SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 22 — 15 Questions

Question 1

A compliance administrator creates a retention policy as shown in the exhibit. What is the overall effect of this policy on content in SharePoint Online?

Accepted Answer

Content is retained for 7 years and then automatically deleted.. The retention policy in the exhibit is configured to retain content for 7 years and then delete it. This means content in SharePoint Online will be kept for the specified duration and automatically purged at the end of the retention period, which matches option D.

Answer

Content is deleted immediately after 7 years from creation.

Answer

Content is automatically labeled after 7 years.

Answer

Content is retained indefinitely after 7 years.

Question 2

A company wants to automatically classify sensitive documents in Microsoft 365 based on credit card numbers and retain them for 7 years. Which two Microsoft Purview solutions should they use together?

Accepted Answer

Sensitivity labels and retention policies. Sensitivity labels classify and protect content, and retention policies ensure data is kept for the required period. Data Loss Prevention (DLP) prevents sharing but does not retain; eDiscovery is for search and export; insider risk management detects risky activities. Therefore, sensitivity labels and retention policies are the correct combination.

Answer

Microsoft Purview compliance portal and Microsoft 365 Defender

Answer

Insider risk management and communication compliance

Answer

Data Loss Prevention (DLP) and eDiscovery

Question 3

Refer to the exhibit. A sensitivity label is configured as shown. A user applies the parent label to a document containing credit card numbers. What is the expected behavior?

Accepted Answer

The document gets the parent label's encryption (ViewOnly) and header, but no watermark. When a user manually applies a parent sensitivity label that has sublabels, only the parent label's settings (encryption and header) are applied. The sublabel's watermark is not applied because sublabels are separate entities that must be explicitly selected; they are not automatically inherited or triggered by applying the parent label. The encryption (ViewOnly) and header come from the parent label's configuration, while the watermark belongs to the sublabel and is not applied.

Answer

The document gets the parent label's header and the sublabel's encryption and watermark

Answer

The document gets no protection because credit card numbers are only detected by auto-labeling

Answer

The document gets the parent label's encryption and header, and auto-labeling applies the sublabel

Question 4

Which TWO Microsoft Purview solutions can be used to identify and protect sensitive data in Microsoft 365?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is correct because it uses content analysis (e.g., keyword matching, regex patterns, and machine learning classifiers) to detect and automatically protect sensitive data like credit card numbers or PII across Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are correct because they classify and protect data at rest and in transit by applying encryption, visual markings, and access restrictions based on label policies, enabling persistent protection even when data leaves Microsoft 365.

Answer

Communication compliance

Answer

Insider risk management

Answer

eDiscovery

Question 5

A compliance officer needs to create a policy that prevents users from sharing files containing medical record numbers (MRN) via email. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as medical record numbers (MRN), via email. DLP policies can inspect email content and attachments for patterns (e.g., regex for MRNs) and automatically enforce actions like blocking the message or notifying the user, preventing data exfiltration.

Answer

Sensitivity labels

Answer

eDiscovery

Answer

Insider risk management

Question 6

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. An HR manager wants to ensure that employee records are kept for at least 1 year after last modification. The policy is applied to Exchange, SharePoint, and OneDrive. What is the outcome?

Accepted Answer

The policy will not retain content; it will delete matching content after 365 days, which may not be intended. The policy is configured as 'Delete only' with a retention period of 365 days. This means that after 365 days from the last modification, the content will be permanently deleted. It does not retain content for any minimum period; it simply deletes it after the specified duration. The HR manager wants to keep records for at least 1 year, but this policy will delete them exactly at the 1-year mark, which may not be intended if the manager expects retention beyond that point or if the policy should also preserve content until deletion.

Answer

Employee records in Exchange are retained for 365 days after last modification, then deleted

Answer

Employee records in SharePoint are deleted after 365 days from last modification if they have Department=HR

Answer

The policy retains content for 365 days and then automatically moves to archive

Question 7

An organization needs to automatically apply a 'Confidential' label to documents that contain EU personal data, and also encrypt those documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies can be configured to automatically apply sensitivity labels based on sensitive info types like EU personal data. Sensitivity labels support encryption. Data classification is a prerequisite, but auto-labeling is the feature that applies the label automatically.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention label policy

Answer

Data classification service

Question 8

A company wants to monitor employee communications for potential harassment or policy violations. Which Microsoft Purview solution should they use?

