SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 16 — 15 Questions

Question 1

Refer to the exhibit. You run the PowerShell command to search the unified audit log for file deletions. The command returns no results, but you know a file was deleted last week. What is the most likely reason?

Accepted Answer

Audit logging is not enabled for the organization. Option B is correct because Audit (Standard) only retains audit logs for 90 days, but the issue here is that the command uses -Operations FileDeleted, which may not be the correct operation name; however, the most likely reason is that Audit (Premium) is required for certain operations. Actually, FileDeleted is a valid operation. The correct answer is that Audit logging must be enabled. Option A is wrong because the command is correct. Option C is wrong because 7 days is within retention. Option D is wrong because the operation name is correct.

Answer

The operation name 'FileDeleted' is incorrect

Answer

Audit logs are only retained for 90 days

Answer

The StartDate and EndDate are incorrect

Question 2

You are the compliance administrator for Contoso, a multinational corporation with headquarters in the US and subsidiaries in Europe and Asia. Contoso uses Microsoft 365 E5 and Microsoft Purview. The company handles personal data subject to GDPR and CCPA. You need to design a compliance solution that meets the following requirements:
- Automatically classify and protect documents containing personal data in SharePoint Online and OneDrive for Business.
- Ensure that data subject requests (DSRs) for access and deletion can be fulfilled within the regulatory timeframes.
- Prevent accidental sharing of sensitive data via email and Teams.
- Maintain an audit trail of all activities related to personal data for at least one year.
- Manage data retention to comply with local laws that require different retention periods for different types of data.
Which combination of Microsoft Purview solutions should you use?

Accepted Answer

Sensitivity labels with auto-labeling, DLP, eDiscovery, Data Lifecycle Management, and Audit (Premium). Option C is correct because sensitivity labels with auto-labeling classify and protect data; DLP prevents sharing; eDiscovery and Data Lifecycle Management handle DSRs and retention; Audit (Premium) provides 1-year audit retention. Option A is wrong because Communication Compliance is for monitoring, not DSRs. Option B is wrong because Information Barriers restrict communication, not retention. Option D is wrong because Insider Risk Management is for risk detection, not compliance lifecycle.

Answer

Insider Risk Management, DLP, eDiscovery, and Data Lifecycle Management

Answer

Data Lifecycle Management, Information Barriers, DLP, and Audit (Premium)

Answer

Sensitivity labels, Communication Compliance, eDiscovery, and Audit (Standard)

Question 3

You work for a law firm that uses Microsoft 365 E5. The firm handles highly confidential client information and must comply with attorney-client privilege. You need to implement a compliance solution that:
- Prevents unauthorized sharing of privileged documents via email.
- Enables lawyers to easily classify documents as 'Privileged' and automatically encrypt them.
- Allows the compliance team to monitor for accidental exposure of privileged information in Teams chats.
- Ensures that privileged documents are retained for 7 years after case closure, then automatically deleted.
- Provides the ability to search for privileged documents in case of a legal hold.
What should you configure?

Accepted Answer

Sensitivity labels with encryption, DLP, Communication Compliance, Data Lifecycle Management, and eDiscovery. Option B is correct because sensitivity labels can classify and encrypt privileged documents; DLP prevents sharing; Communication Compliance monitors Teams; Data Lifecycle Management manages retention; eDiscovery handles legal hold. Option A is wrong because Information Barriers restrict communication between groups, not relevant for privilege. Option C is wrong because Audit (Standard) does not provide 7-year retention. Option D is wrong because Insider Risk Management focuses on risk, not classification.

Answer

DLP, Communication Compliance, Data Lifecycle Management, and Audit (Standard)

Answer

Insider Risk Management, DLP, Data Lifecycle Management, and eDiscovery

Answer

Sensitivity labels, Information Barriers, Data Lifecycle Management, and eDiscovery

Question 4

You are the compliance administrator for a retail company that uses Microsoft 365 Business Premium. The company needs to:
- Block customers' credit card numbers from being sent via email.
- Retain all sales invoices for 3 years as per financial regulations.
- Allow managers to search and export employee emails for HR investigations.
- Ensure that only HR can access employee salary information.
Which Microsoft Purview solutions should you use?

Accepted Answer

DLP, Data Lifecycle Management, eDiscovery, and sensitivity labels. Option A is correct because DLP blocks credit card sharing; Data Lifecycle Management retains invoices; eDiscovery exports emails; sensitivity labels restrict access to salary info. Option B is wrong because Communication Compliance is for monitoring, not blocking data. Option C is wrong because Information Barriers restrict communication, not access. Option D is wrong because Insider Risk Management is for risk, not retention.

Answer

DLP, Information Barriers, eDiscovery, and sensitivity labels

Answer

Insider Risk Management, Data Lifecycle Management, eDiscovery, and sensitivity labels

Answer

Communication Compliance, Data Lifecycle Management, eDiscovery, and sensitivity labels

Question 5

Your organization is implementing Microsoft Purview to govern data across Microsoft 365 and Azure. Which TWO capabilities should you use to discover and classify sensitive data?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Data Map provides automated data discovery and classification across on-premises, multi-cloud, and SaaS data. Microsoft Purview Information Protection enables classification and labeling of sensitive data. Data Lifecycle Management focuses on retention and deletion, not discovery/classification. Audit and eDiscovery are for investigation and legal holds, not initial discovery. Insider Risk Management detects risky user activities, not data classification.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Question 6

A company uses Microsoft Purview to manage data compliance. They need to meet regulatory requirements that mandate retention of financial records for 7 years and deletion of personal data after 3 years. Which THREE capabilities should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Data Lifecycle Management includes retention labels and policies to keep data for required periods and deletion policies to remove data after specified time. Microsoft Purview Records Management enables marking records as regulatory records to prevent deletion during retention. Microsoft Purview Information Protection can apply sensitivity labels that trigger retention, but the primary tools for retention and deletion are Data Lifecycle Management and Records Management. eDiscovery is for search and export, not lifecycle management. Communication Compliance is for monitoring communications, not retention.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview eDiscovery

Question 7

Refer to the exhibit. A Microsoft Purview administrator imported this JSON policy for automatic sensitivity labeling. After deployment, users report that emails containing German social security numbers are not being automatically labeled. What is the most likely cause?

Accepted Answer

Auto-labeling for emails requires 'applyWithOverride' behavior, not 'apply'.. The JSON defines a label with auto-labeling conditions based on the sensitive info type 'EU_Deutschland_SocialSecurityNumber'. However, the auto-labeling behavior is set to 'apply', which is only supported for SharePoint and OneDrive documents, not for Exchange emails. For emails, the behavior must be 'applyWithOverride' or 'applyWithNotify'. Therefore, the auto-labeling will not apply to emails containing the sensitive type. Option B is correct. Option A is wrong because encryption is configured. Option C is wrong because the label is published. Option D is wrong because the sensitivity type is valid.

Answer

The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is not defined in the tenant.

Answer

The encryption setting prevents auto-labeling on emails.

Answer

The label is not published to users.

Question 8

As a compliance administrator for Contoso Ltd., you are responsible for implementing Microsoft Purview solutions to meet regulatory requirements. The organization operates in the healthcare sector and handles Protected Health Information (PHI). Your key objectives are: (1) Automatically detect PHI in documents stored in SharePoint Online and OneDrive for Business using built-in sensitive information types. (2) Apply a 'Highly Confidential - PHI' sensitivity label that encrypts the content and adds a custom header. (3) Ensure that the label is automatically applied when PHI is detected, with a policy that allows users to override the label with justification. (4) Audit all label application activities for compliance reporting. (5) Retain documents containing PHI for a minimum of 7 years. You have access to Microsoft Purview compliance portal. Which action should you take FIRST to achieve these objectives?

Accepted Answer

Create a sensitivity label named 'Highly Confidential - PHI' with encryption and header, and publish it to users and groups.. The first step is to create the sensitivity label with the required encryption and header settings and publish it so that it can be used in auto-labeling policies. Auto-labeling policies can then be configured to apply the label based on sensitive info types, with user override. Retention labels and policies are separate and can be configured later. Audit is enabled by default but should be verified. Therefore, option C is the correct first action.

Answer

Create an auto-labeling policy in Microsoft Purview that applies the sensitivity label to documents containing PHI.

Answer

Enable auditing in Microsoft Purview by turning on Audit logging.

Answer

Create a retention label and policy to retain documents containing PHI for 7 years.

Question 9

You are a compliance administrator for a multinational corporation that uses Microsoft Purview. The company must comply with the General Data Protection Regulation (GDPR). You need to implement a solution that allows data subjects to request access to their personal data stored in Exchange Online, SharePoint Online, and OneDrive for Business. The solution must provide a centralized portal for data subjects to submit requests and for privacy officers to manage the entire process, including searching for data, reviewing results, and exporting or redacting data. You also need to ensure that requests are automatically routed to the appropriate privacy officer based on the data subject's region. Microsoft Purview has been licensed for the entire organization. What should you configure?

Accepted Answer

Configure Microsoft Purview eDiscovery (Premium) cases with workflow automation and role-based access for privacy officers.. Microsoft Purview eDiscovery (Standard) allows for content searches across Exchange, SharePoint, and OneDrive, and can be used to manage GDPR data subject requests. However, the centralized portal and automated routing are features of Microsoft Purview eDiscovery (Premium), which includes case management, review sets, and advanced workflows. Therefore, the best option is to configure eDiscovery (Premium) cases with workflow automation. Option A is too basic. Option C is for data retention, not subject access requests. Option D is for classification, not access requests.

Answer

Use Microsoft Purview Information Protection to manually classify and search for personal data.

Answer

Configure Microsoft Purview eDiscovery (Standard) cases to manage each request manually.

Answer

Create retention labels and policies to retain personal data for GDPR compliance.

Question 10

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A is for email encryption, not blocking. Option B is for communication monitoring, not data protection. Option C is for retention, not real-time blocking.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview Data Lifecycle Management

Question 11

A multinational company deploys Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. The compliance team reports that a DLP policy blocks a legitimate payment processing workflow. What should the compliance administrator do to allow the workflow while maintaining protection?

Accepted Answer

Configure a DLP policy tip that allows users to override the block with a business justification.. Option D is correct because DLP policy tips allow users to override a block and provide a business justification, which can then be reviewed. Option A is wrong because disabling the policy leaves the data unprotected. Option B is wrong because adding the payment server to an allow list would bypass DLP entirely for that server. Option C is wrong because lowering the confidence level would reduce detection accuracy, potentially allowing real violations.

Answer

Add the payment processing server to the DLP policy’s allow list.

Answer

Reduce the minimum confidence level in the DLP policy.

Answer

Disable the DLP policy for the payment processing department.

Question 12

A healthcare organization stores patient records in SharePoint Online. The compliance officer needs to ensure that records containing Protected Health Information (PHI) are retained for 7 years per regulatory requirements. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Records Management. Option D is correct because Microsoft Purview Records Management allows labeling documents as records and applying retention policies. Option A is wrong because Data Lifecycle Management manages non-record content. Option B is wrong because Audit is for logging, not retention. Option C is wrong because eDiscovery is for search and export, not retention enforcement.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Lifecycle Management

Question 13

A company uses Microsoft 365 and wants to automatically classify documents based on sensitive information types like Social Security numbers. Which Microsoft Purview feature should be used?

Accepted Answer

Microsoft Purview Data Classification. Option C is correct because Microsoft Purview Data Classification uses trainable classifiers and sensitive info types to auto-classify content. Option A is wrong because Sensitivity labels are for manual or automatic labeling, but classification is the broader term. Option B is wrong because DLP policies prevent data loss but don't classify by default. Option D is wrong because Communication Compliance monitors communications, not classification.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Sensitivity Labels

Question 14

An organization needs to prevent users from sharing files containing trade secrets with external parties via email. The solution must allow internal sharing. Which Microsoft Purview capability should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention policies. Option B is correct because Microsoft Purview DLP can be configured to block external sharing of emails and attachments containing sensitive info. Option A is wrong because Sensitivity Labels control access and encryption but don't block sharing by themselves. Option C is wrong because Data Lifecycle Management handles retention. Option D is wrong because Communication Compliance monitors for policy violations, not block sharing.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Sensitivity Labels with encryption

Question 15

A financial services firm uses Microsoft Purview Information Barriers to prevent traders from communicating with investment bankers. A new employee in the trading department cannot access a SharePoint site used for compliance training. What should the administrator do?

Accepted Answer

Add the employee to the 'Traders' segment in Microsoft Purview Information Barriers.. Option D is correct because Information Barriers enforce segments; adding the employee to the correct segment allows access. Option A is wrong because disabling barriers would remove protection. Option B is wrong because segment membership is not based on group membership by default. Option C is wrong because overriding the block would violate the policy.

Answer

Add the employee to the 'Traders' Microsoft 365 group.

Answer

Use the 'Override' option in the Information Barrier policy.

Answer

Disable the Information Barrier policy for the trading department.

SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 16 — 15 Questions

Exhibit

SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 16 — 15 Questions

Exhibit