SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 11 — 15 Questions

Question 1

Match each security control type to its example.

Accepted Answer

Preventive: Firewall rules blocking unauthorized traffic. Security control types categorize how controls operate: preventive controls block incidents, detective controls identify them, and corrective controls fix issues. Common examples include firewall rules (preventive), IDS (detective), and backup/restore (corrective).

Answer

Preventive: Intrusion detection system monitoring network traffic

Answer

Detective: Backup and restore procedures

Answer

Corrective: Firewall rules blocking unauthorized traffic

Question 2

Match each compliance framework to its primary focus.

Accepted Answer

GDPR: Focuses on data privacy and protection for individuals in the EU. Correct matches: GDPR = data privacy, ISO 27001 = information security management, SOC 2 = trust service criteria. Common confusions include mixing GDPR with financial controls (SOX) or privacy with broader security.

Answer

GDPR: Focuses on financial reporting controls

Answer

ISO 27001: Focuses on data privacy for EU citizens

Answer

SOC 2: Focuses on international trade regulations

Question 3

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to ensure that when a user attempts to share a document containing credit card numbers via email, the document is blocked and the user receives a policy tip. What should you configure in the DLP policy?

Accepted Answer

Set the action to 'Block with override'. The requirement is to block the sharing of a document containing credit card numbers via email while also providing a policy tip to the user. In Microsoft Purview DLP, the 'Block with override' action blocks the sensitive data from being shared but allows the user to override the block (e.g., by providing a business justification), and it automatically triggers a policy tip to inform the user. This matches the scenario exactly.

Answer

Set the action to 'Audit only'

Answer

Set the action to 'Block'

Answer

Set the action to 'Notify only'

Question 4

Your company uses Microsoft Purview Communication Compliance to detect and remediate inappropriate messages. You need to create a policy that monitors Microsoft Teams chats for potential harassment. Which type of policy should you create?

Accepted Answer

Communication Compliance policy. Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate messages, such as harassment, in Microsoft Teams chats and other communication channels. It uses customizable policies to scan for offensive language, sensitive information, or policy violations, enabling organizations to enforce internal compliance rules.

Answer

Data Loss Prevention (DLP) policy

Answer

Information Barriers policy

Answer

Retention policy

Question 5

Your organization is implementing Microsoft Purview to manage data governance. You need to classify sensitive data such as social security numbers automatically. What should you create?

Accepted Answer

Sensitive information type. Sensitive information type. Sensitive information types (SITs) are predefined or custom patterns that detect sensitive data like social security numbers automatically. Option A is incorrect because a data loss prevention (DLP) policy uses SITs to enforce actions, but it does not classify data on its own. Option B is incorrect because retention labels manage data retention and disposal, not classification. Option D is incorrect because trainable classifiers require training with sample data to identify content, whereas SITs use pattern matching out of the box.

Answer

Data loss prevention policy

Answer

Retention label

Answer

Trainable classifier

Question 6

Your organization uses Microsoft Purview Data Lifecycle Management to retain data for regulatory compliance. You need to ensure that all documents in a SharePoint site are retained for 7 years after they are last modified. What should you create?

Accepted Answer

An adaptive scope based on last modified date. To retain documents in a SharePoint site for 7 years after they are last modified, you need a retention policy with an adaptive scope that uses a query to target items based on the 'Last Modified' date. Adaptive scopes allow dynamic, attribute-based scoping (e.g., last modified date), which is required for this time-based retention trigger. A static scope would apply to all content in the site without the ability to filter by modification date.

Answer

An auto-labeling policy

Answer

A data loss prevention policy

Answer

A static scope for the SharePoint site

Question 7

Your organization uses Microsoft Purview eDiscovery to manage legal holds. You need to place a hold on mailboxes and OneDrive accounts for a specific user who is involved in a litigation. Which eDiscovery solution should you use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) is the correct solution because it is designed specifically for legal hold management, allowing you to place a hold on content locations such as mailboxes and OneDrive accounts for a specific user involved in litigation. This hold preserves all content in those locations, including deleted items and versions, until the hold is released. Audit, Communication Compliance, and Content search do not provide the legal hold functionality required for this scenario.

Answer

Audit

Answer

Communication Compliance

Answer

Content search

Question 8

Your organization wants to classify documents based on whether they contain confidential business information like trade secrets. You need to use a classifier that learns from example documents. What should you use?

Accepted Answer

Trainable classifier. A trainable classifier is the correct choice because it uses machine learning to analyze example documents and learn patterns that distinguish content containing confidential business information, such as trade secrets. Unlike predefined sensitive information types, trainable classifiers can be customized to identify unique or proprietary content by training on your specific sample documents. This aligns with the requirement to 'learn from example documents' rather than relying on fixed patterns or exact matches.

Answer

Exact data match

Answer

Data loss prevention policy

Answer

Sensitive information type

Question 9

Your organization uses Microsoft Purview Records Management to manage high-value records that must not be deleted. You need to apply a label that marks content as a regulatory record. What label type should you use?

Accepted Answer

Retention label configured for regulatory records. A retention label configured for regulatory records is the correct choice because it locks the label so that no user, including an administrator, can remove it or reduce the retention period. This meets the requirement to mark content as a regulatory record that must not be deleted, as regulatory records provide the highest level of immutability in Microsoft Purview Records Management.

Answer

Data loss prevention policy

Answer

Retention label configured for record

Answer

Sensitivity label

Question 10

Your organization needs to ensure that emails containing personally identifiable information (PII) like passport numbers are automatically encrypted before being sent externally. What should you configure in Microsoft Purview?

Accepted Answer

A DLP policy with the 'Encrypt' action. Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect emails containing sensitive information types (e.g., passport numbers) and apply the 'Encrypt' action to enforce encryption before the email is sent externally. This leverages Microsoft 365 Message Encryption (OME) to protect the data in transit.

Answer

A retention label that encrypts the email

Answer

A communication compliance policy

Answer

An information barrier policy

Question 11

Your organization wants to audit all activities related to accessing sensitive files in Microsoft SharePoint. Which Microsoft Purview solution should you use?

Accepted Answer

Audit (Premium). Audit (Premium) in Microsoft Purview provides detailed logging of user and admin activities, including granular events like file access, modification, and permission changes in SharePoint. This solution enables organizations to investigate and audit all activities related to sensitive files by capturing and retaining audit records with high-volume event support and custom alerting.

Answer

Data lifecycle management

Answer

Information barriers

Answer

Data loss prevention

Question 12

Which TWO Microsoft Purview features can be used to automatically classify and protect sensitive data in documents?

Accepted Answer

Trainable classifiers. Trainable classifiers (C) use machine learning to intelligently identify sensitive content based on context and patterns, enabling automatic classification. Sensitive information types (E) are predefined or custom patterns (e.g., credit card numbers, SSNs) that detect specific data types, which can then trigger protection actions like encryption or access restrictions. Both features work together to automatically classify and protect sensitive data in documents.

Answer

Data loss prevention policies

Answer

eDiscovery (Premium)

Answer

Retention labels

Question 13

Which TWO Microsoft Purview compliance solutions are used to manage data retention and deletion?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (A) is correct because it enables organizations to apply retention and deletion policies to content based on its age or classification, automatically managing data across SharePoint, OneDrive, Exchange, and Teams. Records Management (C) is correct because it provides a solution for declaring records, applying retention labels that lock content to prevent modification or deletion, and managing disposition reviews for permanent deletion. Both solutions are part of Microsoft Purview's information governance capabilities, specifically designed to control data retention and deletion.

Answer

Data Loss Prevention

Answer

Communication Compliance

Answer

Audit

Question 14

A compliance administrator configures the above retention policy. A document created on January 1, 2025, in SharePoint Online will be retained until when?

Accepted Answer

December 31, 2025. The retention policy uses the 'When created' trigger, so a document created on January 1, 2025 is retained for 365 days from that date, expiring on December 31, 2025. Option A is incorrect because the retention period is finite. Option B is incorrect because the retention duration is 365 days from creation, not from the end of the year. Option D is incorrect because the retention period does not end on the creation date itself.

Answer

Indefinitely

Answer

January 1, 2026

Answer

January 1, 2025

Question 15

A security analyst runs the above KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify users with more than 5 MFA failure anomalies in the last 7 days. The KQL query uses `summarize` with `count()` on MFA failure anomalies, then filters with `where count_ > 5` and `where TimeGenerated > ago(7d)`. This explicitly returns only users whose anomaly count exceeds 5 in the last 7 days, making option D correct. The query does not correlate with other events, list all users with any anomaly, or check block status.

Answer

Correlate MFA failures with other security events

Answer

Identify all users who had an MFA failure anomaly in the last 7 days

Answer

Identify users who have been blocked due to MFA failures