SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. You are a compliance administrator managing a DLP policy in Microsoft Purview. The policy is set to 'enforce' mode but you notice that internal users can still share credit card numbers via email to external recipients. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The action only blocks access to the content from external users, not sharing by internal users. A DLP policy in 'enforce' mode can still allow internal users to share sensitive data if the policy action is configured to 'block access to content from external users' rather than 'block sharing by internal users'. In Microsoft Purview, the 'block access' action restricts external recipients from viewing the content but does not prevent the internal sender from transmitting the email. To stop internal users from sending, the policy must use the 'block sending' action, which prevents the message from being delivered.

Answer

The policy is in test mode, not enforce mode

Answer

The policy is not applied to the user's mailbox

Answer

The condition requires a minimum count of 5

Question 2

Your organization needs to retain all email communications with customers for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?

Accepted Answer

Retention policies. Retention policies in Microsoft Purview are designed to retain data for a specified period to meet regulatory or legal requirements. For email communications, a retention policy can be applied to Exchange mailboxes to ensure all messages are preserved for exactly 7 years, regardless of user deletion. This directly addresses the need to retain all customer emails for the mandated duration.

Answer

Sensitivity labels

Answer

eDiscovery (Standard)

Answer

Data Loss Prevention policies

Question 3

Your organization uses Microsoft Purview to classify documents containing health information. You need to ensure that only users with explicit permission can access these documents. Which Microsoft Purview capability should you use?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption are the correct choice because they allow you to classify documents containing health information and apply encryption to restrict access to only users with explicit permissions. This ensures that even if the document is shared or moved, only authorized users can decrypt and read it, meeting the requirement for access control.

Answer

Audit logs

Answer

Retention policies

Answer

Data Loss Prevention

Question 4

Your organization has a Microsoft Purview Data Lifecycle Management policy that deletes emails after 3 years. A legal hold is placed on a user's mailbox. What happens to the emails?

Accepted Answer

Emails are preserved and not deleted despite the retention policy. When a legal hold is placed on a user's mailbox in Microsoft Purview, it takes precedence over any deletion actions from Data Lifecycle Management policies. The hold preserves all mailbox content, including emails that would otherwise be deleted after 3 years, ensuring data is retained for legal or compliance purposes. This is because legal holds are designed to prevent permanent deletion of data subject to litigation or investigation.

Answer

Only emails created before the hold are deleted

Answer

Emails are deleted immediately to avoid conflicting policies

Answer

Emails are deleted after 3 years as per the retention policy

Question 5

Refer to the exhibit. You run the PowerShell command shown to investigate a potential data exfiltration incident. The output is empty. Which is the most likely reason?

Accepted Answer

Audit logging is not enabled for the tenant. The Search-UnifiedAuditLog cmdlet retrieves entries from the unified audit log. If the output is empty, the most likely cause is that unified audit logging is not enabled for the tenant. In Microsoft 365, unified audit logging must be turned on in the compliance portal or via PowerShell (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true). Without this, no audit records are generated, so the cmdlet returns no results regardless of user activity.

Answer

The user does not have a mailbox

Answer

The command syntax is incorrect

Answer

The user did not download or access any files in the past 7 days

Question 6

Your organization is implementing Microsoft 365 and needs to prevent sensitive data from being copied to USB drives. Which Microsoft Purview solution should you configure?

Accepted Answer

Endpoint data loss prevention (Endpoint DLP). Endpoint DLP (Data Loss Prevention) monitors and controls actions users take on devices, such as copying sensitive data to USB drives. It enforces policies directly on Windows, macOS, and other endpoints to block unauthorized transfers, making it the correct solution for preventing data exfiltration via removable media.

Answer

Audit logs

Answer

Communication Compliance

Answer

Sensitivity labels

Question 7

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' label to documents that contain salary information. Which type of sensitivity label configuration should you use?

Accepted Answer

Auto-labeling with sensitive information types. Auto-labeling with sensitive information types allows Microsoft Purview to automatically apply a 'Confidential' label to documents containing salary information based on predefined patterns, such as employee salary data. This configuration uses content scanning to detect sensitive data (e.g., via built-in or custom sensitive information types) and applies the label without user intervention, meeting the requirement for automatic classification.

Answer

Manual labeling

Answer

Default labeling for SharePoint libraries

Answer

Mandatory labeling policy

Question 8

Your organization uses Microsoft Purview Communication Compliance to detect harassing messages. You receive an alert for a message that appears to be a joke between colleagues. What should you do to prevent similar false positives?

Accepted Answer

Refine the policy conditions to exclude certain keywords or users. Microsoft Purview Communication Compliance policies are configurable to reduce false positives. You can refine the policy by adding conditions to exclude specific keywords (e.g., 'joke' or 'just kidding') or specific users (e.g., known colleagues) from triggering alerts, without disabling the policy or relying on user behavior changes.

