SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 19 — 15 Questions

Question 1

Your organization is implementing Microsoft 365 and needs to prevent sensitive data from being copied to USB drives. Which Microsoft Purview solution should you configure?

Accepted Answer

Endpoint data loss prevention (Endpoint DLP). Endpoint DLP (Data Loss Prevention) monitors and controls actions users take on devices, such as copying sensitive data to USB drives. It enforces policies directly on Windows, macOS, and other endpoints to block unauthorized transfers, making it the correct solution for preventing data exfiltration via removable media.

Answer

Audit logs

Answer

Communication Compliance

Answer

Sensitivity labels

Question 2

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' label to documents that contain salary information. Which type of sensitivity label configuration should you use?

Accepted Answer

Auto-labeling with sensitive information types. Auto-labeling with sensitive information types allows Microsoft Purview to automatically apply a 'Confidential' label to documents containing salary information based on predefined patterns, such as employee salary data. This configuration uses content scanning to detect sensitive data (e.g., via built-in or custom sensitive information types) and applies the label without user intervention, meeting the requirement for automatic classification.

Answer

Manual labeling

Answer

Default labeling for SharePoint libraries

Answer

Mandatory labeling policy

Question 3

Your organization uses Microsoft Purview Communication Compliance to detect harassing messages. You receive an alert for a message that appears to be a joke between colleagues. What should you do to prevent similar false positives?

Accepted Answer

Refine the policy conditions to exclude certain keywords or users. Microsoft Purview Communication Compliance policies are configurable to reduce false positives. You can refine the policy by adding conditions to exclude specific keywords (e.g., 'joke' or 'just kidding') or specific users (e.g., known colleagues) from triggering alerts, without disabling the policy or relying on user behavior changes.

Answer

Train users not to joke about sensitive topics

Answer

Delete the alert and ignore future similar messages

Answer

Turn off the policy and use a different solution

Question 4

Your organization must ensure that financial reports are protected with encryption and cannot be forwarded. Which two Microsoft Purview features should you combine?

Accepted Answer

Sensitivity labels with encryption and Data Loss Prevention. Sensitivity labels with encryption allow you to apply persistent encryption to financial reports, ensuring they remain protected even when shared. Data Loss Prevention (DLP) policies can then block or warn users from forwarding these encrypted reports via email or other channels, providing a combined solution for encryption and forwarding prevention.

Answer

Data Lifecycle Management and Data Loss Prevention

Answer

Retention policies and Records Management

Answer

Information Barriers and Communication Compliance

Answer

eDiscovery (Premium) and Audit (Standard)

Question 5

Your organization uses Microsoft 365 and needs to identify internal users who are sending confidential data to external domains repeatedly. Which Microsoft Purview solution should you use?

Accepted Answer

Insider Risk Management. Insider Risk Management (IRM) is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that violate organizational policies, such as repeatedly sending confidential data to external domains. IRM uses predefined or custom policies to correlate signals from Microsoft 365 logs (e.g., email, SharePoint, Teams) and user behavior analytics to identify patterns of data exfiltration by internal users. Unlike other solutions, IRM focuses on user-centric risk scenarios and can trigger automated responses like escalation or case creation.

Answer

Data Loss Prevention

Answer

Audit (Premium)

Answer

Communication Compliance

Question 6

Your organization has a Microsoft Purview retention policy that retains SharePoint documents for 5 years. After 5 years, you want an administrator to review and approve deletion. Which configuration is required?

Accepted Answer

Configure a disposition review at the end of the retention period. A disposition review allows an administrator to manually review and approve or reject deletion at the end of the retention period, meeting the requirement for admin approval.

Option B is incorrect: applying a retention label and enabling disposition review is not required; the configuration needed is to enable disposition review on the retention policy itself. Option C is incorrect: eDiscovery (Premium) is used for legal investigations and exports, not for managing disposition workflows. Option D is incorrect: automatic deletion would delete files without any admin review, which contradicts the requirement.

Answer

Apply a retention label and enable disposition review

Answer

Use eDiscovery (Premium) to export and then delete

Answer

Set the retention policy to delete automatically after 5 years

Question 7

Your organization uses Microsoft Purview to manage data governance. You need to ensure that sensitive financial data containing credit card numbers is automatically detected and labeled when stored in SharePoint Online. Which compliance solution should you configure?

Accepted Answer

Information Protection auto-labeling. Microsoft Purview Information Protection auto-labeling is the correct solution because it can automatically detect sensitive data types, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply sensitivity labels to documents in SharePoint Online. This ensures that financial data is classified and protected at rest without manual intervention, aligning with the requirement for automatic detection and labeling.

Answer

eDiscovery (Premium)

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Question 8

A company is implementing Microsoft Purview Communication Compliance to detect inappropriate messages. They need to monitor Microsoft Teams channel messages and chat messages for potential policy violations. Which configuration is required?

Accepted Answer

Configure a Communication Compliance policy that includes Teams messages as the supervised communication channel.. Communication Compliance policies can be configured to monitor Microsoft Teams channel messages and chat messages natively, without requiring additional DLP policies, retention policies, or third-party archiving. The policy must include Teams messages as a supervised communication channel. Option A is incorrect because DLP policies are not required for Communication Compliance monitoring; they serve a different purpose. Option B is incorrect because Exchange Online retention policies retain data but do not enable monitoring for policy violations. Option C is incorrect because Microsoft provides native integration for Teams monitoring, so a third-party solution is unnecessary.

Answer

Enable Microsoft Purview Data Loss Prevention (DLP) policies for Teams.

Answer

Set up an Exchange Online retention policy to retain Teams messages.

Answer

Deploy a third-party archiving solution for Teams messages.

Question 9

Refer to the exhibit. The JSON snippet shows a sensitivity label configuration. What is the purpose of the 'SensitiveInfoTypes' property in this label?

Accepted Answer

It specifies the sensitive information types that trigger automatic labeling.. The 'SensitiveInfoTypes' property in a sensitivity label configuration specifies which built-in or custom sensitive information types (e.g., credit card numbers, passport numbers) should be detected in content. When these types are matched, the label can be applied automatically through auto-labeling policies, ensuring consistent protection without requiring manual user action.

Answer

It sets the retention period for content with this label.

Answer

It defines the user groups that can apply this label manually.

Answer

It configures the encryption settings for the label.

Question 10

Your organization uses Microsoft Purview Records Management to manage high-value contracts. You need to ensure that once a contract is declared as a record, it cannot be modified or deleted by any user, including administrators. Which type of record should you use?

Accepted Answer

Regulatory record. Regulatory records provide the highest level of protection and cannot be modified or deleted by any user, including administrators. Option A is wrong because disposition review is a process for reviewing content before deletion, not a record type that locks content. Option B is wrong because event-based retention policies apply retention based on a trigger event, but they do not prevent modification or deletion once declared a record. Option C is wrong because a retention label with default settings does not lock the record; it only applies retention settings without regulatory protections.

Answer

Disposition review

Answer

Event-based retention policy

Answer

Retention label with default settings

Question 11

A multinational corporation must comply with the EU General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) by searching for personal data across Exchange Online, SharePoint Online, and OneDrive for Business. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). EDiscovery (Premium) provides powerful search capabilities across Exchange Online, SharePoint Online, and OneDrive for Business, making it suitable for DSARs. Option A is incorrect because Data Lifecycle Management focuses on retention and deletion policies, not content search. Option B is incorrect because Audit (Premium) logs user activities but does not search for specific content. Option D is incorrect because Data Loss Prevention (DLP) prevents data leakage but does not provide the content search needed for DSARs.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Data Loss Prevention (DLP)

Question 12

Your organization wants to automatically retain all customer emails for 7 years and then delete them. Which Microsoft Purview feature should you configure?

Accepted Answer

Data Lifecycle Management retention policy. Data Lifecycle Management includes retention and deletion policies for Exchange Online. Option B is wrong because Information Protection is about classification. Option C is wrong because Audit is for logging. Option D is wrong because eDiscovery is for search and hold.

Answer

Information Protection sensitivity labels

Answer

Audit log retention

Answer

eDiscovery hold

Question 13

Refer to the exhibit. You are reviewing a Communication Compliance policy. What does this policy do when a user sends an email containing EU GDPR PII to privacy@contoso.com?

Accepted Answer

It notifies the policy owner and generates a case for investigation.. Communication Compliance policies in Microsoft 365 are designed to detect and investigate policy violations, not to enforce real-time blocking or automated deletion. When a user sends an email containing EU GDPR PII to a specified recipient like privacy@contoso.com, the policy triggers an alert, notifies the policy owner, and generates a case for investigation in the Compliance Center. This allows organizations to review and remediate potential data privacy violations without disrupting email flow.

Answer

It blocks the email from being sent.

Answer

It automatically deletes the email after 30 days.

Answer

It applies a sensitivity label to the email.

Question 14

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to receive alerts when a user attempts to share a file containing personally identifiable information (PII) via email. Which DLP rule component is used to define the notification action?

Accepted Answer

Actions. In Microsoft Purview DLP, the 'Actions' component defines what happens when a DLP rule is triggered, including sending notifications or alerts to administrators. For the scenario of receiving alerts when a user attempts to share PII via email, the notification action is configured within the rule's Actions section. Conditions define what data to match, Locations specify where to monitor, and Exceptions refine rule scope, but only Actions contain the notification settings.

Answer

Conditions

Answer

Location

Answer

Exceptions

Question 15

Refer to the exhibit. An administrator created a retention label with the settings shown. What is the behavior of this label when applied to content?

Accepted Answer

It retains content for 7 years and then automatically deletes it.. The retention label is configured with a retention period of 7 years and an action of 'Delete items automatically when the retention period ends.' Since no disposition review is enabled, the content will be automatically deleted after 7 years. This matches option C exactly.

Answer

It retains content for 5 years and then applies a disposition review.

Answer

It marks content as a regulatory record and prevents deletion.

Answer

It retains content indefinitely with no deletion.