SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 15 — 15 Questions

Question 1

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run the Information Barriers policy in test mode. Microsoft Purview Information Barriers include a dedicated test mode that allows administrators to validate policy behavior against user segments before enforcement. Running the policy in test mode evaluates whether communications between specified segments are correctly blocked or allowed, without actually preventing messages, enabling safe validation of the configuration.

Answer

Define user segments in the Microsoft Purview compliance portal

Answer

Enable audit logging and then run the policy application

Answer

Use the Compliance Manager assessment for Information Barriers

Question 2

A multinational corporation needs to enforce data residency requirements by storing data in specific geographic locations. They are using Microsoft Purview for data governance. Which capability should they leverage to meet this requirement?

Accepted Answer

Microsoft Purview Multi-Geo. Microsoft Purview Multi-Geo is the correct capability because it enables organizations to store data at rest in specific geographic locations to meet data residency requirements. This feature works by provisioning data in chosen regions while maintaining a single Microsoft 365 tenant, allowing the multinational corporation to comply with local regulations without needing separate tenants.

Answer

Data loss prevention policies

Answer

Sensitivity labels with encryption

Answer

Azure Information Protection unified labeling

Question 3

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Insider Risk Management. Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on risky user activities, including the exfiltration of sensitive data to personal cloud storage services like Dropbox. It uses predefined or custom policies with indicators such as copying files to unauthorized cloud apps, which aligns directly with the requirement to detect data exfiltration to personal cloud storage.

Answer

eDiscovery (Premium)

Answer

Audit (Premium)

Answer

Communication Compliance

Question 4

Your company uses Microsoft Purview to manage records. You need to ensure that financial records are retained for 7 years and then permanently deleted. Which type of policy should you create?

Accepted Answer

A retention policy with a retention period of 7 years and then delete. A retention policy with a retention period of 7 years and then delete is correct because it applies a time-based retention rule to financial records at the container or folder level, ensuring they are kept for exactly 7 years and then permanently removed without human intervention. This meets the requirement for automatic deletion after the retention period, as opposed to a disposition review which requires manual approval.

Answer

A sensitivity label set to 'Financial' with auto-labeling

Answer

A retention label that triggers a disposition review after 7 years

Answer

A DLP policy that blocks sharing of financial records

Question 5

Your organization is implementing Microsoft Purview Communication Compliance to detect potential regulatory violations. You need to configure a policy that alerts when employees discuss insider trading in emails and Microsoft Teams messages. The solution should minimize false positives. Which action should you take?

Accepted Answer

Use a trainable classifier and train it with sample data. Trainable classifiers use machine learning to identify content based on patterns learned from sample data, which significantly reduces false positives compared to static keyword lists. By training the classifier with relevant examples of insider trading discussions, the policy can accurately distinguish between genuine regulatory violations and benign uses of similar terms.

Answer

Include all message types without filtering

Answer

Create a global keyword list of insider trading terms

Answer

Set the policy sensitivity threshold to 90%

Question 6

Your organization is implementing a data loss prevention (DLP) policy to prevent sensitive data from being shared via email. Users in the finance department need to send financial reports to external auditors. What should you configure?

Accepted Answer

Configure a DLP policy with an override option allowing users to justify the sharing. Configuring a DLP policy with an override option allows finance users to share financial reports with external auditors while still providing a justification, ensuring legitimate business needs are met without blocking all external sharing. Option A is incorrect because DLP policies use allow lists for exceptions, but an override with justification is more appropriate for this scenario. Option C is incorrect because sensitivity labels can encrypt emails, but they do not replace the need for a DLP policy with override for specific external sharing. Option D is incorrect because a block action would prevent all external sharing, which is not suitable for legitimate business needs.

Answer

Add the auditors' domains to a DLP allow list

Answer

Assign a sensitivity label that automatically encrypts the email

Answer

Configure a DLP policy with a block action for all external sharing

Question 7

A company uses Microsoft Purview Information Protection to classify and protect sensitive data. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which should you configure?