Accepted Answer

Communication compliance. Communication compliance is the correct solution because it is specifically designed to detect and remediate inappropriate communications, such as harassment, threats, or policy violations, by analyzing email, Microsoft Teams, and third-party messages. It uses customizable policies to scan for sensitive content, keywords, or patterns, and provides alerts for review by designated investigators.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Answer

Insider risk management

Question 9

You are the compliance administrator for a healthcare organization that must comply with HIPAA. You need to automatically detect and prevent patients' protected health information (PHI) from being shared via email. Additionally, you need to retain all emails containing PHI for 6 years. You also need to allow users to manually classify documents as 'Medical Record' with encryption that expires after 30 days. Which combination of Microsoft Purview solutions should you implement?

Accepted Answer

Data Loss Prevention (DLP) policy to block PHI; retention policy for 6 years on emails containing PHI; sensitivity label with encryption and expiration. DLP policies detect and prevent sharing of PHI via email; a retention policy retains emails containing PHI for 6 years; a sensitivity label allows users to manually apply encryption with expiration. Option B is incorrect because eDiscovery is for search and export, not for retention; retention is handled by a retention policy, not eDiscovery. Option C is incorrect because communication compliance monitors for policy violations but does not prevent sharing; additionally, a retention label alone does not enforce retention (a retention policy or auto-apply label policy would be needed). Option D is incorrect because it lacks a manual label with encryption and expiration; auto-labeling can apply retention but not encryption with expiration.

Answer

Data Loss Prevention (DLP) policy to block PHI; eDiscovery to retain emails; sensitivity label with encryption

Answer

Retention label for 6 years; sensitivity label with encryption; communication compliance to monitor sharing

Answer

Data Loss Prevention (DLP) policy to block PHI; auto-labeling policy to apply retention label; no manual label needed

Question 10

Your organization uses Microsoft Purview to manage compliance. You need to ensure that financial documents are automatically labeled as 'Financial' and retained for 7 years. Additionally, if a user tries to share a financial document externally, they must see a policy tip warning them and be blocked if they proceed. You also need to audit all access to financial documents. Which configuration should you implement?

Accepted Answer

Create an auto-labeling policy to apply a sensitivity label 'Financial' with encryption; create a retention policy to retain all labeled content for 7 years; create a DLP policy to block external sharing of 'Financial' labeled content with a policy tip; enable audit logging. It combines auto-labeling to automatically apply the 'Financial' sensitivity label with encryption, a retention policy to retain labeled content for 7 years, a DLP policy to block external sharing with a policy tip, and audit logging (enabled by default) to track access. Option A lacks labeling and retention. Option B uses manual labeling, which is not automatic, and the DLP only warns, not blocks. Option C uses a retention label instead of a sensitivity label, so it does not provide encryption or protection, and the DLP policy does not include a policy tip.

Answer

Create a DLP policy to detect financial data and block external sharing; use default audit logging

Answer

Create a manual labeling policy for users to apply 'Financial' label; create a retention label for 7 years; create a DLP policy to warn on external sharing

Answer

Create a retention label 'Financial' with auto-apply based on sensitive info type; create a DLP policy to block external sharing

Question 11

Tailspin Toys is a toy manufacturer with headquarters in the US and subsidiaries in Europe and Asia. You are the compliance administrator. The company must comply with the EU General Data Protection Regulation (GDPR). Requirements: 1) Personal data of EU residents must be retained only for as long as necessary (max 5 years after last interaction). 2) If a user tries to share personal data outside the EU, the action must be blocked. 3) Users must be able to manually mark documents as 'GDPR High Risk' which will encrypt them and add a watermark 'GDPR PROTECTED'. 4) All access to personal data must be audited. You have Microsoft Purview with E5 compliance licenses. What is the most efficient solution?

