SC-900 Describe the capabilities of Microsoft compliance solutions — 30 Questions

Question 1

A healthcare organization uses Microsoft Purview to protect patient health information (PHI). They need to identify sensitive data stored in Microsoft SharePoint Online and prevent unauthorized sharing. Which two Purview solutions should they implement? (Select all that apply.)

Accepted Answer

Data Classification. Data Classification (A) is correct because it enables the organization to identify and label sensitive data, such as PHI, stored in SharePoint Online. By applying sensitivity labels or retention labels, the organization can classify content based on its sensitivity, which is a prerequisite for applying protective actions. This allows them to discover where PHI resides and prepare it for further controls.

Answer

Insider Risk Management

Answer

Communication Compliance

Question 2

A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?

Accepted Answer

Configure improvement actions with owners. To automatically assign each control to the appropriate team member for remediation in Microsoft Purview Compliance Manager, you must configure improvement actions with owners. Each improvement action can be assigned to a specific user who is responsible for implementing the remediation steps, and this assignment triggers automatic notifications and tracking within the compliance score.

Answer

Create new assessments for each regulation

Answer

Set up connectors to import external risk data

Answer

Use the Microsoft 365 admin center to delegate tasks

Question 3

A company is subject to a legal hold for an ongoing investigation. The IT administrator must prevent the deletion of any documents related to this case across SharePoint Online and OneDrive, overriding any existing deletion policies. Which Microsoft Purview capability should the administrator use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct choice because it provides legal hold capabilities that can preserve content in SharePoint Online and OneDrive for Business, overriding any deletion policies. When a legal hold is applied via eDiscovery, the system places a hold on the specified locations, preventing permanent deletion or modification of documents until the hold is released. This directly addresses the requirement to prevent deletion of case-related documents during an ongoing investigation.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Communication Compliance

Question 4

A company wants to automatically apply a 'Confidential' sensitivity label to any document that contains a credit card number, and also encrypt the document as part of the label. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

A sensitivity label with encryption settings. Option A is correct because a sensitivity label must include encryption settings to automatically encrypt documents when the label is applied. The encryption is configured within the label's protection settings, which defines how content is protected (e.g., with a predefined template or user-defined permissions). Without encryption configured in the label, the automatic application would only assign the label without encrypting the document.

Answer

A DLP policy that detects sensitive info

Answer

A data classification dashboard

Question 5

A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution because it allows you to define retention labels and policies that automatically retain contracts for a specified period (10 years) and then trigger a permanent deletion disposition review or direct deletion. This aligns directly with the regulatory requirement to retain data for a fixed duration and then dispose of it securely.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Answer

Information Protection

Question 6

A healthcare organization uses Microsoft 365 and wants to prevent users from sending emails that contain patient health information (PHI) to external recipients. Which Microsoft Purview solution should they implement?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as patient health information (PHI), via email and other channels. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) to automatically block or warn users when they attempt to send such data to external recipients.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

eDiscovery

Question 7

A multinational corporation must retain all financial records for 7 years and then permanently delete them. The compliance officer wants to ensure that even a global administrator cannot modify or delete the retention policy. Which Microsoft Purview solution and configuration should they use?

Accepted Answer

Data Lifecycle Management with a preservation lock. C is correct because Data Lifecycle Management with a preservation lock allows an organization to apply a retention policy that cannot be modified, deleted, or turned off by any administrator, including a global administrator. This ensures financial records are retained for exactly 7 years and then permanently deleted, meeting the compliance officer's requirement for immutable retention.

Answer

eDiscovery (Standard)

Answer

Compliance Manager

Answer

Information Protection with sensitivity labels

Question 8

A company is subject to a legal investigation and must preserve all email communications related to the case for an indefinite period, even if users try to delete them. The compliance officer needs a solution that can place a hold on specific user mailboxes and prevent any permanent deletion of relevant content. Which Microsoft Purview feature should be used?

Accepted Answer

Litigation hold. Litigation hold is the correct feature because it places a hold on an entire mailbox, preserving all content including deleted items and versions, and prevents permanent deletion by users or automated processes. Unlike retention labels or policies, litigation hold applies to the entire mailbox and is designed specifically for legal investigations where indefinite preservation is required.

