SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 18 — 15 Questions

Question 1

Which TWO of the following are capabilities of Microsoft Purview Data Loss Prevention?

Accepted Answer

Block sharing of sensitive data via email.. Microsoft Purview Data Loss Prevention (DLP) is designed to detect and prevent the accidental or intentional sharing of sensitive information. Option C is correct because DLP policies can block the sharing of sensitive data via email by inspecting content in transit and applying actions such as blocking the message. Option E is correct because DLP can display policy tips to users in real time, warning them before they share sensitive data and allowing them to override the block with justification.

Answer

Define retention periods for documents.

Answer

Search for content in Exchange Online mailboxes.

Answer

Automatically apply sensitivity labels to content.

Question 2

Which THREE are benefits of using Microsoft Purview Compliance Manager?

Accepted Answer

View a compliance score that indicates your overall compliance posture.. Compliance Manager provides a compliance score to indicate your overall compliance posture (B), suggests improvement actions to achieve compliance (D), and allows you to assign compliance tasks to other users (C). Option A is incorrect because Data Loss Prevention policies are created in the Microsoft Purview compliance portal, not directly in Compliance Manager. Option E is incorrect because automatically applying sensitivity labels is done through auto-labeling policies, not Compliance Manager.

Answer

Create Data Loss Prevention policies.

Answer

Automatically apply sensitivity labels to documents.

Question 3

Which TWO scenarios are appropriate uses of Microsoft Purview Audit (Standard)?

Accepted Answer

Investigating a user who accessed a sensitive file in SharePoint.. Microsoft Purview Audit (Standard) logs key events such as file access and admin activities, and retains logs for 90 days. Option A is correct because accessing a sensitive file in SharePoint generates an audit event captured by Audit (Standard). Option B is correct because searching the audit log for admin activities within the 90-day retention period is a core capability of Audit (Standard).

Answer

Generating custom reports with PowerShell for all activities.

Answer

Tracking when sensitivity labels are applied to documents.

Answer

Retaining audit logs for 2 years for compliance purposes.

Question 4

Refer to the exhibit. You are reviewing a Microsoft Purview sensitivity label configuration. A user reports that a document containing a sensitive info type with confidence 80 was not automatically labeled. What is the most likely cause?

Accepted Answer

The auto-labeling policy is not configured to apply this label.. Auto-labeling in Microsoft Purview requires a specific auto-labeling policy to be configured and published to the user or location. Even if a sensitivity label exists and a sensitive info type (SIT) is detected with high confidence, the label will not be applied automatically unless an auto-labeling policy is explicitly set to apply that label to documents matching the SIT. The user's report indicates the label was not applied, which points to the policy not being configured, not a user override or encryption issue.

Answer

The user has overridden the label application.

Answer

The encryption is disabled.

Answer

The encryption template ID is missing.

Question 5

Refer to the exhibit. A compliance administrator runs the PowerShell commands to create a DLP policy. Users complain that they are blocked from sending emails containing credit card numbers but cannot override the block. The administrator wants to allow override with a business justification. What should they do?

Accepted Answer

Change the NotifyAllowOverride parameter to $true in the rule.. The `NotifyAllowOverride` parameter controls whether users can override a DLP rule action with a business justification. Setting it to `$true` enables the override prompt, allowing users to bypass the block when they provide a valid reason. The current policy blocks emails with credit card numbers without offering this option, so changing this parameter directly addresses the requirement.

Answer

Change the SentInfo parameter to a different sensitive info type.

Answer

Remove the SharePoint location from the policy.

Answer

Enable the DLP policy by setting the Policy's Enabled parameter to $true.

Question 6

Refer to the exhibit. A legal team needs to preserve all documents in SharePoint and OneDrive for 5 years. The current policy retains for 1 year. What should the administrator do to meet the requirement?

Accepted Answer

Change the retention duration to 1825 days.. The policy retains for 365 days (1 year), but the requirement is 5 years. Changing the retention duration to 1825 days (5 years) meets the requirement. Option A is wrong because the policy already includes both locations. Option B is wrong because changing to Delete would delete content. Option D is wrong because changing to KeepAndDelete would still delete after retention, but the duration is the issue.

Answer

Add Exchange Online to the locations.

Answer

Change the retention type to Delete.

Answer

Change the retention action to KeepAndDelete.

Question 7

Your organization is implementing Microsoft Purview to manage sensitive data. You need to ensure that documents containing credit card numbers are automatically detected and protected. Which Microsoft Purview solution should you configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect sensitive data, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply protective actions like blocking sharing or encrypting the document. Microsoft Purview DLP policies can scan content at rest, in transit, and in use across Exchange, SharePoint, OneDrive, Teams, and endpoints, ensuring credit card numbers are identified and protected in real time.

Answer

eDiscovery (Premium)

Answer

Audit (Standard)

Answer

Information Barriers

Question 8

Your organization uses Microsoft Purview to label documents. Users report that some documents are automatically labeled as 'Confidential' even though the content is public. Which action should you take to resolve this issue?

