SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 11 — 15 Questions

Question 1

A company is required by a compliance regulation to retain all user and admin activity audit logs for 2 years. They also need the ability to perform faster, historical searches on this audit data. Which Microsoft Purview solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) provides a 2-year retention capability for audit logs, which meets the compliance regulation requirement. Additionally, it offers faster, historical searches through features like high-bandwidth access to the Audit Log Search API and intelligent insights, enabling efficient querying of large volumes of audit data. Standard Audit only retains logs for 90 days by default and lacks the performance optimizations for historical searches.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview eDiscovery (Premium)

Question 2

A company wants to proactively detect and investigate potential insider security risks, such as a departing employee copying large amounts of data to a personal USB drive or sharing confidential files with unauthorized individuals. Which Microsoft Purview solution should they use?

Accepted Answer

Insider Risk Management. Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on risky user activities that may lead to data security incidents, such as unauthorized data exfiltration by departing employees. It uses predefined and customizable policies to correlate signals from Microsoft 365 logs (e.g., copying files to USB, sharing with external users) and applies risk-scoring to prioritize alerts. This makes it the correct solution for proactively identifying potential insider threats like bulk data copying or unauthorized file sharing.

Answer

Data Lifecycle Management

Answer

Communication Compliance

Answer

eDiscovery (Standard)

Question 3

A healthcare organization uses Microsoft 365 and must comply with HIPAA regulations. They need to assess their current compliance posture, identify gaps, and implement improvement actions. They want a tool that provides a compliance score based on best practices and regulatory frameworks, and offers recommended actions to improve the score. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Microsoft Purview Compliance Manager provides a compliance score based on your configuration against best practices and regulatory frameworks like HIPAA. It offers a centralized dashboard to assess compliance posture, identify gaps, and provides recommended improvement actions with step-by-step guidance. This directly matches the requirement to assess, identify gaps, and implement improvements.

Answer

Insider Risk Management

Answer

Communication Compliance

Answer

Audit

Question 4

A company uses Microsoft 365 and must comply with a regulation that requires all business records, including emails and documents, to be retained for exactly 5 years. They need to automatically apply a retention label to any item that contains the keyword 'Contract' when the item is created or modified. Which Microsoft Purview solution should they use to configure this automatic labeling?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview enables automatic retention labeling based on sensitive content, such as keywords like 'Contract'. It uses auto-labeling policies to apply retention labels at the time of creation or modification, ensuring compliance with the 5-year retention requirement without manual intervention.

Answer

Data Loss Prevention (DLP)

Answer

Audit

Answer

Compliance Manager

Question 5

A financial services company uses Microsoft 365 and must comply with PCI DSS. They want to automatically prevent users from sending emails that contain credit card numbers to external recipients. If a user tries to send such an email, the system should block the message and notify the user with a policy tip. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive data, such as credit card numbers, in transit (e.g., email). DLP policies can be configured with conditions to match credit card number patterns (using a built-in sensitive info type) and set actions to block the message and display a policy tip to the sender, meeting the PCI DSS compliance requirement.

Answer

Communication Compliance

Answer

Information Protection

Answer

Insider Risk Management

Question 6

A healthcare organization uses Microsoft 365. They need to prevent employees from sharing emails or documents that contain patient medical record numbers (MRNs) with external recipients. If an attempt is made, the message should be blocked and the sender should receive a policy tip notification. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as patient medical record numbers (MRNs), with external recipients. DLP policies can be configured to scan emails and documents for patterns (e.g., regex for MRNs), block the transmission, and display a policy tip notification to the sender, meeting all requirements.

Answer

Data Lifecycle Management

Answer

Records Management

Answer

Information Protection

Question 7

A company is involved in a lawsuit. The legal team needs to preserve all emails, documents, and Teams messages from five key employees (custodians) that are related to a specific project. The data must be collected securely and provided for legal review without modifying the original data. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing organizations to identify, preserve, collect, and export relevant data (emails, documents, Teams messages) from custodians without altering the original data. It supports legal hold, advanced search, and secure export for legal review, meeting the lawsuit requirements.

Answer

Data Lifecycle Management

Answer

Records Management

Answer

Communication Compliance

Question 8

A company is involved in a legal case and must preserve all emails and documents sent by a specific employee (custodian) that are related to a particular matter. The legal team needs to collect this data into a tamper-proof container for review, ensuring that no original items are modified or deleted. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it provides advanced capabilities for legal investigations, including the ability to place a legal hold on specific custodians (the employee) and preserve all relevant emails and documents in a tamper-proof container. This ensures that no original items are modified or deleted during the review process, meeting the requirements of the legal case.