Answer

Retention labels

Answer

Data loss prevention

Answer

Compliance Manager

Question 9

A financial services organization needs to prevent communication between its research analysts and investment bankers to comply with regulatory requirements. Which Microsoft Purview solution should the compliance team implement?

Accepted Answer

Information Barriers. Information Barriers (IB) in Microsoft Purview is specifically designed to prevent communication and collaboration between certain user groups to comply with regulatory requirements, such as those in financial services that require separation between research analysts and investment bankers. IB policies enforce restrictions on Microsoft Teams, SharePoint, and OneDrive to block unauthorized communication and file sharing, directly addressing the need to avoid conflicts of interest.

Answer

Data Loss Prevention (DLP)

Answer

Data Lifecycle Management

Answer

Microsoft Purview eDiscovery

Question 10

A financial institution uses Microsoft 365 and must ensure that Microsoft support engineers cannot access the institution's content (e.g., Exchange Online mailboxes, SharePoint sites) without explicit approval from the institution's compliance officer. The compliance officer needs to review and approve or reject each access request. Which Microsoft Purview feature should be configured?

Accepted Answer

Customer Lockbox. Customer Lockbox is the correct feature because it provides a controlled access approval process for Microsoft support engineers to access customer content. When a support case requires access to Exchange Online mailboxes or SharePoint sites, Customer Lockbox ensures the request is sent to the institution's compliance officer for explicit approval or rejection before access is granted, meeting the requirement for explicit approval.

Answer

Communication Compliance

Answer

Insider Risk Management

Answer

Data Lifecycle Management

Question 11

A financial services organization must prevent employees in the Research department from communicating via email or Microsoft Teams with employees in the Investment Banking department to avoid conflicts of interest. Additionally, they need to prevent any credit card numbers from being shared in emails sent to external recipients. Which combination of Microsoft Purview solutions should they implement?

Accepted Answer

Information Barriers and Data Loss Prevention. Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest (e.g., research vs. investment banking). Data Loss Prevention (DLP) policies detect and protect sensitive information such as credit card numbers from being shared externally. Communication Compliance focuses on monitoring communications for regulatory compliance but does not block communications, and Insider Risk Management analyzes risky user activities but does not enforce segmentation.

Answer

Communication Compliance and Insider Risk Management

Answer

Information Barriers and Communication Compliance

Answer

Data Lifecycle Management and Data Loss Prevention

Question 12

A company's security team needs to detect and investigate potential data theft by employees who have legitimate access to sensitive data. They want a solution that uses heuristics and behavioral analytics to identify risky user actions such as data exfiltration to personal cloud storage. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that may lead to data theft, using heuristics and behavioral analytics. It correlates signals from Microsoft 365 and Azure services to identify patterns like data exfiltration to personal cloud storage, which aligns directly with the scenario's requirements.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Information Barriers

Question 13

A company must retain all vendor contracts for 10 years to meet regulatory requirements. After 10 years, the contracts must be permanently destroyed with no possibility of recovery. The compliance team wants to automate this lifecycle and ensure that during the retention period, the contracts cannot be edited or deleted by users. Which Microsoft Purview solution should they use?

Accepted Answer

Records Management. Records Management in Microsoft Purview is designed to declare records (regulatory or legal) that must be retained for a specific period and then disposed of in a compliant manner. It enforces immutability during the retention period—users cannot edit or delete records—and supports a disposition review or automatic permanent deletion after the retention period ends, exactly matching the requirement for 10-year retention followed by destruction with no recovery.

Answer

Data Lifecycle Management (DLM)

Answer

eDiscovery (Premium)

Answer

Sensitivity Labels

Question 14

A compliance officer needs to evaluate their organization's security and compliance posture against multiple regulatory frameworks such as HIPAA, GDPR, and ISO 27001. The solution must provide a continuous assessment score, actionable improvement actions, and the ability to track implementation progress. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a continuous compliance assessment score against multiple regulatory frameworks (including HIPAA, GDPR, and ISO 27001), offers actionable improvement actions, and enables tracking of implementation progress through a centralized dashboard. It maps controls to specific regulations and generates a compliance score based on implemented controls, making it the only option that meets all stated requirements.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery

Question 15

A multinational corporation must comply with several regulatory frameworks, including GDPR, SOX, and HIPAA. The compliance officer wants to continuously assess the organization's compliance posture against these regulations, receive prioritized improvement actions, and track the implementation progress of those actions. Which Microsoft Purview solution should the compliance officer use?

