SC-900 Describe the capabilities of Microsoft compliance solutions — 20 Questions

Question 1

A healthcare organization uses Microsoft Purview to protect patient health information (PHI). They need to identify sensitive data stored in Microsoft SharePoint Online and prevent unauthorized sharing. Which two Purview solutions should they implement? (Select all that apply.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Classification. Data Classification (A) is correct because it enables the organization to identify and label sensitive data, such as PHI, stored in SharePoint Online. By applying sensitivity labels or retention labels, the organization can classify content based on its sensitivity, which is a prerequisite for applying protective actions. This allows them to discover where PHI resides and prepare it for further controls.

Data Loss Prevention (DLP) (B) is correct because it allows the organization to create and enforce policies that prevent sensitive data, once identified and classified, from being shared inappropriately or externally. DLP policies can detect PHI in SharePoint Online and block, warn, or encrypt content based on policy rules, thereby preventing unauthorized sharing.

Answer

Insider Risk Management

Answer

Communication Compliance

Question 2

A law firm uses Microsoft 365 and has two legal teams working on opposing sides of the same lawsuit. The compliance officer needs to prevent any communication (email, Teams chat, file sharing) between the two teams. Additionally, the firm must block emails containing the case name from being sent outside the organization. Which two Microsoft Purview solutions should be configured to meet these requirements? (Choose two.)

Accepted Answer

Microsoft Purview Information Barriers. Microsoft Purview Information Barriers (A) is correct because it is specifically designed to prevent communication and collaboration between two groups within an organization, such as legal teams on opposing sides of a lawsuit. It enforces policies that block email, Teams chat, and file sharing between the defined segments, directly meeting the first requirement. Microsoft Purview Data Loss Prevention (DLP) (B) is correct because it allows organizations to identify, monitor, and protect sensitive information. A DLP policy can be configured to detect specific content (like the case name) in emails and block them from being sent outside the organization, directly addressing the second requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit (Standard)

Question 3

A government agency has extremely sensitive classified data that must be protected even from Microsoft. They require a solution where the encryption keys are stored and managed on-premises within their own hardware security module (HSM), ensuring that Microsoft cannot decrypt their data. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Customer Key. Microsoft Purview Customer Key is the correct solution because it allows customers to provide and manage their own encryption keys. These keys can be generated in an on-premises hardware security module (HSM) and then securely imported into Azure Key Vault, where they are stored and managed. Azure Key Vault itself is backed by FIPS 140-2 Level 2 validated HSMs. This ensures that Microsoft cannot access the encrypted data, as the keys are under the customer's control, meeting the requirement for protecting classified data even from Microsoft.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Communication Compliance

Question 4

A security team is investigating a data exfiltration incident. They need to see detailed events such as when a user accessed a file, the exact action (read, write, delete), and the file name. They also need to perform custom searches across all users. Which Microsoft Purview audit solution should they use to meet these requirements?

Accepted Answer

Audit (Premium). Audit (Premium) is the correct choice because it provides enhanced audit logging capabilities, including longer retention (1 year vs. 90 days in Standard) which is crucial for in-depth investigations like data exfiltration. It also offers access to higher-value audit events across various services, providing more comprehensive and potentially more granular details for specific actions (e.g., MailItemsAccessed for Exchange mailboxes) that are critical for forensic analysis. While Audit (Standard) provides basic audit logs, Audit (Premium) is specifically designed for advanced forensic and compliance investigations requiring deeper insights and extended historical data.

Answer

Audit (Standard)

Answer

eDiscovery (Standard)

Answer

Communication Compliance

Question 5

A financial organization needs to automatically detect documents containing credit card numbers in SharePoint Online and apply a sensitivity label that encrypts the document and restricts editing to internal users. The label must also be automatically assigned when the sensitive content is detected. Which Microsoft Purview solution should they configure?

Accepted Answer

Information Protection (Sensitivity Labels). Microsoft Purview Information Protection (sensitivity labels) supports automatic labeling based on sensitive content types (e.g., credit card numbers) using built-in or custom sensitive info types. When configured with auto-labeling policies, the label can be applied automatically in SharePoint Online, enforcing encryption and restricting editing to internal users via rights management.

Answer

Data Loss Prevention (DLP)

Answer

Audit (Unified Audit Log)

Answer

eDiscovery (Content Search)

Question 6

A company must comply with the General Data Protection Regulation (GDPR). They need a unified solution that provides a compliance score, actionable recommendations to improve their security posture, and the ability to track their progress over time. Additionally, they want to assign improvement actions to specific teams and automate the collection of evidence for controls. Which two Microsoft Purview solutions should the administrator use? (Select two.)