Accepted Answer

Configure an auto-labeling policy with a sensitive info type for credit card numbers. Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents and emails that contain specific sensitive information types, such as credit card numbers. This enables automated classification and protection without requiring user intervention, directly meeting the requirement to automatically apply a label based on the presence of credit card data.

Answer

Use a manual labeling policy requiring users to apply labels

Answer

Create a trainable classifier for credit card patterns

Answer

Set up a data classification activity explorer to monitor credit card usage

Question 8

Your organization uses Microsoft Purview Audit to investigate a security incident. You need to search for activities performed by a specific user over the past 90 days. Which solution should you use?

Accepted Answer

Microsoft Purview Audit (Standard). Microsoft Purview Audit (Standard) provides 90-day retention for audit logs, which meets the requirement to search for user activities over the past 90 days. Option B (Audit Premium) offers longer retention but is not necessary for this 90-day search. Option C (Microsoft Defender XDR Advanced Hunting) is used for advanced threat hunting, not for auditing user activities. Option D (eDiscovery Standard) is designed for legal and compliance searches, not for routine audit log searches.

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Defender XDR Advanced Hunting

Answer

Microsoft Purview eDiscovery (Standard)

Question 9

A healthcare organization must comply with HIPAA regulations. They need to classify and protect medical records stored in Microsoft 365. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (D) is the correct solution because it enables organizations to classify, label, and protect sensitive data—such as medical records—using sensitivity labels and encryption. This directly supports HIPAA compliance by ensuring that protected health information (PHI) is consistently safeguarded across Microsoft 365 services, including Exchange, SharePoint, and OneDrive.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Priva

Answer

Microsoft Purview Data Lifecycle Management

Question 10

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct choice because it provides advanced legal hold capabilities, including the ability to apply holds automatically based on specified criteria such as user mailboxes or SharePoint sites. Unlike the Standard version, Premium supports policy-based holds that can be set to trigger automatically without manual intervention, which is essential for managing legal cases efficiently.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview Communication Compliance

Question 11

Refer to the exhibit. An administrator runs this KQL query in Microsoft Purview Audit. What is the purpose of this query?

Accepted Answer

To identify file types that a specific user uploaded more than 10 times in the last 30 days. The KQL query uses `| summarize Count = count() by FileType` to group audit log entries by file type, then `| where Count > 10` filters for file types that appear more than 10 times. The `where UserId == 'user@domain.com'` restricts the results to a specific user, and `| where TimeGenerated > ago(30d)` limits the time range to the last 30 days. This directly identifies file types uploaded more than 10 times by that user, matching option D.

Answer

To find the total number of file uploads by all users in the last 30 days

Answer

To find files larger than a certain size uploaded by a specific user

Answer

To list all files deleted by a specific user in the last 30 days

Question 12

A company wants to automatically detect and remediate compliance issues such as sharing sensitive data externally. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, alert, and automatically remediate when sensitive data (e.g., credit card numbers, personally identifiable information) is shared externally via email, Teams, or cloud apps. DLP policies can enforce actions like blocking the transmission or applying encryption, directly addressing the requirement to prevent unauthorized external sharing of sensitive data.

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 13

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (D) provides the ability to create retention and deletion policies that automatically retain data for a specified period and then delete it. This solution directly addresses the requirement to manage data retention and deletion schedules within Microsoft Purview.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Information Protection

Question 14

Which TWO of the following are capabilities of Microsoft Purview Communication Compliance? (Select TWO.)

Accepted Answer

Enforce company policies on communication channels. Microsoft Purview Communication Compliance allows organizations to enforce company policies on communication channels such as email, Microsoft Teams, and third-party platforms. It does this by scanning communications for policy violations (e.g., insider trading, harassment) and enabling designated reviewers to take remediation actions like escalating or archiving messages.

Answer

Automatically apply sensitivity labels to documents

Answer

Prevent sharing of credit card numbers via email

Answer

Place legal holds on user mailboxes

Question 15

Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)

Accepted Answer

Identify anomalous user activities such as mass file downloads. Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.

Answer

Review communications for policy violations

Answer

Conduct eDiscovery searches for legal cases

Answer

Block sharing of sensitive data via email