SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 17 — 15 Questions

Question 1

Your organization is implementing Microsoft Purview to govern data across Microsoft 365 and Azure. Which TWO capabilities should you use to discover and classify sensitive data?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (A) enables you to discover, classify, and protect sensitive data by applying sensitivity labels and analyzing content via data loss prevention (DLP) policies. Microsoft Purview Data Map (B) provides automated scanning and classification of data assets across Azure and Microsoft 365, building a unified map of sensitive data locations. Together, they fulfill the discovery and classification requirements.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Question 2

A company uses Microsoft Purview to manage data compliance. They need to meet regulatory requirements that mandate retention of financial records for 7 years and deletion of personal data after 3 years. Which THREE capabilities should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (A) is correct because it enables classification and labeling of sensitive data, such as financial records and personal data, with retention and deletion policies. This ensures that data is retained for the required 7 years and deleted after 3 years, meeting regulatory mandates. It works by applying sensitivity labels that trigger retention or deletion actions based on the label's configured settings.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview eDiscovery

Question 3

Refer to the exhibit. A Microsoft Purview administrator imported this JSON policy for automatic sensitivity labeling. After deployment, users report that emails containing German social security numbers are not being automatically labeled. What is the most likely cause?

Accepted Answer

Auto-labeling for emails requires 'applyWithOverride' behavior, not 'apply'.. Microsoft Purview auto-labeling for emails requires the 'applyWithOverride' action to allow users to override the label, whereas 'apply' is used for static labeling in other scenarios like SharePoint. The JSON policy uses 'apply' without override, which prevents automatic labeling on emails, as email auto-labeling policies specifically need the 'applyWithOverride' behavior to function correctly.

Answer

The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is not defined in the tenant.

Answer

The encryption setting prevents auto-labeling on emails.

Answer

The label is not published to users.

Question 4

As a compliance administrator for Contoso Ltd., you are responsible for implementing Microsoft Purview solutions to meet regulatory requirements. The organization operates in the healthcare sector and handles Protected Health Information (PHI). Your key objectives are: (1) Automatically detect PHI in documents stored in SharePoint Online and OneDrive for Business using built-in sensitive information types. (2) Apply a 'Highly Confidential - PHI' sensitivity label that encrypts the content and adds a custom header. (3) Ensure that the label is automatically applied when PHI is detected, with a policy that allows users to override the label with justification. (4) Audit all label application activities for compliance reporting. (5) Retain documents containing PHI for a minimum of 7 years. You have access to Microsoft Purview compliance portal. Which action should you take FIRST to achieve these objectives?

Accepted Answer

Create a sensitivity label named 'Highly Confidential - PHI' with encryption and header, and publish it to users and groups.. The first step is to create the sensitivity label with the required encryption and header settings and publish it so that it can be used in auto-labeling policies. Auto-labeling policies can then be configured to apply the label based on sensitive info types, with user override. Retention labels and policies are separate and can be configured later. Audit is enabled by default but should be verified. Therefore, option C is the correct first action.

Answer

Create an auto-labeling policy in Microsoft Purview that applies the sensitivity label to documents containing PHI.

Answer

Enable auditing in Microsoft Purview by turning on Audit logging.

Answer

Create a retention label and policy to retain documents containing PHI for 7 years.

Question 5

You are a compliance administrator for a multinational corporation that uses Microsoft Purview. The company must comply with the General Data Protection Regulation (GDPR). You need to implement a solution that allows data subjects to request access to their personal data stored in Exchange Online, SharePoint Online, and OneDrive for Business. The solution must provide a centralized portal for data subjects to submit requests and for privacy officers to manage the entire process, including searching for data, reviewing results, and exporting or redacting data. You also need to ensure that requests are automatically routed to the appropriate privacy officer based on the data subject's region. Microsoft Purview has been licensed for the entire organization. What should you configure?

Accepted Answer

Configure Microsoft Purview eDiscovery (Premium) cases with workflow automation and role-based access for privacy officers.. Microsoft Purview eDiscovery (Standard) allows for content searches across Exchange, SharePoint, and OneDrive, and can be used to manage GDPR data subject requests. However, the centralized portal and automated routing are features of Microsoft Purview eDiscovery (Premium), which includes case management, review sets, and advanced workflows. Therefore, the best option is to configure eDiscovery (Premium) cases with workflow automation. Option A is too basic. Option C is for data retention, not subject access requests. Option D is for classification, not access requests.

Answer

Use Microsoft Purview Information Protection to manually classify and search for personal data.

Answer

Configure Microsoft Purview eDiscovery (Standard) cases to manage each request manually.

Answer

Create retention labels and policies to retain personal data for GDPR compliance.

Question 6

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A (Communication Compliance) is for communication monitoring, not data protection. Option B (Message Encryption) is for email encryption, not blocking. Option D (Data Lifecycle Management) is for retention, not real-time blocking.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview Data Lifecycle Management

Question 7

A multinational company deploys Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. The compliance team reports that a DLP policy blocks a legitimate payment processing workflow. What should the compliance administrator do to allow the workflow while maintaining protection?

Accepted Answer

Configure a DLP policy tip that allows users to override the block with a business justification.. DLP policy tips allow users to override a block by providing a business justification, which enables legitimate workflows to proceed while maintaining data protection. This approach ensures that the payment processing workflow is not permanently blocked, but the override is auditable and subject to compliance review. It balances security and operational needs without disabling or weakening the DLP policy.

Answer

Add the payment processing server to the DLP policy’s allow list.

Answer

Reduce the minimum confidence level in the DLP policy.

Answer

Disable the DLP policy for the payment processing department.

Question 8

A healthcare organization stores patient records in SharePoint Online. The compliance officer needs to ensure that records containing Protected Health Information (PHI) are retained for 7 years per regulatory requirements. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Records Management. Microsoft Purview Records Management is the correct solution because it enables organizations to apply retention labels and policies that enforce mandatory retention periods for regulatory compliance. For patient records containing PHI, a retention label can be configured to retain the data for exactly 7 years and then trigger a disposition review or automatic deletion, ensuring the organization meets healthcare regulatory requirements.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Lifecycle Management

Question 9

A company uses Microsoft 365 and wants to automatically classify documents based on sensitive information types like Social Security numbers. Which Microsoft Purview feature should be used?

Accepted Answer

Microsoft Purview Data Classification. Microsoft Purview Data Classification is the correct feature because it automatically scans and classifies documents based on sensitive information types (e.g., Social Security numbers) using built-in or custom classifiers. This enables organizations to identify and label content without manual intervention, directly addressing the requirement for automatic classification.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Sensitivity Labels

Question 10

An organization needs to prevent users from sharing files containing trade secrets with external parties via email. The solution must allow internal sharing. Which Microsoft Purview capability should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention policies. Microsoft Purview Data Loss Prevention (DLP) policies are designed to detect and block the sharing of sensitive information—such as trade secrets—via email or other channels, while still allowing internal sharing. DLP can inspect email content and attachments for sensitive data types and apply actions like blocking external sends, making it the correct choice for this requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Sensitivity Labels with encryption

Question 11

A financial services firm uses Microsoft Purview Information Barriers to prevent traders from communicating with investment bankers. A new employee in the trading department cannot access a SharePoint site used for compliance training. What should the administrator do?

Accepted Answer

Add the employee to the 'Traders' segment in Microsoft Purview Information Barriers.. Microsoft Purview Information Barriers use segments to group users based on their organizational roles. Adding the new employee to the 'Traders' segment ensures that the Information Barrier policy applies to them correctly, allowing them to access the compliance training SharePoint site while still being blocked from communicating with investment bankers.

Answer

Add the employee to the 'Traders' Microsoft 365 group.

Answer

Use the 'Override' option in the Information Barrier policy.

Answer

Disable the Information Barrier policy for the trading department.

Question 12

A law firm needs to retain client documents for 10 years after case closure, but automatically delete drafts after 30 days. Which two Microsoft Purview solutions should be combined?

Accepted Answer

Microsoft Purview Records Management and Data Lifecycle Management. Microsoft Purview Records Management enables the firm to mark client documents as records and enforce a 10-year retention period after case closure, while Data Lifecycle Management allows automatic deletion of drafts after 30 days. Together, they provide both long-term retention for compliance and short-term cleanup for non-record content, aligning with the firm's specific requirements.

Answer

Microsoft Purview Data Loss Prevention and eDiscovery

Answer

Microsoft Purview eDiscovery and Audit

Answer

Microsoft Purview Audit and Data Loss Prevention

Question 13

A company wants to automatically apply a 'Confidential' sensitivity label to all documents containing credit card numbers. Which Microsoft Purview feature should be used to create the auto-labeling policy?

Accepted Answer

Microsoft Purview Auto-labeling policies. Microsoft Purview Auto-labeling policies are specifically designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This feature uses exact data match or pattern-based detection to label content at rest or in transit, fulfilling the requirement without manual intervention.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Question 14

An organization uses Microsoft Purview Compliance Manager to track compliance with regulations. The compliance officer needs to create a custom assessment for a new internal policy. What should they do?

Accepted Answer

Create a new custom assessment in Compliance Manager and add custom controls.. In Microsoft Purview Compliance Manager, assessments are built on templates that contain controls. To create a custom assessment for a new internal policy, the compliance officer must create a new custom assessment and then add custom controls, because Compliance Manager does not provide a built-in template for arbitrary internal policies. Option B correctly describes this workflow: creating a new custom assessment and adding custom controls.

Answer

Use the Microsoft 365 admin center to create a compliance assessment.

Answer

Use the built-in 'Custom' template in Compliance Manager and modify it.

Answer

Import a new assessment template from the Microsoft Service Trust Portal.

Question 15

A company uses Microsoft Teams and wants to ensure that messages containing offensive language are flagged for review. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is designed to detect and flag messages containing offensive language, harassment, or other policy violations in Microsoft Teams, Exchange Online, and Yammer. It uses customizable policies and machine learning classifiers to automatically review communications and route flagged items for human review, making it the correct solution for this requirement.

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit