SC-900 Practice Exam 58 — 20 Questions

Question 1

A company is involved in litigation. The legal team needs to preserve all relevant electronic documents that reside in Exchange Online, SharePoint Online, and OneDrive for Business. They must prevent users from deleting or modifying these documents while the lawsuit is active. Additionally, they need to search across these locations for specific keywords and export the results for review. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Standard or Premium). Microsoft Purview eDiscovery (Standard or Premium) is the correct solution because it provides end-to-end workflow for legal holds (preservation), content search across Exchange Online, SharePoint Online, and OneDrive for Business, and export of results. The legal hold feature prevents deletion or modification by locking the original content, while the search and export capabilities meet the keyword search and review requirements.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management (retention policies/labels)

Answer

Microsoft Purview Data Loss Prevention (DLP)

Question 2

A company's security team needs to detect and investigate potential data theft by employees who have legitimate access to sensitive data. They want a solution that uses heuristics and behavioral analytics to identify risky user actions such as data exfiltration to personal cloud storage. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that may lead to data theft, using heuristics and behavioral analytics. It correlates signals from Microsoft 365 and Azure services to identify patterns like data exfiltration to personal cloud storage, which aligns directly with the scenario's requirements.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Information Barriers

Question 3

A company is involved in litigation and needs to preserve all Exchange Online mailboxes and SharePoint sites related to the case. The legal team also requires the ability to search, review, and export relevant content. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for preserving, searching, reviewing, and exporting content from Exchange Online mailboxes and SharePoint sites. It supports legal hold placement on custodians and data sources, advanced search with keyword and proximity queries, review sets with analytics, and export in a format suitable for litigation. This directly matches the requirement to preserve all relevant mailboxes and sites while enabling the legal team to search, review, and export content.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Premium)

Question 4

A company needs to automatically detect and protect sensitive information such as credit card numbers in emails sent from Exchange Online and documents stored in SharePoint Online. They want to create policies that can block emails if such data is detected, and also automatically encrypt documents with specific labels. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect sensitive information (e.g., credit card numbers) in Exchange Online emails and SharePoint Online documents, and then enforce protective actions such as blocking email transmission or applying encryption labels. DLP policies use sensitive information types and policy tips to identify and remediate data exposure risks across these workloads.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Question 5

A company wants to monitor Microsoft Teams messages and corporate emails for policy violations related to potential harassment and inappropriate behavior. They need a solution that allows them to define policies with conditions (e.g., keywords, patterns), automatically flag suspicious conversations, and optionally send notifications to the sender or escalate to a reviewer. Additionally, they need the ability to train employees when a minor violation is detected. Which Microsoft Purview solution should they use?

Accepted Answer

Communication Compliance. Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and corporate emails by scanning for keywords, patterns, and other conditions. It can automatically flag suspicious conversations, send notifications to the sender, escalate to a reviewer, and even train employees on minor violations through its built-in remediation workflows.

Answer

Data Loss Prevention (DLP)

Answer

Information Protection

Answer

Audit

Question 6

A company wants to monitor internal communications for inappropriate content such as harassment or threats, and also prevent employees from accidentally sharing credit card numbers via email. Which combination of Microsoft Purview solutions should they use?

Accepted Answer

Use Communication Compliance for harassment detection and DLP for preventing sharing of credit card numbers. Communication Compliance is designed to detect and investigate inappropriate internal communications (e.g., harassment, threats) by analyzing messages against customizable policies. Data Loss Prevention (DLP) is purpose-built to identify and prevent the accidental sharing of sensitive data, such as credit card numbers, by scanning content for predefined patterns (e.g., regex for credit card formats) and enforcing policy actions like blocking the email. Together, they address the two distinct requirements: Communication Compliance for behavioral monitoring and DLP for data protection.

