SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 21 — 15 Questions

Question 1

An organization must prove to an auditor that only authorized users have accessed sensitive HR files over the past year. The compliance team needs to generate a report of all access events to these files. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) logs and allows searching for access events. It provides reports on user activity. Information Protection labels files but does not log access. Data Lifecycle Management handles retention. Compliance Manager assesses compliance but does not provide access logs.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Information Protection

Question 2

A company wants to prevent employees from accidentally sharing a document containing personally identifiable information (PII) with external users. The document is stored in OneDrive for Business. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive content and block sharing with external users. Information Protection labels can classify but rely on DLP to enforce restrictions. Communication Compliance monitors communications. Audit logs record sharing events but do not prevent them.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 3

A compliance officer needs to create a policy that automatically detects and blocks the sharing of credit card numbers in emails and Teams messages. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies in Microsoft Purview can be applied to emails and Teams messages to detect sensitive information like credit card numbers and block sharing. Communication Compliance monitors for policy violations but does not enforce blocking. Information Protection labels content. Audit logs activities.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Question 4

An organization needs to automatically apply a 'Highly Confidential' sensitivity label to all documents that contain a specific custom sensitive information type. The label should be applied when the document is created or modified. Which feature of Microsoft Purview Information Protection should be used?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview Information Protection can automatically apply sensitivity labels based on conditions, including custom sensitive information types, when documents are created or modified. Manual labeling requires user action. DLP blocks sharing but does not apply labels. Communication Compliance monitors communications.

Answer

Manual sensitivity labeling

Answer

Data Loss Prevention (DLP) policies

Answer

Communication Compliance policies

Question 5

Which TWO actions can be performed using Microsoft Purview Data Lifecycle Management?

Accepted Answer

Create a retention policy to keep financial records for 7 years. Data Lifecycle Management allows creating retention policies to keep content for a specified period and deletion policies to remove content after a period. It does not classify content (Information Protection) or monitor communications (Communication Compliance).

Answer

Monitor internal emails for policy violations

Answer

Block sharing of sensitive files with external users

Answer

Automatically classify documents containing PII

Question 6

Which THREE capabilities are provided by Microsoft Purview Compliance Manager?

Accepted Answer

Pre-built compliance assessments for regulations like GDPR. Compliance Manager provides assessments, actions, and score tracking. It does not discover data (Data Map) or log access (Audit).

Answer

Audit log search for user access events

Answer

Automated data discovery across cloud sources

Question 7

Which TWO features are part of Microsoft Purview Information Protection?

Accepted Answer

Automatic classification based on sensitive content. Information Protection includes sensitivity labels and automatic classification. Data Lifecycle Management is a separate solution. Communication Compliance is separate. Audit is separate.

Answer

Communication monitoring

Answer

Retention policies

Answer

Audit log investigation

Question 8

A compliance administrator creates the DLP policy shown in the exhibit. When a user shares a document containing a credit card number with an external partner, what is the expected outcome?

Accepted Answer

The document is blocked from being shared externally, and the user receives a notification.. The policy blocks access when sharing externally (BlockExternal) and notifies the user. Access is not blocked for internal sharing, and the document is not deleted or automatically labeled.

Answer

The document is automatically deleted.

Answer

A sensitivity label is automatically applied.

Answer

The document is blocked from being shared both internally and externally.

Question 9

A company deploys a sensitivity label as shown in the exhibit. The custom sensitive information type 'Custom_PII_Type' is configured to detect employee IDs. What happens when a user creates a new document in SharePoint Online that contains an employee ID?

Accepted Answer

The document is automatically labeled 'Highly Confidential' and encrypted.. The label has auto-labeling enabled, so it will automatically apply the label and encryption to the document when the condition is met. The user does not need to manually apply the label, and the document is not blocked or deleted.

Answer

The user is prompted to manually apply the label.

Answer

The document is blocked from being shared externally.

Answer

The document is deleted automatically.

Question 10

A compliance administrator creates a retention policy as shown in the exhibit. What is the overall effect of this policy on content in SharePoint Online?

Accepted Answer

Content is retained for 7 years and then automatically deleted.. The policy retains content for 7 years from creation and then deletes it. 'RetentionAction' is 'Retain' and 'EndAction' is 'Delete'. Content is not permanently retained forever, nor is it deleted immediately. The policy applies to all locations specified.

Answer

Content is deleted immediately after 7 years from creation.

Answer

Content is automatically labeled after 7 years.

Answer

Content is retained indefinitely after 7 years.

Question 11

A company wants to automatically classify sensitive documents in Microsoft 365 based on credit card numbers and retain them for 7 years. Which two Microsoft Purview solutions should they use together?

Accepted Answer

Sensitivity labels and retention policies. Sensitivity labels classify and protect content, and retention policies ensure data is kept for the required period. Data Loss Prevention (DLP) prevents sharing but does not retain; eDiscovery is for search and export; insider risk management detects risky activities. Therefore, sensitivity labels and retention policies are the correct combination.

Answer

Microsoft Purview compliance portal and Microsoft 365 Defender

Answer

Insider risk management and communication compliance

Answer

Data Loss Prevention (DLP) and eDiscovery

Question 12

Refer to the exhibit. A sensitivity label is configured as shown. A user applies the parent label to a document containing credit card numbers. What is the expected behavior?

Accepted Answer

The document gets the parent label's encryption (ViewOnly) and header, but no watermark. The parent label has auto-labeling rules that automatically apply the label when credit card numbers are detected. Since the user manually applied the parent label, auto-labeling is not triggered; the manual label applies. The sublabel is not automatically applied because auto-labeling is configured only on the parent. Therefore, the document gets the parent label's encryption (ViewOnly) and header, but no watermark.

Answer

The document gets the parent label's header and the sublabel's encryption and watermark

Answer

The document gets no protection because credit card numbers are only detected by auto-labeling

Answer

The document gets the parent label's encryption and header, and auto-labeling applies the sublabel

Question 13

Which TWO Microsoft Purview solutions can be used to identify and protect sensitive data in Microsoft 365?

Accepted Answer

Data Loss Prevention (DLP). Sensitivity labels classify and protect data. Data Loss Prevention (DLP) policies detect and prevent sharing of sensitive data. Insider risk management and eDiscovery are not primarily for data protection; communication compliance monitors communications.

Answer

Communication compliance

Answer

Insider risk management

Answer

eDiscovery

Question 14

Which THREE capabilities does Microsoft Purview provide to help meet regulatory compliance requirements?

Accepted Answer

Audit logging. Microsoft Purview offers audit logging, retention policies, and data classification. Communication compliance and insider risk management are related to compliance but are not core capabilities for meeting regulatory requirements like audit, retention, and classification.

Answer

Insider risk management

Answer

Communication compliance

Question 15

A compliance officer needs to create a policy that prevents users from sharing files containing medical record numbers (MRN) via email. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies are designed to detect and block sharing of sensitive information like MRNs via email. Sensitivity labels classify content but do not enforce sharing restrictions. Insider risk management and eDiscovery are not for blocking sharing.

Answer

Sensitivity labels

Answer

eDiscovery

Answer

Insider risk management