SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 13 — 15 Questions

Question 1

An organization uses Microsoft Purview Information Protection. They want to ensure that when a user manually applies a 'Highly Confidential' sensitivity label to a document, the label is automatically applied to any new content pasted from that document into another app. Which configuration should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Marking content as sensitive. Microsoft Purview Information Protection's 'marking content as sensitive' feature (also known as content marking) ensures that when a user manually applies a sensitivity label, the label is automatically applied to any new content pasted from that document into another app. This is achieved through automatic marking that tracks the label even when content is copied. Option B (Data Loss Prevention policies) is incorrect because DLP policies enforce rules to prevent data loss but do not automatically apply labels to copied content. Option C (Encryption with rights management) is incorrect because encryption protects content but does not propagate labels across copy-paste. Option D (Auto-labeling policies) is incorrect because auto-labeling automatically classifies content based on conditions, not manual application.

Answer

Data Loss Prevention policies

Answer

Encryption with rights management

Answer

Auto-labeling policies

Question 2

A compliance officer needs to search for emails containing trade secrets across all mailboxes in the organization. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it is specifically designed for legal and investigative searches across all mailboxes, including the ability to search for specific content like trade secrets using keyword queries and advanced features like predictive coding and review sets. It supports searching across Exchange Online mailboxes, SharePoint sites, and OneDrive for Business, making it ideal for a compliance officer conducting a broad, targeted search for sensitive information.

Answer

Communication Compliance

Answer

Data Loss Prevention

Answer

Audit (Standard)

Question 3

Your organization is required to retain all HR-related documents for 7 years after an employee leaves. After that period, the documents must be permanently deleted. Which two Microsoft Purview features should you use together?

Accepted Answer

Retention labels and retention policies. Retention labels and retention policies. Retention labels allow you to apply retention settings (e.g., retain for 7 years then delete) to specific documents, while retention policies enforce those settings at the location level (e.g., all HR document libraries). Option A (eDiscovery and audit logs) is for search and audit, not retention. Option B (DLP policies and sensitivity labels) is for data protection and classification, not retention. Option C (Sensitivity labels and auto-labeling) is for classification and automated labeling, not retention.

Answer

eDiscovery and audit logs

Answer

DLP policies and sensitivity labels

Answer

Sensitivity labels and auto-labeling

Question 4

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. Which statement about this policy is accurate?

Accepted Answer

The policy will delete items 7 years after they were last modified.. The exhibit shows a retention policy configured with the action 'Delete items' and a period of '7 years' based on 'When items were last modified.' This means the policy will delete items 7 years after their last modification date, not from creation. Option C correctly states this behavior.

Answer

The policy will delete items after 7 years from the date they were created.

Answer

The policy will retain items for 7 years from the last modification date.

Answer

The policy will keep items for 7 years and then delete them.

Question 5

A company wants to automatically prevent users from sharing files containing personal data (e.g., passport numbers) via email. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block the sharing of sensitive information, such as passport numbers, via email. DLP policies use deep content analysis (e.g., regular expressions, keyword matching, and data classification) to inspect email attachments and body text in transit, and can enforce actions like blocking the message or sending a policy tip to the user. This aligns directly with the requirement to prevent users from sharing files containing personal data through email.

Answer

Communication Compliance

Answer

Sensitivity labels

Answer

eDiscovery

Question 6

Your organization uses Microsoft Purview to manage records. For legal reasons, you need to preserve all documents related to a specific litigation case and prevent any modification or deletion. Which feature should you use?

Accepted Answer

eDiscovery (Premium) legal hold. eDiscovery (Premium) legal hold is the correct feature because it preserves content in-place by placing a hold on data sources (e.g., Exchange mailboxes, SharePoint sites, OneDrive accounts) associated with a specific litigation case. This prevents any modification or deletion of documents while the hold is active, ensuring compliance with legal preservation requirements. Unlike retention labels, which manage lifecycle policies, legal hold is designed specifically for litigation scenarios to freeze data immutably.

Answer

Retention labels

Answer

Data Loss Prevention

Answer

Audit logs

Question 7

An organization uses Microsoft Purview Compliance Manager. They need to track their progress against a specific regulatory standard and assign improvement actions to different teams. Which component should they use?

Accepted Answer

Compliance Manager assessments. Compliance Manager assessments are the correct component because they allow you to track progress against a specific regulatory standard (e.g., ISO 27001, SOC 2) by creating an assessment that maps controls to that standard. Improvement actions are the granular tasks within an assessment that can be assigned to different teams for remediation, directly supporting the need to track progress and assign work.

Answer

eDiscovery

Answer

Data Loss Prevention

Answer

Audit logs

Question 8

A compliance administrator needs to generate a report showing all user activities related to accessing highly sensitive documents in SharePoint. Which Microsoft Purview solution should they use?

Accepted Answer

Audit (Standard or Premium). Audit (Standard or Premium) logs and records all user activities, including access to highly sensitive documents in SharePoint. Audit (Premium) provides deeper visibility with events like 'FileAccessed' and 'SensitivityLabelApplied', enabling compliance administrators to generate detailed reports on who accessed sensitive content and when.

Answer

eDiscovery

Answer

Data Loss Prevention

Answer

Communication Compliance

Question 9

Which TWO of the following are capabilities of Microsoft Purview Information Protection?

Accepted Answer

Applying sensitivity labels to documents and emails. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Applying sensitivity labels to documents and emails (Option D) is a core MIP capability, as labels enforce protection actions like encryption or visual markings. Encrypting content with Azure Rights Management (Option E) is the underlying technology that MIP uses to apply persistent protection, making it a direct capability of the solution.

Answer

Searching for content in eDiscovery

Answer

Preventing data loss via policies

Answer

Setting retention periods for content

Question 10

Refer to the exhibit. An administrator creates a DLP rule as shown. What is the expected outcome when a user tries to share a file containing a U.S. Social Security Number with an external recipient?

Accepted Answer

The sharing is blocked, and the user receives a notification.. The DLP rule is configured with an action of 'Block' (or 'BlockAccess') and user notification enabled. When a user attempts to share a file containing a U.S. SSN with an external recipient, the rule blocks the sharing and displays a notification to the user explaining that the action is blocked. Option A is incorrect because the rule applies to all users, not just non-owners. Option B is incorrect because the rule does more than generate an audit event; it actively blocks the sharing. Option C is incorrect because the rule blocks the action outright, rather than allowing it with justification.

Answer

The sharing is blocked only if the user is not the file owner.

Answer

The sharing is allowed, but an audit event is generated.

Answer

The file is shared, but the user is notified and must provide justification.

Question 11

Refer to the exhibit. A sensitivity label is configured as shown. Which statement about the label's behavior is accurate?

Accepted Answer

When applied, users can choose who can access the document and what permissions they have.. The exhibit shows a sensitivity label configured with 'Let users assign permissions' under 'User-defined permissions' in Azure Information Protection. This setting allows end users to define custom permissions (e.g., who can read, edit, or forward) when applying the label, rather than using a fixed template or automatic encryption.

Answer

The label disables encryption and only adds a header and footer.

Answer

The label automatically encrypts the document with a predefined template.

Answer

The label does not apply any protection; it only adds visual markings.

Question 12

An organization uses Microsoft Purview Communication Compliance. They need to monitor Microsoft Teams messages for potential insider trading language. What should they configure?

Accepted Answer

A Communication Compliance policy. B is correct because Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate or policy-violating communications, including insider trading language in Microsoft Teams messages. By configuring a Communication Compliance policy, the organization can define custom conditions (e.g., keywords, patterns, or classifiers) to scan Teams chats and channels for prohibited financial language, enabling automated alerts and remediation workflows.

Answer

An eDiscovery case

Answer

A Data Loss Prevention policy

Answer

A sensitivity label policy

Question 13

Your organization needs to automatically detect and prevent accidental sharing of sensitive data in Microsoft Teams messages. Which Microsoft Purview solution should you use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect and prevent accidental sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), in Microsoft Teams messages. DLP policies can scan messages in real time, apply actions like blocking the message or sending a policy tip to the user, and integrate with Microsoft Teams' chat and channel infrastructure. This directly addresses the requirement for automatic detection and prevention of accidental data sharing.

Answer

Retention policies

Answer

eDiscovery

Answer

Sensitivity labels

Question 14

Your company is implementing records management for legal retention requirements. Documents must be locked and cannot be modified or deleted after a specific event. Which Microsoft Purview capability should you use?

Accepted Answer

Retention label configured as a regulatory record. A retention label configured as a regulatory record is the correct choice because it enforces immutable, locked records that cannot be modified, deleted, or have their retention period shortened by any user, including administrators. This capability is specifically designed for legal retention requirements where documents must be preserved after a triggering event, using a policy that prohibits any changes or deletions.

Answer

Retention policy applied to a SharePoint site

Answer

Sensitivity label with encryption

Answer

Data Loss Prevention policy

Question 15

A multinational corporation must comply with GDPR and requires that personal data of EU users be retained for a maximum of 90 days after account closure. After that, all personal data must be permanently deleted. Which combination of Microsoft Purview capabilities should be used?

Accepted Answer

Create a retention label with a retention period of 90 days and then delete the content automatically. A retention label can be configured to retain data for a specified period (90 days) and then automatically trigger a disposition review or permanent deletion. This meets the GDPR requirement to retain data for 90 days and then delete it. Option B is correct. eDiscovery cases (A) are used for legal holds and searches, not automated lifecycle management. Sensitivity labels (C) do not enforce retention or deletion; they classify data. DLP policies (D) are designed to prevent unauthorized sharing, not to manage retention periods.

Answer

Configure an eDiscovery case to delete content after 90 days

Answer

Apply a sensitivity label that expires after 90 days

Answer

Use a Data Loss Prevention policy to block retention after 90 days