Answer

Use Communication Compliance for both detecting harassment and preventing credit card sharing

Answer

Use Data Loss Prevention (DLP) for both detecting harassment and preventing credit card sharing

Answer

Use eDiscovery for both harassment detection and data leak prevention

Question 7

A compliance officer needs to automatically detect documents containing passport numbers in SharePoint Online and apply a retention label that retains the documents for 10 years before deleting them. They also want to prevent users from permanently deleting these documents before the retention period ends. Which Microsoft Purview solution should they use to achieve this?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it enables organizations to automatically apply retention labels to sensitive content—such as documents containing passport numbers—based on sensitive information types. It also enforces a retention period (10 years) and prevents users from permanently deleting documents before that period ends, meeting both the detection and preservation requirements.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 8

You are a security analyst using Microsoft Sentinel. You run the Kusto query shown in the exhibit. What does this query do?

Accepted Answer

Counts security alerts containing 'MFA' per day for the last 7 days. Option B is correct. The query filters alerts with 'MFA' in the name over the last 7 days, counts them per day, and renders a timechart. Option A is wrong because it counts alerts, not distinct users. Option C is wrong because it counts alerts, not identities. Option D is wrong because it doesn't filter by severity.

Answer

Lists all identities that triggered MFA alerts

Answer

Counts distinct users with MFA alerts per day

Answer

Counts alerts by severity over the last week

Question 9

A multinational corporation wants to detect scenarios where employees in the finance department are accessing and downloading customer credit card data from a CRM system and then emailing that data to personal accounts. The security team needs to define policies that identify this pattern of activity, analyze user behavior over time (e.g., building a user's baseline), and automatically escalate high-risk incidents for investigation. Which Microsoft Purview solution should they deploy?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is designed to detect risky user activities that violate organizational policies, such as accessing sensitive data and exfiltrating it via email. It uses machine learning to establish user baselines over time and automatically escalates high-risk incidents for investigation, directly matching the scenario's requirements.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery (Premium)

Question 10

A legal department is preparing for litigation. They need to preserve all potentially relevant content in Exchange Online, SharePoint Online, and Teams to prevent deletion or modification. Additionally, they must search across these locations for specific keywords and export the results for external review. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) is the correct solution because it provides the capabilities to place Exchange Online, SharePoint Online, and Teams content on legal hold to preserve it from deletion or modification, and it includes built-in search and export functions for litigation. This solution directly addresses the requirements for preservation, keyword search across multiple workloads, and export for external review.

Answer

Audit (Standard)

Answer

Data Lifecycle Management

Answer

Communication Compliance

Question 11

A healthcare organization uses Microsoft Purview to protect patient health information (PHI). They need to identify sensitive data stored in Microsoft SharePoint Online and prevent unauthorized sharing. Which two Purview solutions should they implement? (Select all that apply.)

Accepted Answer

Data Classification. Data Classification (A) is correct because it enables the organization to identify and label sensitive data, such as PHI, stored in SharePoint Online. By applying sensitivity labels or retention labels, the organization can classify content based on its sensitivity, which is a prerequisite for applying protective actions. This allows them to discover where PHI resides and prepare it for further controls.

Answer

Insider Risk Management

Answer

Communication Compliance

Question 12

A consulting firm is involved in a legal investigation. They need to preserve all emails and documents from two specific employees (custodians) related to a contract dispute. The data must be collected and stored in a secure location for legal review without modifying the original data. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing you to identify, preserve, collect, and analyze data from custodians (e.g., employees) without altering the original data. It places a legal hold on mailboxes and sites, ensuring that emails and documents related to the contract dispute are stored in a secure review location for legal review, meeting the requirement of non-modification.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Communication Compliance

Question 13

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user executes a specific command on Azure VMs. Which data source should you connect to capture the command execution logs?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Option C is correct because Azure Activity logs capture resource management operations, but command execution on VMs is captured by Windows Event Logs or Syslog. However, the best answer here is Windows Security Events via the Azure Monitor agent, which is option C. Option A is incorrect because Azure Activity log does not capture guest OS commands. Option B is incorrect because Office Activity logs are for Microsoft 365. Option D is incorrect because Azure AD audit logs are for identity events.