Accepted Answer

Compliance Manager. Compliance Manager is correct because it provides a unified compliance score, actionable recommendations to improve security posture, and the ability to track progress over time. It also allows administrators to assign improvement actions to specific teams and automate evidence collection for controls, directly meeting all the stated GDPR compliance requirements.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

Audit (Premium)

Question 7

Which THREE actions can Microsoft Purview Data Loss Prevention (DLP) policies perform when a sensitive data match is detected?

Accepted Answer

Encrypt the content automatically. Microsoft Purview DLP policies are designed to prevent sensitive data from being shared inappropriately. When a sensitive data match is detected, DLP policies can perform several actions. These include automatically **encrypting the content** (B), often leveraging Azure Information Protection or Microsoft 365 Message Encryption, to restrict access to authorized users. They can also **block the sharing of the content** (C), preventing it from being sent via email, copied to unauthorized locations, or accessed externally. Additionally, DLP policies can **send a notification to the user** (D) who is attempting the action, informing them of the policy violation, and can also notify administrators.

Answer

Apply a retention label

Answer

Delete the content permanently

Question 8

Which TWO Microsoft Purview solutions are primarily used for investigating and responding to compliance incidents?

Accepted Answer

Microsoft Purview eDiscovery. Microsoft Purview eDiscovery is correct because it provides a comprehensive workflow for identifying, preserving, collecting, reviewing, and exporting electronic content relevant to legal or compliance investigations. It allows compliance officers to search across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams to find and hold data in place for litigation or regulatory response.

Microsoft Purview Audit is correct because it provides a forensic record of activities across Microsoft 365 services. It allows compliance officers to search for specific events, user actions, and administrative changes, which is critical for understanding the scope of a compliance incident, identifying responsible parties, and gathering evidence for response.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Insider Risk Management

Question 9

A company is implementing Microsoft Purview to classify sensitive data. They need to automatically detect credit card numbers in emails and apply a retention label. Which solution should they use?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect sensitive data types, such as credit card numbers (using the predefined Sensitive Information Type for credit card numbers, which validates against the Luhn algorithm and checks expiration dates), and then apply actions like retaining the email by assigning a retention label. This meets the requirement for automatic detection and retention label application on emails.

Answer

eDiscovery

Answer

Communication Compliance

Answer

Sensitivity labels

Question 10

Which THREE of the following are features of Microsoft Purview Compliance Manager?

Accepted Answer

Improvement actions with assigned owners. Microsoft Purview Compliance Manager is a workflow-based solution that helps you manage your organization's compliance posture. Key features include:
*   **Compliance Score**: Provides a measurable score of your compliance posture, helping you understand your progress and prioritize actions.
*   **Pre-built assessments**: Offers templates for various regulations and industry standards (e.g., GDPR, ISO 27001, NIST) to help you assess your compliance against specific requirements.
*   **Improvement actions**: Provides step-by-step guidance for implementing controls that enhance your compliance posture. Each improvement action can be assigned to a specific owner within your organization, enabling accountability and tracking of remediation tasks.

Answer

Data Loss Prevention policies

Answer

Audit log search

Question 11

Which TWO of the following are valid uses for Microsoft Purview eDiscovery?

Accepted Answer

Placing legal holds on content. Microsoft Purview eDiscovery includes the ability to place legal holds on content locations (such as mailboxes, SharePoint sites, and OneDrive accounts) to preserve data relevant to legal cases. This ensures that content cannot be modified or deleted while the hold is active, which is a core function of eDiscovery workflows. Additionally, eDiscovery provides powerful search capabilities to identify and collect relevant content across various Microsoft 365 services like Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams.

Answer

Classifying content with sensitivity labels

Answer

Reviewing audit logs for user activity

Answer

Applying retention policies to prevent deletion

Question 12

Which TWO Microsoft Purview solutions can help an organization detect and remediate insider risks such as data theft or unauthorized sharing?

Accepted Answer

Insider Risk Management. Insider Risk Management is correct because it uses machine learning and behavioral analytics to detect, investigate, and remediate risky user activities such as data theft or unauthorized sharing. It correlates signals from Microsoft 365 and Azure Active Directory to identify patterns like unusual file downloads or external sharing, enabling automated response workflows. Communication Compliance is also correct as it helps detect, investigate, and act on inappropriate messages, including the unauthorized sharing of sensitive information or data theft attempts through communication channels within the organization.

Answer

eDiscovery

Answer

Audit

Answer

Data Loss Prevention

Question 13

Which TWO of the following are capabilities of Microsoft Purview that help organizations manage compliance? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview's Data Loss Prevention (DLP) capability helps organizations identify, monitor, and automatically protect sensitive data across Microsoft 365 services, endpoints, and on-premises file shares. It enforces compliance policies by preventing unauthorized sharing or leakage of data such as credit card numbers, social security numbers, or other regulated information. Additionally, Microsoft Purview's Insider Risk Management capability helps organizations detect, investigate, and act on malicious and inadvertent activities that could lead to data leakage, intellectual property theft, or other compliance violations by employees.