Accepted Answer

Review and adjust the auto-labeling rules in the sensitivity label policies. The issue is that auto-labeling rules are incorrectly classifying public content as 'Confidential'. By reviewing and adjusting the auto-labeling rules in the sensitivity label policies, you can refine the conditions (e.g., sensitive info types or pattern matching) to prevent false positives. This directly addresses the misconfiguration causing automatic labeling of non-sensitive content.

Answer

Enable auditing to track label usage

Answer

Disable auto-labeling in all sensitivity label policies

Answer

Require users to manually apply labels

Question 9

Refer to the exhibit. You are a compliance administrator managing a DLP policy in Microsoft Purview. The policy is set to 'enforce' mode but you notice that internal users can still share credit card numbers via email to external recipients. What is the most likely cause?

Accepted Answer

The action only blocks access to the content from external users, not sharing by internal users. A DLP policy in 'enforce' mode can still allow internal users to share sensitive data if the policy action is configured to 'block access to content from external users' rather than 'block sharing by internal users'. In Microsoft Purview, the 'block access' action restricts external recipients from viewing the content but does not prevent the internal sender from transmitting the email. To stop internal users from sending, the policy must use the 'block sending' action, which prevents the message from being delivered.

Answer

The policy is in test mode, not enforce mode

Answer

The policy is not applied to the user's mailbox

Answer

The condition requires a minimum count of 5

Question 10

Your organization needs to retain all email communications with customers for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?

Accepted Answer

Retention policies. Retention policies in Microsoft Purview are designed to retain data for a specified period to meet regulatory or legal requirements. For email communications, a retention policy can be applied to Exchange mailboxes to ensure all messages are preserved for exactly 7 years, regardless of user deletion. This directly addresses the need to retain all customer emails for the mandated duration.

Answer

Sensitivity labels

Answer

eDiscovery (Standard)

Answer

Data Loss Prevention policies

Question 11

A user reports that a sensitive document labeled 'Highly Confidential' was accidentally shared with an external vendor. You need to investigate how the sharing occurred. Which two Microsoft Purview tools should you use together?

Accepted Answer

Audit (Standard) and Content Explorer. Audit (Standard) logs all user activities, including sharing events, while Content Explorer shows where sensitive documents with specific sensitivity labels (like 'Highly Confidential') are stored and who has accessed them. Together, they allow you to trace the exact sharing action and identify the document's location and exposure.

Answer

Insider Risk Management and Information Barriers

Answer

eDiscovery (Premium) and Communication Compliance

Answer

Data Loss Prevention and Sensitivity labels

Answer

Records Management and Data Lifecycle Management

Question 12

Your organization is subject to GDPR and must respond to data subject deletion requests within 30 days. You have identified all personal data in Microsoft 365. Which Microsoft Purview solution should you use to permanently delete the data?

Accepted Answer

Data Lifecycle Management (disposition review). Data Lifecycle Management (disposition review) is the correct solution because it allows you to permanently delete personal data after a specified retention period. In this scenario, you have already identified the personal data and need to respond to a deletion request within 30 days. Disposition review provides a workflow to review and then permanently delete the data, meeting GDPR requirements.

Answer

Retention policies to preserve the data

Answer

Data Loss Prevention to block the data

Answer

eDiscovery (Premium) to export the data

Question 13

Your organization uses Microsoft Purview to classify documents containing health information. You need to ensure that only users with explicit permission can access these documents. Which Microsoft Purview capability should you use?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption are the correct choice because they allow you to classify documents containing health information and apply encryption to restrict access to only users with explicit permissions. This ensures that even if the document is shared or moved, only authorized users can decrypt and read it, meeting the requirement for access control.

Answer

Audit logs

Answer

Retention policies

Answer

Data Loss Prevention

Question 14

Your organization has a Microsoft Purview Data Lifecycle Management policy that deletes emails after 3 years. A legal hold is placed on a user's mailbox. What happens to the emails?

Accepted Answer

Emails are preserved and not deleted despite the retention policy. When a legal hold is placed on a user's mailbox in Microsoft Purview, it takes precedence over any deletion actions from Data Lifecycle Management policies. The hold preserves all mailbox content, including emails that would otherwise be deleted after 3 years, ensuring data is retained for legal or compliance purposes. This is because legal holds are designed to prevent permanent deletion of data subject to litigation or investigation.

Answer

Only emails created before the hold are deleted

Answer

Emails are deleted immediately to avoid conflicting policies

Answer

Emails are deleted after 3 years as per the retention policy

Question 15

Refer to the exhibit. You run the PowerShell command shown to investigate a potential data exfiltration incident. The output is empty. Which is the most likely reason?

Accepted Answer

Audit logging is not enabled for the tenant. The Search-UnifiedAuditLog cmdlet retrieves entries from the unified audit log. If the output is empty, the most likely cause is that unified audit logging is not enabled for the tenant. In Microsoft 365, unified audit logging must be turned on in the compliance portal or via PowerShell (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true). Without this, no audit records are generated, so the cmdlet returns no results regardless of user activity.

Answer

The user does not have a mailbox

Answer

The command syntax is incorrect

Answer

The user did not download or access any files in the past 7 days