Answer

Office Activity log

Answer

Azure AD audit logs

Answer

Azure Activity log

Question 14

A compliance officer needs to evaluate their organization's security and compliance posture against multiple regulatory frameworks such as HIPAA, GDPR, and ISO 27001. The solution must provide a continuous assessment score, actionable improvement actions, and the ability to track implementation progress. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a continuous compliance assessment score against multiple regulatory frameworks (including HIPAA, GDPR, and ISO 27001), offers actionable improvement actions, and enables tracking of implementation progress through a centralized dashboard. It maps controls to specific regulations and generates a compliance score based on implemented controls, making it the only option that meets all stated requirements.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery

Question 15

A compliance officer is tasked with continuously assessing the organization's compliance posture against GDPR and ISO 27001. The solution should generate a compliance score based on implemented controls, provide recommended improvement actions, and track remediation progress over time. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Compliance Manager is the correct solution because it provides a continuous compliance score based on implemented controls, offers recommended improvement actions, and tracks remediation progress over time. It supports frameworks like GDPR and ISO 27001 by mapping controls to assessments and generating a dynamic score that reflects the organization's compliance posture.

Answer

Audit (Premium)

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 16

A multinational corporation must comply with several regulatory frameworks, including GDPR, SOX, and HIPAA. The compliance officer wants to continuously assess the organization's compliance posture against these regulations, receive prioritized improvement actions, and track the implementation progress of those actions. Which Microsoft Purview solution should the compliance officer use?

Accepted Answer

Compliance Manager. Compliance Manager is the correct solution because it provides a centralized dashboard for continuously assessing compliance posture against multiple regulatory frameworks (GDPR, SOX, HIPAA), generates prioritized improvement actions based on built-in assessments, and tracks implementation progress of those actions through a task-based workflow. It uses automated control mapping and continuous monitoring to help organizations meet evolving compliance requirements.

Answer

Information Protection

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Question 17

A financial services company needs to monitor employee communications in Microsoft Teams and Exchange Online for potential policy violations, such as sharing insider trading tips. They want to automatically detect specific keywords and phrases, and then allow designated reviewers to flag and escalate the messages. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in communications like Microsoft Teams chats and Exchange Online emails. It uses customizable policies to automatically scan for sensitive keywords and phrases (e.g., insider trading terms), and then routes flagged messages to designated reviewers for investigation, flagging, and escalation. This aligns directly with the requirement to monitor employee communications for policy violations and enable reviewer workflows.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview eDiscovery

Question 18

A security analyst needs to investigate a potential ransomware attack affecting multiple endpoints. They want to centralize detection and response across devices, email, and applications. Which Microsoft solution should they use?

Accepted Answer

Microsoft 365 Defender (now Microsoft Defender XDR). Microsoft Defender XDR (formerly Microsoft 365 Defender) provides unified detection and response across endpoints, email, identities, and applications. Microsoft Sentinel is a SIEM for broader security data. Defender for Cloud is for cloud workloads. Defender for Endpoint only covers endpoints.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud

Question 19

A financial services company uses Microsoft 365 and must comply with PCI DSS. They want to automatically prevent users from sending emails that contain credit card numbers to external recipients. If a user tries to send such an email, the system should block the message and notify the user with a policy tip. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive data, such as credit card numbers, in transit (e.g., email). DLP policies can be configured with conditions to match credit card number patterns (using a built-in sensitive info type) and set actions to block the message and display a policy tip to the sender, meeting the PCI DSS compliance requirement.

Answer

Communication Compliance

Answer

Information Protection

Answer

Insider Risk Management

Question 20

A company wants to create a sensitivity label called 'Highly Confidential' in Microsoft 365. When applied to a document, the label should automatically encrypt the document and restrict access to employees in the finance department only. Which Microsoft Purview solution should the administrator use to configure this label?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection is the correct solution because it provides the ability to create and configure sensitivity labels that enforce protection actions such as encryption and access restrictions. When a 'Highly Confidential' label is applied, it can automatically encrypt the document using Azure Rights Management (Azure RMS) and restrict access to only members of the finance department via a defined permission policy.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit