. Option C is incorrect because encryption is a protection action that can be part of a sensitivity label, but the question is about labeling, not encryption. Option D is incorrect because retention labels are for managing data retention, not classification.

Answer

Train users to manually apply a sensitivity label to documents containing PII.

Answer

Configure a sensitivity label to encrypt documents containing PII.

Answer

Create a retention label for documents containing PII.

Question 8

Your organization is deploying Microsoft Purview Data Lifecycle Management to manage data retention and deletion. You need to design a retention policy for SharePoint Online sites that automatically deletes documents after 7 years, but allows users to manually delete documents earlier if needed. Which THREE actions should you take? (Select THREE.)

Accepted Answer

Create a retention policy with a retention rule that retains content for 7 years and then deletes it.. A retention policy with a retention rule set to retain for 7 years then delete meets the requirement to automatically delete after 7 years. Option C is correct because using preservation lock prevents changes to the retention policy, ensuring the policy remains enforced. Option E is correct because configuring a retention label that allows manual deletion and publishing it to SharePoint enables users to delete documents earlier if needed, while the automatic deletion still occurs after 7 years if not manually deleted. Option B is incorrect because setting a default retention label would apply to all documents automatically, overriding the manual deletion capability. Option D is incorrect because a file plan is used for records management and is not needed for simple retention and deletion; the scenario requires a retention label with manual deletion, not a file plan.

Answer

Set a default retention label for the SharePoint document library.

Answer

Create a file plan in Microsoft Purview Records Management for the documents.

Question 9

You are reviewing a Conditional Access policy JSON for your Microsoft Entra ID tenant. The first policy blocks access from high-risk IP addresses. The second policy requires MFA for all users from trusted locations. You notice that users from high-risk IP addresses are still prompted for MFA instead of being blocked. What is the most likely cause?

Accepted Answer

The block policy is set to report-only mode, so it is not enforced.. The most likely cause is that the block policy is set to report-only mode. In Microsoft Entra ID, Conditional Access policies in report-only mode are evaluated but not enforced. This means the block policy's conditions are checked, but it does not block access. Meanwhile, the grant policy (requiring MFA) is active and enforces MFA for all users from trusted locations. Since the high-risk IP users are not blocked, they fall through to the grant policy and receive MFA prompts.

Answer

The block policy does not specify MFA, so it is ignored.

Answer

The block policy has a lower priority than the grant policy.

Answer

The grant policy requires MFA for all users, overriding the block.

Question 10

You are the compliance administrator for Contoso Ltd., a multinational corporation with 10,000 users. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Purview Compliance Manager. The legal department requires that all contracts be retained for 10 years after the contract ends, and then be permanently deleted. Contracts are stored in a SharePoint Online site named 'Contracts'. The site already has a retention policy that retains all documents for 5 years. You need to configure additional retention settings to meet the legal requirement without disrupting existing retention. What should you do?

Accepted Answer

Create a retention label with a retention period of 10 years after contract end, and automatically apply it to contract documents using a sensitive info type or a custom condition.. A retention label can be applied automatically or manually to contracts, and it can have a longer retention period than the policy; the policy still applies for 5 years, but the label's retention takes precedence and extends to 10 years. Option B is wrong because creating a new policy would conflict and might cause unintended retention. Option C is wrong because a file plan is used for records management, not for extending retention. Option D is wrong because preservation lock prevents deletion but does not set retention period.

Answer

Create a file plan in Microsoft Purview Records Management and attach it to the Contracts site.

Answer

Modify the existing retention policy to retain content for 10 years instead of 5.

Answer

Apply a preservation hold to the Contracts site to prevent deletion until 10 years.

Question 11

Your organization, Fabrikam Inc., uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You have a DLP policy that blocks sharing of credit card numbers in Teams messages. Recently, users have reported that they cannot share legitimate credit card numbers for business purposes, even with customers. You need to allow users to override the block for legitimate sharing, but require them to provide a business justification. What should you configure?

Accepted Answer

Configure the DLP policy to show a policy tip that allows users to override the block with a business justification, and enable audit logging for overrides.. Configuring the DLP policy to show a policy tip allows users to override the block when they have a legitimate business need, and requiring a business justification ensures compliance while providing an audit trail. Option A is incorrect because creating a second policy with lower priority for authorized users is complex and doesn't allow per-message override with justification. Option B is incorrect because adding users to an exempt group removes the block entirely for them, which does not require justification. Option D is incorrect because allowing overrides without justification defeats the purpose of protecting sensitive data.

Answer

Create a second DLP policy with a lower priority that allows credit card sharing, and assign it to a security group containing authorized users.

Answer

Add the users to an exempt group in the DLP policy so they are not blocked.

Answer

Configure the DLP policy to allow overrides without justification, and monitor usage.

Question 12

Your company, Wingtip Toys, uses Microsoft Purview Audit (Standard) to track user activity. The compliance officer needs to investigate a potential data leak involving a user who may have accessed sensitive files in SharePoint Online. You need to search the audit log for file access events for that specific user over the past 30 days. The audit log contains millions of records. What is the most efficient way to retrieve the required audit records?

Accepted Answer

Use the Search-UnifiedAuditLog cmdlet in Exchange Online PowerShell with the -UserIds and -StartDate/-EndDate parameters.. Using Search-UnifiedAuditLog with the UserIds and StartDate/EndDate parameters efficiently filters for the specific user and time range. Option B is wrong because the Microsoft Purview compliance portal's audit log search page, while allowing filtering, can be less efficient than PowerShell for large volumes of records. Option C is wrong because exporting the entire audit log to a CSV file is inefficient and not recommended. Option D is wrong because Security & Compliance Center PowerShell is deprecated in favor of Exchange Online PowerShell.

Answer

Use the Microsoft Purview compliance portal audit log search page to filter by user and date range.

Answer

Export the entire audit log to a CSV file using the New-UnifiedAuditLog cmdlet, then filter in Excel.

Answer

Use the Security & Compliance Center PowerShell module with the Search-MailboxAuditLog cmdlet.

Question 13

Your organization, Contoso, uses Microsoft Purview Data Lifecycle Management to manage data retention. You have a retention policy that deletes emails in Exchange Online after 3 years. The legal department has started a litigation hold for a specific user, requiring that all the user's emails be preserved indefinitely. You need to ensure that the litigation hold takes precedence over the retention policy, and that no emails are deleted. What should you do?

Accepted Answer

Place the user's mailbox on litigation hold in the Exchange admin center.. Placing a user on litigation hold in Exchange Online preserves all mailbox content, including items subject to deletion policies; retention policies do not delete items under hold. Option B is wrong because preservation lock is for SharePoint/OneDrive, not for litigation hold. Option C is wrong because changing the retention policy would affect all users. Option D is wrong because a retention label does not override litigation hold; the hold already preserves.

Answer

Apply a retention label to all emails in the user's mailbox that prevents deletion.

Answer

Apply a preservation hold to the user's mailbox using Microsoft Purview Data Lifecycle Management.

Answer

Modify the retention policy to exclude the user's mailbox from the deletion action.

Question 14

Your organization uses Microsoft Purview Communication Compliance to detect inappropriate messages in Microsoft Teams. You need to configure a policy that monitors for potential harassment based on a built-in classifier. The policy should alert designated reviewers when a match is found. What is the minimum configuration required?

Accepted Answer

Create a communication compliance policy, select the built-in harassment classifier, specify the users to monitor, and assign reviewers.. The minimum configuration to monitor for potential harassment using Communication Compliance is to create a communication compliance policy, select the built-in harassment classifier, specify the users to monitor, and assign reviewers. No retention policy, DLP policy, or sensitivity label is required.

Answer

Create a retention policy for Teams messages, then create a communication compliance policy with the harassment classifier.

Answer

Create a DLP policy that blocks harassment, then configure communication compliance to review DLP alerts.

Answer

Apply a sensitivity label to all Teams messages, then create a communication compliance policy that scans for the label.

Question 15

A compliance officer needs to automatically retain emails that contain personally identifiable information (PII) for 10 years and then permanently delete them. Which Microsoft Purview feature should be configured?

Accepted Answer

Auto-apply retention labels based on sensitive information types. Auto-apply retention labels based on sensitive information types allow you to automatically classify and retain emails containing PII for a specified period (10 years) and then permanently delete them. This feature uses sensitive information types (e.g., Social Security Number, Credit Card Number) to detect PII and applies a retention label that enforces the retention and deletion actions at the item level, which is required for targeted compliance scenarios.

Answer

Data Lifecycle Management retention policy

Answer

Data classification

Answer

eDiscovery