Accepted Answer

Compliance Manager. Compliance Manager is the correct solution because it provides a centralized dashboard for continuously assessing compliance posture against multiple regulatory frameworks (GDPR, SOX, HIPAA), generates prioritized improvement actions based on built-in assessments, and tracks implementation progress of those actions through a task-based workflow. It uses automated control mapping and continuous monitoring to help organizations meet evolving compliance requirements.

Answer

Information Protection

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Question 16

A financial services company must comply with a regulation that requires all audit-related documents to be retained for 7 years and then permanently deleted. The compliance officer wants to ensure that even if a user modifies or deletes a file, the original content is preserved for the full 7 years, and at the end of the period the files are automatically destroyed without any manual approval. The company uses Microsoft 365 and stores these documents in SharePoint Online and Microsoft Teams. Which Microsoft Purview solution should the compliance officer configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management using a retention policy configured to retain items for 7 years and then delete them automatically. Option C is correct because Microsoft Purview Data Lifecycle Management allows you to create a retention policy that retains items for a fixed period (7 years) and then automatically deletes them without any manual intervention. This meets the regulatory requirement for automatic destruction at the end of the retention period, and the policy applies to both SharePoint Online and Microsoft Teams, preserving the original content even if a user modifies or deletes the file.

Answer

Microsoft Purview Retention Labels with a disposition review that requires manual approval at the end of the retention period

Answer

Microsoft Purview Retention Policy with a record label to mark items as regulatory records

Answer

Microsoft Purview eDiscovery with a hold policy to preserve the documents indefinitely

Question 17

A company receives a subject rights request (SRR) from a customer under GDPR, asking for the deletion of all personal data held about them. The compliance team needs a tool to orchestrate the discovery of this data across Microsoft 365 and other systems, and to track the response and fulfillment of the request. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Priva (Privacy Management). Microsoft Priva (Privacy Management) is the correct solution because it is specifically designed to help organizations manage subject rights requests (SRRs) under regulations like GDPR. It automates the discovery of personal data across Microsoft 365 and connected systems, provides a workflow to track the request lifecycle, and facilitates the fulfillment of actions such as deletion. This directly addresses the compliance team's need to orchestrate discovery and track response for an SRR.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management (retention labels)

Question 18

A law firm uses Microsoft 365 and has two legal teams working on opposing sides of the same lawsuit. The compliance officer needs to prevent any communication (email, Teams chat, file sharing) between the two teams. Additionally, the firm must block emails containing the case name from being sent outside the organization. Which two Microsoft Purview solutions should be configured to meet these requirements? (Choose two.)

Accepted Answer

Microsoft Purview Information Barriers. Microsoft Purview Information Barriers (A) is correct because it is specifically designed to prevent communication and collaboration between two groups within an organization, such as legal teams on opposing sides of a lawsuit. It enforces policies that block email, Teams chat, and file sharing between the defined segments, directly meeting the first requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit (Standard)

Question 19

A legal team is involved in a lawsuit and needs to ensure that all emails and documents related to the case are preserved in their original state, even if users edit or delete them. They also need the ability to search for these items and export them for legal review. Which Microsoft Purview solution should the compliance team configure to meet these requirements?

Accepted Answer

Microsoft Purview eDiscovery (Standard). Microsoft Purview eDiscovery (Standard) is the correct solution because it provides the ability to place a legal hold on content (preserving emails and documents in their original state even if users edit or delete them), perform searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams, and export the results for legal review. This directly meets the requirements of preservation, search, and export for litigation.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Standard)

Question 20

A multinational organization uses Microsoft 365 and must demonstrate compliance with both GDPR and ISO 27001. The compliance team needs a centralized tool to assess their current compliance posture against these frameworks, receive prioritized improvement actions, and track the implementation of those actions over time. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Compliance Manager is the correct solution because it provides a centralized dashboard that assesses an organization's compliance posture against frameworks like GDPR and ISO 27001. It offers prioritized improvement actions based on built-in assessments and tracks the implementation of those actions over time, directly meeting the requirements for a unified compliance management tool.

Answer

Data Lifecycle Management

Answer

Audit

Answer

eDiscovery