SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Purview Audit (Standard) and needs to investigate a data breach that occurred 120 days ago. You discover that the required audit logs are not available. What is the most likely reason?

Accepted Answer

Audit log retention is limited to 90 days for Audit (Standard). Microsoft Purview Audit (Standard) retains audit logs for only 90 days. Option C is correct. Audit (Premium) retains logs for 1 year. Licenses and storage are not the issue.

Answer

The user does not have an appropriate license

Answer

The organization has insufficient storage

Answer

The audit logs were manually deleted by an administrator

Question 2

Which TWO Microsoft Purview solutions can help an organization detect and remediate insider risks such as data theft or unauthorized sharing?

Accepted Answer

Insider Risk Management. Insider Risk Management and Communication Compliance are the two Purview solutions designed to detect and remediate insider risks. Data Loss Prevention prevents sharing but does not specifically address insider risk detection. eDiscovery is for legal discovery. Audit logs track activities but do not provide remediation workflows. So correct: A and C.

Answer

eDiscovery

Answer

Audit

Answer

Data Loss Prevention

Question 3

Which THREE capabilities are part of Microsoft Purview Data Lifecycle Management?

Accepted Answer

Retention labels. Data Lifecycle Management includes retention policies, retention labels, and records management. DLP is data loss prevention, not lifecycle management. eDiscovery is discovery. So correct: A, B, D.

Answer

Data Loss Prevention policies

Answer

eDiscovery

Question 4

Which TWO of the following are Microsoft Purview solutions that help protect sensitive data?

Accepted Answer

Data Loss Prevention (DLP). Sensitivity labels and Data Loss Prevention (DLP) are both Purview solutions that protect sensitive data. Insider Risk Management detects risks but does not directly protect data. Communication Compliance monitors communications. eDiscovery is for discovery. So correct: A and B.

Answer

Communication Compliance

Answer

eDiscovery

Answer

Insider Risk Management

Question 5

Refer to the exhibit. You are reviewing a sensitivity label configuration in Microsoft Purview. Based on the exhibit, what is the result when a user applies this label to a document?

Accepted Answer

The document is encrypted and a header/footer is added. The exhibit shows encryption enabled and header/footer markings. Encryption prevents unauthorized access, and markings add text. Option B is correct. The label does not automatically delete the document or prevent printing. It does not remove the label after a period.

Answer

The label is automatically removed after one year

Answer

The document is automatically deleted after 30 days

Answer

The document can be printed but not edited

Question 6

Refer to the exhibit. You are evaluating a Microsoft Purview retention policy. The policy is applied to Exchange Online, SharePoint Online, and OneDrive for Business. What is the behavior of this policy?

Accepted Answer

Items are automatically deleted 365 days after creation. The policy retains items for 365 days from creation and then deletes them. Without preservation lock, users can delete items before 365 days, but the system retains them until the period ends. Option C is correct. Option A is wrong because it says items are kept indefinitely. Option B is wrong because deletion triggers after 365 days. Option D is wrong because preservation lock is false.

Answer

Items are retained indefinitely and cannot be deleted

Answer

Items are deleted 365 days after last modification

Answer

Items are preserved with a lock and cannot be deleted by users

Question 7

Refer to the exhibit. An administrator runs the PowerShell command shown. What is the purpose of this command?

Accepted Answer

Search audit logs for file activities performed by a specific user. The command searches the unified audit log for file-related operations by a specific user in the last 90 days. Option A is correct. It does not delete files, modify permissions, or block the user.

Answer

Delete all files modified by a user in the last 90 days

Answer

Modify permissions on files uploaded by a user

Answer

Block a user from uploading files

Question 8

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to create a policy that prevents users from sharing credit card numbers via email to external recipients. The policy should only apply to users in the Finance department. Which action should you take?

Accepted Answer

Create a DLP policy, select the Finance user location, and add the credit card number condition. Option C is correct because DLP policies in Microsoft Purview can be scoped to specific user groups via location selection. Option A is wrong because sensitivity labels are for classification, not DLP enforcement. Option B is wrong because retention labels are for data retention, not DLP. Option D is wrong because the policy should be created from scratch, not copied from a template that may not match the requirement.

Answer

Create a retention label and apply auto-labeling for Finance

Answer

Create a sensitivity label and publish it to Finance users

Answer

Copy the default DLP template for financial data and modify it

Question 9

A healthcare organization needs to automatically classify documents containing patient health information (PHI) in Microsoft SharePoint. The solution should apply a 'Confidential - Healthcare' sensitivity label to any document that matches the HIPAA content pattern. Which Microsoft Purview feature should be used?

