SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 2 — 15 Questions

Question 1

A financial services company must comply with a regulation that requires all audit-related documents to be retained for 7 years and then permanently deleted. The compliance officer wants to ensure that even if a user modifies or deletes a file, the original content is preserved for the full 7 years, and at the end of the period the files are automatically destroyed without any manual approval. The company uses Microsoft 365 and stores these documents in SharePoint Online and Microsoft Teams. Which Microsoft Purview solution should the compliance officer configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management using a retention policy configured to retain items for 7 years and then delete them automatically. Option C is correct because Microsoft Purview Data Lifecycle Management allows you to create a retention policy that retains items for a fixed period (7 years) and then automatically deletes them without any manual intervention. This meets the regulatory requirement for automatic destruction at the end of the retention period, and the policy applies to both SharePoint Online and Microsoft Teams, preserving the original content even if a user modifies or deletes the file.

Answer

Microsoft Purview Retention Labels with a disposition review that requires manual approval at the end of the retention period

Answer

Microsoft Purview Retention Policy with a record label to mark items as regulatory records

Answer

Microsoft Purview eDiscovery with a hold policy to preserve the documents indefinitely

Question 2

A company receives a subject rights request (SRR) from a customer under GDPR, asking for the deletion of all personal data held about them. The compliance team needs a tool to orchestrate the discovery of this data across Microsoft 365 and other systems, and to track the response and fulfillment of the request. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Priva (Privacy Management). Microsoft Priva (Privacy Management) is the correct solution because it is specifically designed to help organizations manage subject rights requests (SRRs) under regulations like GDPR. It automates the discovery of personal data across Microsoft 365 and connected systems, provides a workflow to track the request lifecycle, and facilitates the fulfillment of actions such as deletion. This directly addresses the compliance team's need to orchestrate discovery and track response for an SRR.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management (retention labels)

Question 3

A law firm uses Microsoft 365 and has two legal teams working on opposing sides of the same lawsuit. The compliance officer needs to prevent any communication (email, Teams chat, file sharing) between the two teams. Additionally, the firm must block emails containing the case name from being sent outside the organization. Which two Microsoft Purview solutions should be configured to meet these requirements? (Choose two.)

Accepted Answer

Microsoft Purview Information Barriers. Microsoft Purview Information Barriers (A) is correct because it is specifically designed to prevent communication and collaboration between two groups within an organization, such as legal teams on opposing sides of a lawsuit. It enforces policies that block email, Teams chat, and file sharing between the defined segments, directly meeting the first requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit (Standard)

Question 4

A legal team is involved in a lawsuit and needs to ensure that all emails and documents related to the case are preserved in their original state, even if users edit or delete them. They also need the ability to search for these items and export them for legal review. Which Microsoft Purview solution should the compliance team configure to meet these requirements?

Accepted Answer

Microsoft Purview eDiscovery (Standard). Microsoft Purview eDiscovery (Standard) is the correct solution because it provides the ability to place a legal hold on content (preserving emails and documents in their original state even if users edit or delete them), perform searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams, and export the results for legal review. This directly meets the requirements of preservation, search, and export for litigation.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Standard)

Question 5

A multinational organization uses Microsoft 365 and must demonstrate compliance with both GDPR and ISO 27001. The compliance team needs a centralized tool to assess their current compliance posture against these frameworks, receive prioritized improvement actions, and track the implementation of those actions over time. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Compliance Manager is the correct solution because it provides a centralized dashboard that assesses an organization's compliance posture against frameworks like GDPR and ISO 27001. It offers prioritized improvement actions based on built-in assessments and tracks the implementation of those actions over time, directly meeting the requirements for a unified compliance management tool.

Answer

Data Lifecycle Management

Answer

Audit

Answer

eDiscovery

Question 6

A company has a policy that prohibits employees from sharing confidential customer data with unauthorized parties. The compliance team needs to detect patterns of unusual user activity that may indicate insider data theft, such as downloading large volumes of data to a personal device or emailing sensitive files to external recipients. They also want to investigate the activity and take remediation actions like generating a case for litigation or notifying the user's manager. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is designed specifically to detect, investigate, and remediate insider data theft scenarios. It uses predefined and customizable policies to identify patterns like large-volume downloads to personal devices or emailing sensitive files externally, and provides built-in remediation actions such as generating a case for litigation or notifying a user's manager.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Question 7

A financial services firm is required by regulatory bodies to monitor employee communications (email, Teams chats) for potential insider trading or market manipulation. They need a solution that allows them to define policies to detect messages containing specific keywords or phrases (e.g., 'confidential', 'insider info'), and then assign flagged messages to designated reviewers for investigation. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in employee communications, such as email and Teams chats, by scanning for sensitive keywords or phrases like 'confidential' or 'insider info'. It then automatically flags and routes these messages to designated reviewers for investigation, directly meeting the regulatory requirement for monitoring potential insider trading or market manipulation.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview eDiscovery (Standard or Premium)

Answer

Microsoft Purview Audit (Standard or Premium)

Question 8

A company stores financial reports in SharePoint Online that contain credit card numbers. The compliance team needs to automatically apply a sensitivity label that encrypts the documents when they detect credit card data. Which Microsoft Purview solution should they configure?

Accepted Answer

Information Protection. Microsoft Purview Information Protection (A) is the correct solution because it enables the creation of auto-labeling policies that can automatically apply a sensitivity label with encryption when credit card numbers are detected in SharePoint Online documents. This directly addresses the requirement to classify and protect sensitive data at rest based on content inspection.

Answer

Data Loss Prevention

Answer

Data Lifecycle Management

Answer

Records Management

Question 9

A financial services company uses Microsoft 365 and must prevent employees from emailing credit card numbers in plain text. The compliance team wants to automatically detect credit card numbers in outgoing emails and block them before delivery. They also want to allow users to override the block with a business justification. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data, such as credit card numbers, in transit (e.g., email) and enforce actions like blocking the message. DLP policies can be configured with user override options that require a business justification, meeting the compliance team's requirement for automatic detection and conditional blocking.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Insider Risk Management

Question 10

A legal team is preparing for a lawsuit and needs to perform a detailed investigation of user activities across Microsoft 365 services. They need to view the 'before' and 'after' values whenever a critical item in SharePoint or Exchange is updated or deleted. The investigation requires high-volume export performance and the ability to search by specific activities like 'MailboxFolderAccess' and 'Send'. Which Microsoft Purview solution should be enabled and configured to meet these advanced auditing requirements?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is required because it captures detailed 'before' and 'after' values for critical updates and deletions in SharePoint and Exchange, supports high-volume export performance, and allows searching for specific activities like 'MailboxFolderAccess' and 'Send'. These capabilities go beyond the Standard audit log, which only records basic event metadata without the old/new values and lacks the advanced search and export throughput needed for litigation.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Data Lifecycle Management

Question 11

A company stores HR documents in SharePoint Online. The compliance team wants to automatically apply a sensitivity label that encrypts the document whenever it contains a passport number. They do not want users to be able to override this classification. Which Microsoft Purview solution should they configure?

Accepted Answer

Auto-labeling policy for sensitivity labels. An auto-labeling policy for sensitivity labels can automatically apply a sensitivity label (e.g., 'Highly Confidential') that encrypts documents when they contain sensitive data like passport numbers. This policy can be configured to enforce mandatory labeling without allowing user override, meeting the compliance team's requirement. In contrast, a DLP policy can detect and block sharing of sensitive data but does not apply encryption labels automatically.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention policy

Answer

Communication compliance policy

Question 12

A legal team is preparing for litigation and needs to collect relevant data from Microsoft Teams chats, email, and SharePoint documents. They need to place a hold on the data to prevent deletion, review it, and then use advanced analytics such as relevance ranking and email threading to reduce the review set. Which Microsoft Purview solution should they use to perform these tasks?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct solution because it provides the full lifecycle of legal hold, collection, review, and advanced analytics such as relevance ranking, email threading, and predictive coding. These capabilities are specifically designed for complex litigation scenarios, whereas the Standard edition lacks the advanced analytics features needed to reduce the review set.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Copilot

Answer

Microsoft Purview Compliance Manager

Question 13

A company stores sensitive financial data on on-premises Windows Server file shares. The compliance team needs to automatically discover files containing credit card numbers, classify them by applying a sensitivity label, and optionally enforce protection actions like encryption. They want this solution to run on the on-premises file servers without needing to manually scan. Which Microsoft Purview solution should the compliance team deploy?

Accepted Answer

Microsoft Purview Information Protection scanner. The Microsoft Purview Information Protection scanner is designed to run on on-premises Windows Server file shares to automatically discover, classify, and protect sensitive data. It uses content inspection to identify patterns like credit card numbers, applies sensitivity labels, and can enforce encryption without requiring manual scanning.

Answer

Microsoft Purview Data Loss Prevention (DLP) for on-premises

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Question 14

A financial services organization must comply with a regulation that requires all communications related to trades (including emails and Teams messages) to be retained for a period of 7 years. During retention, no user may edit or delete these records. After the 7 years, the records must be disposed of with an irreversible deletion that is verified by a compliance officer. Which Microsoft Purview solution should the organization use to enforce both retention and regulatory disposition?

Accepted Answer

Microsoft Purview Records Management (regulatory retention label). Microsoft Purview Records Management with a regulatory retention label is the correct solution because it enforces immutable retention (no user edits or deletions) and mandates a disposition review by a compliance officer before irreversible deletion. Regulatory labels lock the retention policy at the highest level, preventing any user or administrator from shortening the retention period or bypassing the disposition workflow, which aligns with the 7-year retention and verified disposal requirement.

Answer

Microsoft Purview Data Lifecycle Management (standard retention label)

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management

Question 15

A financial services company is subject to regulations that require monitoring of employee communications for potential market manipulation. The compliance team needs to create policies that automatically detect messages containing phrases like 'insider info' or 'confidential trade' in Microsoft Teams chats and Exchange Online emails. Detected messages should be routed to designated reviewers for investigation, and the company wants a built-in Microsoft Purview solution to handle this process. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect and investigate policy violations in organizational communications, such as Microsoft Teams chats and Exchange Online emails. It allows compliance teams to create custom policies that automatically scan for sensitive phrases like 'insider info' or 'confidential trade' and route flagged messages to designated reviewers for investigation, meeting the regulatory monitoring requirements.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management