SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 17 — 15 Questions

Question 1

An organization has a Microsoft Purview Data Lifecycle Management policy that retains all documents for 5 years. However, legal requires that documents related to a specific lawsuit be preserved indefinitely. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place the relevant sites on litigation hold. Litigation hold (now called legal hold in Microsoft Purview) preserves all content in a SharePoint site or OneDrive account indefinitely, overriding any retention policy. This ensures documents related to the lawsuit are not deleted or altered, even if a Data Lifecycle Management policy would otherwise remove them after 5 years. The hold applies at the site level, not to individual items, and prevents both deletion and modification.

Answer

Configure information barriers

Answer

Apply a retention label with indefinite retention

Answer

Create a DLP policy to block deletion

Question 2

Your company needs to detect and prevent employees from sharing confidential product plans via email with external parties. Which Microsoft Purview solution should you configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive information, such as confidential product plans, via email and other channels. DLP policies can inspect email content and attachments for sensitive data types (e.g., custom keywords or patterns) and automatically block or quarantine the message if it is sent to external recipients. This aligns directly with the requirement to prevent employees from sharing confidential plans externally.

Answer

Sensitivity labels

Answer

Communication compliance

Answer

Retention policies

Question 3

A financial services company uses Microsoft Purview to manage compliance. They need to automatically apply a 'Confidential' label to all documents containing financial data in SharePoint. What should they configure?

Accepted Answer

Auto-labeling policy for sensitivity labels. Auto-labeling policies for sensitivity labels in Microsoft Purview allow organizations to automatically apply labels to documents based on conditions such as sensitive information types (e.g., financial data patterns). This meets the requirement to label documents containing financial data in SharePoint without manual intervention, leveraging built-in or custom sensitive info types.

Answer

Data classification dashboard

Answer

Trainable classifiers for manual labeling

Answer

Data Loss Prevention (DLP) policy

Question 4

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is correct because Microsoft Purview DLP policies can be scoped to Microsoft Teams chat and channel messages, detecting sensitive information types (for example, credit card or Social Security numbers) and taking protective actions such as blocking the message or generating alerts. Sensitivity labels are correct because they can be applied to Teams sites, channels, and files shared in Teams, and they enforce protection such as encryption and access restrictions that travel with the content. Information barriers are not the best fit here because they restrict communication between groups rather than protect sensitive data content itself. Communication compliance is designed to detect and remediate inappropriate or risky communications for compliance review, not to apply data protection controls. eDiscovery is used for identifying, preserving, and collecting content for legal or investigative purposes, not for preventing sensitive data exposure.

Answer

Information barriers

Answer

Communication compliance

Answer

eDiscovery

Question 5

Which TWO Microsoft Purview solutions help organizations respond to data subject requests under GDPR?

Accepted Answer

eDiscovery. eDiscovery (A) is correct because it enables organizations to search for and export personal data across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject access and export requests under GDPR Article 15. Data Lifecycle Management (C) is correct because it allows organizations to retain personal data for the minimum necessary period and permanently delete it when no longer needed, supporting the right to erasure under GDPR Article 17.

Answer

Information barriers

Answer

Data Loss Prevention (DLP)

Answer

Communication compliance

Question 6

Refer to the exhibit. You are reviewing a Microsoft Purview classification rule. The rule is enabled and set to apply a sensitivity label. However, you notice that documents containing EU personal data are not being labeled automatically. What is the most likely cause?

Accepted Answer

The rule does not include a condition to detect sensitive data. The rule is enabled and applies a sensitivity label, but documents containing EU personal data are not being labeled automatically. For automatic labeling to occur, the classification rule must include a condition that detects sensitive data types (e.g., EU passport numbers or GDPR-defined personal data). Without such a condition, the rule has no trigger to identify the content and apply the label, even if the rule is active and scoped correctly.

Answer

The label ID is invalid

Answer

The rule status is Disabled

Answer

The rule is not scoped to SharePoint Online

Question 7

Refer to the exhibit. You run the PowerShell command to search the unified audit log for file deletions. The command returns no results, but you know a file was deleted last week. What is the most likely reason?

Accepted Answer

Audit logging is not enabled for the organization. The most likely reason is that audit logging is not enabled for the organization. In Microsoft 365, unified audit log search requires that audit logging be explicitly turned on (by default, it is enabled for most tenants, but it can be disabled). If audit logging is disabled, no audit records are generated, so any search—including for 'FileDeleted' operations—will return no results, even if files were actually deleted.

Answer

The operation name 'FileDeleted' is incorrect

Answer

Audit logs are only retained for 90 days

Answer

The StartDate and EndDate are incorrect

Question 8

You are the compliance administrator for Contoso, a multinational corporation with headquarters in the US and subsidiaries in Europe and Asia. Contoso uses Microsoft 365 E5 and Microsoft Purview. The company handles personal data subject to GDPR and CCPA. You need to design a compliance solution that meets the following requirements:
- Automatically classify and protect documents containing personal data in SharePoint Online and OneDrive for Business.
- Ensure that data subject requests (DSRs) for access and deletion can be fulfilled within the regulatory timeframes.
- Prevent accidental sharing of sensitive data via email and Teams.
- Maintain an audit trail of all activities related to personal data for at least one year.
- Manage data retention to comply with local laws that require different retention periods for different types of data.
Which combination of Microsoft Purview solutions should you use?

Accepted Answer

Sensitivity labels with auto-labeling, DLP, eDiscovery, Data Lifecycle Management, and Audit (Premium). It includes all the necessary Purview solutions: Sensitivity labels with auto-labeling classify and protect documents containing personal data; DLP prevents accidental sharing via email and Teams; eDiscovery enables fulfilling data subject requests (DSRs) for access and deletion; Data Lifecycle Management allows configuring different retention periods for different data types; Audit (Premium) provides one-year audit trail retention. Options B, C, and D each miss one or more critical components needed to meet all requirements.

Answer

Insider Risk Management, DLP, eDiscovery, and Data Lifecycle Management

Answer

Data Lifecycle Management, Information Barriers, DLP, and Audit (Premium)

Answer

Sensitivity labels, Communication Compliance, eDiscovery, and Audit (Standard)

Question 9

You work for a law firm that uses Microsoft 365 E5. The firm handles highly confidential client information and must comply with attorney-client privilege. You need to implement a compliance solution that:
- Prevents unauthorized sharing of privileged documents via email.
- Enables lawyers to easily classify documents as 'Privileged' and automatically encrypt them.
- Allows the compliance team to monitor for accidental exposure of privileged information in Teams chats.
- Ensures that privileged documents are retained for 7 years after case closure, then automatically deleted.
- Provides the ability to search for privileged documents in case of a legal hold.
What should you configure?

Accepted Answer

Sensitivity labels with encryption, DLP, Communication Compliance, Data Lifecycle Management, and eDiscovery. Sensitivity labels with encryption classify and encrypt privileged documents, DLP prevents unauthorized email sharing, Communication Compliance monitors Teams chats for accidental exposure, Data Lifecycle Management enforces 7-year retention then deletion, and eDiscovery supports legal hold searches. Together these Microsoft Purview solutions meet all five requirements. This combination is the only one that covers classification, encryption, monitoring, retention, and search.

Answer

DLP, Communication Compliance, Data Lifecycle Management, and Audit (Standard)

Answer

Insider Risk Management, DLP, Data Lifecycle Management, and eDiscovery

Answer

Sensitivity labels, Information Barriers, Data Lifecycle Management, and eDiscovery

Question 10

You are the compliance administrator for a retail company that uses Microsoft 365 Business Premium. The company needs to:
- Block customers' credit card numbers from being sent via email.
- Retain all sales invoices for 3 years as per financial regulations.
- Allow managers to search and export employee emails for HR investigations.
- Ensure that only HR can access employee salary information.
Which Microsoft Purview solutions should you use?

Accepted Answer

DLP, Data Lifecycle Management, eDiscovery, and sensitivity labels. DLP (Data Loss Prevention) blocks credit card numbers from being sent via email, Data Lifecycle Management retains sales invoices for 3 years, eDiscovery allows managers to search and export employee emails for HR investigations, and sensitivity labels restrict access to salary information to HR only. Each requirement maps directly to a specific Purview solution: DLP for sensitive data protection, retention policies for compliance, eDiscovery for legal/HR investigations, and sensitivity labels for access control.

Answer

DLP, Information Barriers, eDiscovery, and sensitivity labels

Answer

Insider Risk Management, Data Lifecycle Management, eDiscovery, and sensitivity labels

Answer

Communication Compliance, Data Lifecycle Management, eDiscovery, and sensitivity labels

Question 11

Your organization is implementing Microsoft Purview to govern data across Microsoft 365 and Azure. Which TWO capabilities should you use to discover and classify sensitive data?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (A) enables you to discover, classify, and protect sensitive data by applying sensitivity labels and analyzing content via data loss prevention (DLP) policies. Microsoft Purview Data Map (B) provides automated scanning and classification of data assets across Azure and Microsoft 365, building a unified map of sensitive data locations. Together, they fulfill the discovery and classification requirements.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Question 12

A company uses Microsoft Purview to manage data compliance. They need to meet regulatory requirements that mandate retention of financial records for 7 years and deletion of personal data after 3 years. Which THREE capabilities should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (A) is correct because it enables classification and labeling of sensitive data, such as financial records and personal data, with retention and deletion policies. This ensures that data is retained for the required 7 years and deleted after 3 years, meeting regulatory mandates. It works by applying sensitivity labels that trigger retention or deletion actions based on the label's configured settings.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview eDiscovery

Question 13

Refer to the exhibit. A Microsoft Purview administrator imported this JSON policy for automatic sensitivity labeling. After deployment, users report that emails containing German social security numbers are not being automatically labeled. What is the most likely cause?

Accepted Answer

Auto-labeling for emails requires 'applyWithOverride' behavior, not 'apply'.. Microsoft Purview auto-labeling for emails requires the 'applyWithOverride' action to allow users to override the label, whereas 'apply' is used for static labeling in other scenarios like SharePoint. The JSON policy uses 'apply' without override, which prevents automatic labeling on emails, as email auto-labeling policies specifically need the 'applyWithOverride' behavior to function correctly.

Answer

The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is not defined in the tenant.

Answer

The encryption setting prevents auto-labeling on emails.

Answer

The label is not published to users.

Question 14

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A (Communication Compliance) is for communication monitoring, not data protection. Option B (Message Encryption) is for email encryption, not blocking. Option D (Data Lifecycle Management) is for retention, not real-time blocking.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview Data Lifecycle Management

Question 15

A multinational company deploys Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. The compliance team reports that a DLP policy blocks a legitimate payment processing workflow. What should the compliance administrator do to allow the workflow while maintaining protection?

Accepted Answer

Configure a DLP policy tip that allows users to override the block with a business justification.. DLP policy tips allow users to override a block by providing a business justification, which enables legitimate workflows to proceed while maintaining data protection. This approach ensures that the payment processing workflow is not permanently blocked, but the override is auditable and subject to compliance review. It balances security and operational needs without disabling or weakening the DLP policy.

Answer

Add the payment processing server to the DLP policy’s allow list.

Answer

Reduce the minimum confidence level in the DLP policy.

Answer

Disable the DLP policy for the payment processing department.