Answer

Microsoft Entra ID

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Question 14

Which THREE of the following are features of Microsoft Purview Communication Compliance? (Choose three.)

Accepted Answer

Detect offensive language in emails and Teams messages. Microsoft Purview Communication Compliance helps organizations detect, investigate, and act on inappropriate messages. It uses built-in and custom trainable classifiers to identify policy violations (Option D), such as offensive, threatening, or harassing language (Option A), and to monitor communications to ensure compliance with internal policies and external regulations, including financial regulations (Option B), across various communication channels like emails and Microsoft Teams messages.

Answer

Prevent data loss by blocking sensitive data

Answer

Search for content across Exchange, SharePoint, and Teams

Question 15

Which TWO of the following are types of retention actions available in Microsoft Purview? (Choose two.)

Accepted Answer

Retain data for a specified period. Microsoft Purview's retention policies and labels include actions to 'retain data for a specified period' and 'delete data after a specified period'. The 'retain' action allows organizations to keep data for a defined duration to meet regulatory or business requirements, while the 'delete' action ensures data is removed after a set time. These actions are configured within retention rules and can be applied to content across various Microsoft 365 services like Exchange, SharePoint, OneDrive, and Teams.

Answer

Encrypt data at rest

Answer

Classify data as confidential

Answer

Search for data using eDiscovery

Question 16

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. A document in SharePoint is labeled as 'Highly Confidential' and was created 5 years ago. What will happen to this document?

Accepted Answer

The document will be retained for 2 more years. The retention policy retains items labeled as 'Highly Confidential' for 7 years from creation. Since the document was created 5 years ago, it will be retained until 7 years from creation (2 more years). Option A is wrong because the retention period starts from the document's creation date, not the policy's creation date. Option B is wrong because the label meets the condition. Option C is wrong because the retention is based on creation date, not 'now'.

Answer

The document will be retained for 7 years from the policy creation date

Answer

The document will be deleted immediately

Answer

The document will be retained for 7 years from now

Question 17

Which THREE of the following are features of Microsoft Purview Compliance Manager? (Select THREE.)

Accepted Answer

Compliance score and templates for custom assessments. Microsoft Purview Compliance Manager provides a **compliance score** that quantifies an organization's compliance posture and includes **templates for custom assessments** tailored to specific regulatory or organizational requirements (Option B). It also offers a library of **pre-built assessments** for common regulations like GDPR (Option C). Additionally, it details **improvement actions**, including those that are **Microsoft-managed**, to help organizations meet regulatory requirements (Option E).

Answer

Record declaration and disposition reviews

Answer

Trainable classifiers to identify sensitive content

Question 18

Which TWO of the following are examples of sensitive information types in Microsoft Purview? (Select TWO.)

Accepted Answer

Passport number. Both passport numbers and credit card numbers are classified as sensitive information types in Microsoft Purview. They are examples of predefined, pattern-based data identifiers (often using regex and checksums) that can be automatically detected and protected by Data Loss Prevention (DLP) policies. Microsoft Purview includes a wide range of built-in sensitive information types for various forms of personally identifiable information (PII) and financial data, enabling automatic classification and policy enforcement.

Answer

Public holiday list

Answer

Employee name

Answer

Internal project code name

Question 19

Which THREE of the following are retention actions in Microsoft Purview Data Lifecycle Management? (Select THREE.)

Accepted Answer

Delete the content after a specified period. Microsoft Purview Data Lifecycle Management uses retention policies and retention labels to manage the lifecycle of data. These policies and labels can be configured to perform three primary retention actions: 1. Retain content for a specified period (Option E), which can be indefinitely or for a set duration. 2. Delete content after a specified period (Option A), often used for content that doesn't require long-term retention but needs to be disposed of after a certain age. 3. Retain content for a specified period and then delete it (Option D), which combines both retention and eventual disposal.

Answer

Automatically archive the content

Answer

Apply a sensitivity label to the content

Question 20

You are designing a compliance solution for a healthcare organization that must comply with HIPAA. You need to ensure that patient health information (PHI) is encrypted at rest in Microsoft 365. What should you use?

Accepted Answer

Sensitivity labels. Sensitivity labels are the most appropriate solution. They allow organizations to classify data and apply protection, including encryption (using Azure Information Protection), to sensitive information like PHI across various Microsoft 365 services such as Exchange Online, SharePoint Online, and OneDrive for Business. This ensures PHI is encrypted at rest regardless of whether it's in an email, document, or other file type. While Microsoft Purview Message Encryption handles email, sensitivity labels offer a broader, more integrated approach to data protection and encryption at rest within Microsoft 365.

Answer

Microsoft Purview Message Encryption

Answer

Data Loss Prevention (DLP) policies

Answer

Customer Key