Answer

Retention labels

Answer

eDiscovery (Standard)

Answer

Data Lifecycle Management

Question 9

An organization uses Microsoft 365. They need to prevent users from sharing credit card numbers in emails and Microsoft Teams messages. When a user attempts to share such sensitive information externally, the message should be blocked and the user should receive a policy tip notification. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and protect sensitive information, such as credit card numbers, through deep content analysis using built-in sensitive information types. DLP policies can be configured to block the sharing of this data in emails and Microsoft Teams messages and to display a policy tip notification to the user, enforcing compliance in real time.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

Information Protection

Question 10

A company must retain all financial records for exactly 7 years and then automatically delete them. They need to automatically apply a retention label to any document that contains the words 'Invoice' or 'Statement'. Which Microsoft Purview solution should they use?

Accepted Answer

Data Lifecycle Management (retention labels with auto-apply). Data Lifecycle Management (DLM) with auto-apply retention labels is the correct solution because it allows you to define a retention label that automatically applies to documents containing the keywords 'Invoice' or 'Statement' using a sensitive info type or trainable classifier. You can then configure the label to retain the data for exactly 7 years and trigger automatic deletion at the end of that period. This directly meets the requirement for both automated classification and lifecycle enforcement.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery (Standard)

Answer

Audit

Question 11

Arrange the steps to conduct a data classification scan using Microsoft Purview Information Protection.

Accepted Answer

Create labels, then Publish labels, then Set auto-labeling rules, then Run scans, then Review results. Data classification involves creating labels, publishing them, setting auto-labeling rules, running scans, and reviewing results.

Answer

Create labels, then Set auto-labeling rules, then Publish labels, then Run scans, then Review results

Answer

Run scans, then Create labels, then Publish labels, then Set auto-labeling rules, then Review results

Answer

Create labels, then Publish labels, then Run scans, then Set auto-labeling rules, then Review results

Question 12

Order the steps to deploy Microsoft Intune for mobile device management.

Accepted Answer

1. Set up Intune (configuration of MDM authority, licenses, and basic settings), 2. Create enrollment policies, 3. Create compliance policies, 4. Assign apps, 5. Enroll devices.. Intune deployment includes setup, enrollment policies, compliance policies, app assignment, and enrollment.

Answer

1. Enroll devices, 2. Set up Intune, 3. Create compliance policies, 4. Create enrollment policies, 5. Assign apps.

Answer

1. Set up Intune, 2. Create compliance policies, 3. Create enrollment policies, 4. Assign apps, 5. Enroll devices.

Answer

1. Enroll devices, 2. Assign apps, 3. Create compliance policies, 4. Create enrollment policies, 5. Set up Intune.

Question 13

Match each security control type to its example.

Accepted Answer

Preventive: Firewall rules blocking unauthorized traffic. Security control types categorize how controls operate: preventive controls block incidents, detective controls identify them, and corrective controls fix issues. Common examples include firewall rules (preventive), IDS (detective), and backup/restore (corrective).

Answer

Preventive: Intrusion detection system monitoring network traffic

Answer

Detective: Backup and restore procedures

Answer

Corrective: Firewall rules blocking unauthorized traffic

Question 14

Match each compliance framework to its primary focus.

Accepted Answer

GDPR: Focuses on data privacy and protection for individuals in the EU. Correct matches: GDPR = data privacy, ISO 27001 = information security management, SOC 2 = trust service criteria. Common confusions include mixing GDPR with financial controls (SOX) or privacy with broader security.

Answer

GDPR: Focuses on financial reporting controls

Answer

ISO 27001: Focuses on data privacy for EU citizens

Answer

SOC 2: Focuses on international trade regulations

Question 15

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to ensure that when a user attempts to share a document containing credit card numbers via email, the document is blocked and the user receives a policy tip. What should you configure in the DLP policy?

Accepted Answer

Set the action to 'Block'. The requirement is to block sharing of a document containing credit card numbers via email and show the user a policy tip. In Microsoft Purview DLP, the 'Block' action prevents the sensitive data from being shared and displays a policy tip to the user. 'Block with override' would additionally allow the user to bypass the block with a justification or false positive, which is not required here. Therefore, 'Block' is the correct action.

Answer

Set the action to 'Audit only'

Answer

Set the action to 'Block with override'

Answer

Set the action to 'Notify only'