Accepted Answer

Auto-labeling for sensitivity labels. Option B is correct because auto-labeling in Microsoft Purview can apply sensitivity labels based on content patterns. Option A is wrong because manual labeling requires user action. Option C is wrong because DLP policies prevent sharing, not classify. Option D is wrong because retention labels manage retention, not classification.

Answer

Retention label auto-apply

Answer

Manual sensitivity labeling

Answer

Data loss prevention (DLP) policy

Question 10

Your organization uses Microsoft Purview for data governance. You need to ensure that when a user marks an email as 'Confidential' using a sensitivity label, the email is automatically encrypted and cannot be forwarded. What configuration is required?

Accepted Answer

Configure the sensitivity label with encryption and a rights management template that prohibits forwarding. Option A is correct because sensitivity labels can be configured with encryption and rights management options like preventing forwarding. Option B is wrong because DLP policies can apply encryption but are not triggered by manual labeling alone. Option C is wrong because a retention label does not enforce encryption. Option D is wrong because an Azure Information Protection scanner applies labels to on-premises files, not emails.

Answer

Create a DLP policy that detects the 'Confidential' label and applies encryption

Answer

Use the Azure Information Protection unified labeling scanner

Answer

Apply a retention label that triggers encryption

Question 11

Your company is subject to GDPR and must be able to respond to data subject requests (DSRs) by finding all personal data of a specific user across Microsoft 365. Which Microsoft Purview solution should you use?

Accepted Answer

eDiscovery (Standard or Premium). Option B is correct because eDiscovery in Microsoft Purview is designed to search for content across Exchange, SharePoint, OneDrive, and Teams. Option A is wrong because Communication Compliance monitors for policy violations, not search. Option C is wrong because Audit logs track activities, not content. Option D is wrong because Privileged Access Management protects administrative access.

Answer

Communication Compliance

Answer

Privileged Access Management

Answer

Audit (Standard or Premium)

Question 12

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

Accepted Answer

Run the Information Barriers policy in test mode. Option C is correct because Information Barriers can be run in test mode to evaluate policy matches without blocking. Option A is wrong because segmentation is the process of defining groups, not testing. Option B is wrong because the policy application must be run; enabling audit does not test the barrier. Option D is wrong because there is a dedicated test mode for Information Barriers.

Answer

Define user segments in the Microsoft Purview compliance portal

Answer

Enable audit logging and then run the policy application

Answer

Use the Compliance Manager assessment for Information Barriers

Question 13

A multinational corporation needs to enforce data residency requirements by storing data in specific geographic locations. They are using Microsoft Purview for data governance. Which capability should they leverage to meet this requirement?

Accepted Answer

Microsoft Purview Multi-Geo. Option D is correct because Microsoft Purview Multi-Geo enables data residency at the tenant level for Exchange Online, SharePoint, and OneDrive. Option A is wrong because sensitivity labels classify data but do not enforce storage location. Option B is wrong because DLP policies control data movement, not storage. Option C is wrong because Azure Information Protection is for classification and protection, not data residency.

Answer

Data loss prevention policies

Answer

Sensitivity labels with encryption

Answer

Azure Information Protection unified labeling

Question 14

Your organization uses Microsoft Purview to manage insider risk. You need to create a policy that detects users who exfiltrate sensitive data by copying it to personal cloud storage services like Dropbox. Which solution should you use?

Accepted Answer

Insider Risk Management. Option A is correct because Insider Risk Management policies can be configured to detect data theft by copying to personal cloud storage. Option B is wrong because Communication Compliance focuses on communications, not data exfiltration. Option C is wrong because eDiscovery searches content, does not detect risky behavior. Option D is wrong because Audit logs record events but require manual analysis.

Answer

eDiscovery (Premium)

Answer

Audit (Premium)

Answer

Communication Compliance

Question 15

Your company uses Microsoft Purview to manage records. You need to ensure that financial records are retained for 7 years and then permanently deleted. Which type of policy should you create?

Accepted Answer

A retention policy with a retention period of 7 years and then delete. Option C is correct because a retention policy with a retention period of 7 years and then deletion will meet the requirement. Option A is wrong because a retention label with a disposition review does not guarantee automatic deletion. Option B is wrong because a DLP policy prevents data loss, not retention. Option D is wrong because a sensitivity label does not manage retention.

Answer

A sensitivity label set to 'Financial' with auto-labeling

Answer

A retention label that triggers a disposition review after 7 years

Answer

A DLP policy that blocks sharing of financial records