Accepted Answer

Create an auto-labeling policy to apply a 'Personal Data' sensitivity label; create a retention label 'GDPR Retention' to auto-apply to personal data and retain for 5 years; create a DLP policy to block sharing of labeled personal data outside EU; create a separate sensitivity label 'GDPR High Risk' for manual application with encryption and watermark; enable audit logging. The most efficient because it uses a retention label 'GDPR Retention' with auto-labeling to automatically retain personal data for 5 years, precisely meeting requirement 1. It creates a DLP policy to block sharing of labeled personal data outside the EU, satisfying requirement 2. It provides a separate sensitivity label 'GDPR High Risk' for manual application with encryption and watermark, meeting requirement 3. Audit logging is enabled for requirement 4. Option A uses a retention policy on all content, which is too broad and not specific to personal data. Option C lacks a manual sensitivity label for high-risk documents. Option D attempts to use a single sensitivity label for both automatic and manual scenarios, which is less flexible and may not apply encryption/watermark correctly for manual labeling.

Answer

Use a retention policy to delete all content after 5 years; create a DLP policy to block sharing of personal data outside EU; create a sensitivity label for manual application with encryption and watermark; enable audit logging

Answer

Use a retention policy to delete personal data after 5 years; create a DLP policy to block cross-border sharing; use a sensitivity label with auto-labeling for personal data; enable audit logging

Answer

Create a DLP policy to block sharing of personal data outside EU; use a retention label for 5 years; use a single sensitivity label for both automatic and manual scenarios; enable audit logging

Question 12

Which TWO Microsoft Purview solutions can be used to manage data retention and deletion?

Accepted Answer

Retention policies. Retention policies (A) are used to assign retention and deletion settings at the container level (e.g., entire SharePoint site, Exchange mailbox, or OneDrive account), automatically applying to all content within that scope. Retention labels (D) are used to assign retention and deletion settings at the item level (e.g., a specific document or email), allowing granular control and manual or auto-classification. Both are core Microsoft Purview solutions for managing data lifecycle, including retention and deletion.

Answer

eDiscovery

Answer

Sensitivity labels

Answer

Data Loss Prevention (DLP)

Question 13

An organization wants to allow users to classify documents as 'Public', 'Internal', 'Confidential', or 'Highly Confidential' with different levels of protection. Which Microsoft Purview solution should they use?

Accepted Answer

Sensitivity labels. Sensitivity labels in Microsoft Purview Information Protection allow organizations to classify and protect documents and emails by applying labels such as 'Public', 'Internal', 'Confidential', or 'Highly Confidential'. These labels can enforce encryption, visual markings (headers/footers/watermarks), and access restrictions based on the classification level, directly meeting the requirement for different levels of protection.

Answer

Data Loss Prevention (DLP)

Answer

Communication compliance

Answer

Retention policies

Question 14

A healthcare organization is implementing Microsoft Purview Data Lifecycle Management to retain medical records for 7 years. Which THREE components must be configured to achieve this retention requirement?

Accepted Answer

Create a retention label policy to publish the label.. A retention label policy is required to publish the retention label so that it can be automatically or manually applied to the medical records. Without publishing the label via a policy, the label itself cannot be assigned to content, and the retention period will not take effect.

Answer

Apply a sensitivity label to classify the records.

Answer

Implement Data Loss Prevention (DLP) policies to prevent data exfiltration.

Question 15

Contoso Pharmaceuticals is implementing Microsoft Purview to meet regulatory compliance (HIPAA and GDPR). They need to: (1) automatically classify and protect patient health information (PHI) and personally identifiable information (PII) in Exchange Online, SharePoint Online, and OneDrive for Business; (2) detect and prevent unauthorized sharing of sensitive data; (3) retain audit logs for 7 years; and (4) allow users to manually apply classification labels to documents. The company has 5,000 users and uses Microsoft 365 E5 licenses. The security team wants to minimize manual effort and ensure consistent protection. What should the compliance administrator configure first?

Accepted Answer

Create sensitivity labels with auto-labeling policies configured to detect PHI and PII, and publish them via label policies.. Sensitivity labels with auto-labeling policies can automatically classify and protect PHI and PII across Exchange Online, SharePoint Online, and OneDrive for Business, meeting the requirement for automated classification and consistent protection. Option A is wrong because DLP policies detect and prevent unauthorized sharing but do not classify or label data. Option C is wrong because retention policies only manage data retention, not classification or protection. Option D is wrong because auditing logs activities but does not classify or protect content.

Answer

Configure Data Loss Prevention (DLP) policies to block sharing of content containing PHI and PII.

Answer

Set up retention policies for Exchange, SharePoint, and OneDrive to retain data for 7 years.

Answer

Enable auditing for all workloads and configure alert policies for unauthorized access.