Answer

Train users not to joke about sensitive topics

Answer

Delete the alert and ignore future similar messages

Answer

Turn off the policy and use a different solution

Question 9

Your organization must ensure that financial reports are protected with encryption and cannot be forwarded. Which two Microsoft Purview features should you combine?

Accepted Answer

Sensitivity labels with encryption and Data Loss Prevention. Sensitivity labels with encryption allow you to apply persistent encryption to financial reports, ensuring they remain protected even when shared. Data Loss Prevention (DLP) policies can then block or warn users from forwarding these encrypted reports via email or other channels, providing a combined solution for encryption and forwarding prevention.

Answer

Data Lifecycle Management and Data Loss Prevention

Answer

Retention policies and Records Management

Answer

Information Barriers and Communication Compliance

Answer

eDiscovery (Premium) and Audit (Standard)

Question 10

Your organization uses Microsoft 365 and needs to identify internal users who are sending confidential data to external domains repeatedly. Which Microsoft Purview solution should you use?

Accepted Answer

Insider Risk Management. Insider Risk Management (IRM) is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that violate organizational policies, such as repeatedly sending confidential data to external domains. IRM uses predefined or custom policies to correlate signals from Microsoft 365 logs (e.g., email, SharePoint, Teams) and user behavior analytics to identify patterns of data exfiltration by internal users. Unlike other solutions, IRM focuses on user-centric risk scenarios and can trigger automated responses like escalation or case creation.

Answer

Data Loss Prevention

Answer

Audit (Premium)

Answer

Communication Compliance

Question 11

Your organization uses Microsoft Purview to manage data governance. You need to ensure that sensitive financial data containing credit card numbers is automatically detected and labeled when stored in SharePoint Online. Which compliance solution should you configure?

Accepted Answer

Information Protection auto-labeling. Microsoft Purview Information Protection auto-labeling is the correct solution because it can automatically detect sensitive data types, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply sensitivity labels to documents in SharePoint Online. This ensures that financial data is classified and protected at rest without manual intervention, aligning with the requirement for automatic detection and labeling.

Answer

eDiscovery (Premium)

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Question 12

A company is implementing Microsoft Purview Communication Compliance to detect inappropriate messages. They need to monitor Microsoft Teams channel messages and chat messages for potential policy violations. Which configuration is required?

Accepted Answer

Configure a Communication Compliance policy that includes Teams messages as the supervised communication channel.. Communication Compliance in Microsoft Purview is configured by creating a policy that specifies the supervised communication channels, and Microsoft Teams chats and channel messages are selectable channels within that policy. Enabling Teams as a supervised channel is the required configuration to detect inappropriate messages in Teams. DLP, retention, and third-party archiving address different compliance goals.

Answer

Enable Microsoft Purview Data Loss Prevention (DLP) policies for Teams.

Answer

Set up an Exchange Online retention policy to retain Teams messages.

Answer

Deploy a third-party archiving solution for Teams messages.

Question 13

Refer to the exhibit. The JSON snippet shows a sensitivity label configuration. What is the purpose of the 'SensitiveInfoTypes' property in this label?

Accepted Answer

It specifies the sensitive information types that trigger automatic labeling.. The 'SensitiveInfoTypes' property in a sensitivity label configuration specifies which built-in or custom sensitive information types (e.g., credit card numbers, passport numbers) should be detected in content. When these types are matched, the label can be applied automatically through auto-labeling policies, ensuring consistent protection without requiring manual user action.

Answer

It sets the retention period for content with this label.

Answer

It defines the user groups that can apply this label manually.

Answer

It configures the encryption settings for the label.

Question 14

Your organization uses Microsoft Purview Records Management to manage high-value contracts. You need to ensure that once a contract is declared as a record, it cannot be modified or deleted by any user, including administrators. Which type of record should you use?

Accepted Answer

Regulatory record. Regulatory records provide the highest level of protection and cannot be modified or deleted by any user, including administrators. Option A is wrong because disposition review is a process for reviewing content before deletion, not a record type that locks content. Option B is wrong because event-based retention policies apply retention based on a trigger event, but they do not prevent modification or deletion once declared a record. Option C is wrong because a retention label with default settings does not lock the record; it only applies retention settings without regulatory protections.

Answer

Disposition review

Answer

Event-based retention policy

Answer

Retention label with default settings

Question 15

A multinational corporation must comply with the EU General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) by searching for personal data across Exchange Online, SharePoint Online, and OneDrive for Business. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) provides the Content Search, case management, custodian, and review-set capabilities needed to locate and export personal data across Exchange Online, SharePoint Online, OneDrive for Business, and Teams for a DSAR response. It is the only Purview workload designed specifically for identifying and collecting responsive content across Microsoft 365 workloads at scale.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Data Loss Prevention (DLP)