SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 22 — 15 Questions

Question 1

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. An HR manager wants to ensure that employee records are kept for at least 1 year after last modification. The policy is applied to Exchange, SharePoint, and OneDrive. What is the outcome?

Accepted Answer

The policy will not retain content; it will delete matching content after 365 days, which may not be intended. The policy deletes content 365 days after last modification, but the content query filters only items where Department equals 'HR'. However, SharePoint items do not have a Department property by default; the query may not match any items, so the policy may have no effect. Also, the policy deletes rather than retains; a retention policy should use 'Keep' or 'KeepAndDelete'. The design is flawed.

Answer

Employee records in Exchange are retained for 365 days after last modification, then deleted

Answer

Employee records in SharePoint are deleted after 365 days from last modification if they have Department=HR

Answer

The policy retains content for 365 days and then automatically moves to archive

Question 2

An organization needs to automatically apply a 'Confidential' label to documents that contain EU personal data, and also encrypt those documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies can be configured to automatically apply sensitivity labels based on sensitive info types like EU personal data. Sensitivity labels support encryption. Data classification is a prerequisite, but auto-labeling is the feature that applies the label automatically.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention label policy

Answer

Data classification service

Question 3

Which THREE actions can be performed using Microsoft Purview compliance portal?

Accepted Answer

Conduct eDiscovery searches. The compliance portal allows managing sensitivity labels, creating retention policies, and conducting eDiscovery searches. Managing user licenses is done in Microsoft 365 admin center; setting up conditional access is in Microsoft Entra ID.

Answer

Manage user licenses

Answer

Configure conditional access policies

Question 4

A company wants to monitor employee communications for potential harassment or policy violations. Which Microsoft Purview solution should they use?

Accepted Answer

Communication compliance. Communication compliance monitors communications for inappropriate content. Insider risk management focuses on data theft and risky activities. DLP prevents data loss. eDiscovery is for legal discovery.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Answer

Insider risk management

Question 5

Your organization, Contoso Ltd., is a multinational company with offices in the US, EU, and Asia. You are the compliance administrator. The legal team requires that all documents containing personally identifiable information (PII) of EU citizens be retained for 10 years after the last modification. Additionally, any document classified as 'Highly Confidential' must be encrypted and have a custom header 'CONFIDENTIAL - DO NOT FORWARD' when shared externally. You also need to ensure that only users in the EU region can access documents containing EU PII. You have Microsoft Purview with the necessary licenses. You need to design a compliance solution that meets these requirements with minimal administrative overhead. What should you do?

Accepted Answer

Create a retention label for 10-year retention based on PII content; create a sensitivity label 'Highly Confidential' with encryption and header; configure a conditional access policy in Microsoft Entra ID to restrict access to EU users for documents labeled 'Highly Confidential'. Option A combines a retention label for 10-year retention, a sensitivity label with encryption and header, and a conditional access policy to restrict access based on region. This meets all requirements. Option B uses DLP, which does not enforce access control per region. Option C uses a single label, but retention and sensitivity are separate; also conditional access is needed. Option D lacks encryption and header for external sharing.

Answer

Create a Data Loss Prevention (DLP) policy to block external sharing of PII; create a retention policy for 10 years on all content; use sensitivity labels for encryption

Answer

Use a single unified label that combines retention and sensitivity settings; then configure an auto-labeling policy to apply it; use a device compliance policy to restrict access

Answer

Create a retention policy for 10 years on all content; use sensitivity labels with encryption; then configure a DLP policy to add the header when shared externally

Question 6

You are the compliance administrator for a healthcare organization that must comply with HIPAA. You need to automatically detect and prevent patients' protected health information (PHI) from being shared via email. Additionally, you need to retain all emails containing PHI for 6 years. You also need to allow users to manually classify documents as 'Medical Record' with encryption that expires after 30 days. Which combination of Microsoft Purview solutions should you implement?

Accepted Answer

Data Loss Prevention (DLP) policy to block PHI; retention policy for 6 years on emails containing PHI; sensitivity label with encryption and expiration. DLP detects and prevents sharing of PHI via email. A retention policy retains emails containing PHI for 6 years. A sensitivity label allows users to manually apply encryption with expiration. Option B: DLP handles prevention, retention policy handles retention, sensitivity label handles manual classification. Option A: eDiscovery does not prevent sharing. Option C: only uses DLP, no retention or manual label. Option D: retention label cannot expire encryption.

Answer

Data Loss Prevention (DLP) policy to block PHI; eDiscovery to retain emails; sensitivity label with encryption

Answer

Retention label for 6 years; sensitivity label with encryption; communication compliance to monitor sharing

Answer

Data Loss Prevention (DLP) policy to block PHI; auto-labeling policy to apply retention label; no manual label needed

Question 7

Your organization uses Microsoft Purview to manage compliance. You need to ensure that financial documents are automatically labeled as 'Financial' and retained for 7 years. Additionally, if a user tries to share a financial document externally, they must see a policy tip warning them and be blocked if they proceed. You also need to audit all access to financial documents. Which configuration should you implement?

Accepted Answer

Create an auto-labeling policy to apply a sensitivity label 'Financial' with encryption; create a retention policy to retain all labeled content for 7 years; create a DLP policy to block external sharing of 'Financial' labeled content with a policy tip; enable audit logging. Option A: Auto-labeling applies the sensitivity label; a retention policy retains for 7 years; DLP blocks external sharing with policy tip; audit logging is enabled by default. Option B: manual labeling is not automatic; Option C: retention label is not sensitivity; Option D: DLP alone does not automate labeling or retention.

Answer

Create a DLP policy to detect financial data and block external sharing; use default audit logging

Answer

Create a manual labeling policy for users to apply 'Financial' label; create a retention label for 7 years; create a DLP policy to warn on external sharing

Answer

Create a retention label 'Financial' with auto-apply based on sensitive info type; create a DLP policy to block external sharing

Question 8

Tailspin Toys is a toy manufacturer with headquarters in the US and subsidiaries in Europe and Asia. You are the compliance administrator. The company must comply with the EU General Data Protection Regulation (GDPR). Requirements: 1) Personal data of EU residents must be retained only for as long as necessary (max 5 years after last interaction). 2) If a user tries to share personal data outside the EU, the action must be blocked. 3) Users must be able to manually mark documents as 'GDPR High Risk' which will encrypt them and add a watermark 'GDPR PROTECTED'. 4) All access to personal data must be audited. You have Microsoft Purview with E5 compliance licenses. What is the most efficient solution?

Accepted Answer

Create an auto-labeling policy to apply a 'Personal Data' sensitivity label; create a retention label 'GDPR Retention' to auto-apply to personal data and retain for 5 years; create a DLP policy to block sharing of labeled personal data outside EU; create a separate sensitivity label 'GDPR High Risk' for manual application with encryption and watermark; enable audit logging. Option A: retention policy for 5 years on all content (not specific to personal data), but the requirement is to retain personal data only as long as necessary; a retention label with auto-apply is more precise. DLP can block cross-border sharing. Sensitivity label for manual marking with encryption and watermark. Audit logging is enabled by default. Option B: auto-labeling for sensitivity is good, but retention label for personal data is needed; also DLP is required. Option C: DLP cannot enforce retention. Option D: auto-labeling for retention label is good, but sensitivity label is needed for manual marking; also DLP is required.

Answer

Use a retention policy to delete all content after 5 years; create a DLP policy to block sharing of personal data outside EU; create a sensitivity label for manual application with encryption and watermark; enable audit logging

Answer

Use a retention policy to delete personal data after 5 years; create a DLP policy to block cross-border sharing; use a sensitivity label with auto-labeling for personal data; enable audit logging

Answer

Create a DLP policy to block sharing of personal data outside EU; use a retention label for 5 years; use a single sensitivity label for both automatic and manual scenarios; enable audit logging

Question 9

Which TWO Microsoft Purview solutions can be used to manage data retention and deletion?

Accepted Answer

Retention policies. Retention policies and retention labels are used to manage data retention and deletion. Sensitivity labels classify and protect; DLP prevents data loss; eDiscovery searches content.

Answer

eDiscovery

Answer

Sensitivity labels

Answer

Data Loss Prevention (DLP)

Question 10

An organization wants to allow users to classify documents as 'Public', 'Internal', 'Confidential', or 'Highly Confidential' with different levels of protection. Which Microsoft Purview solution should they use?

Accepted Answer

Sensitivity labels. Sensitivity labels allow users to manually classify documents with different levels of protection (e.g., encryption, markings). Retention policies manage retention, not classification. DLP prevents data loss. Communication compliance monitors communications.

Answer

Data Loss Prevention (DLP)

Answer

Communication compliance

Answer

Retention policies

Question 11

A company must implement data classification labels in Microsoft Purview to protect sensitive information. Which TWO actions are required to create and publish a sensitivity label?

Accepted Answer

Create the label in the Microsoft Purview compliance portal.. Option A is correct because labels are created in the Microsoft Purview compliance portal. Option D is correct because labels must be published via a label policy. Option B is wrong because auto-labeling is a separate feature, not a requirement for creating a label. Option C is wrong because label creation doesn't require scoping. Option E is wrong because labels are not published via Microsoft Intune.

Answer

Deploy the label using Microsoft Intune configuration profiles.

Answer

Define the label scope to include SharePoint and OneDrive.

Answer

Configure auto-labeling rules in Microsoft 365 Defender.

Question 12

A healthcare organization is implementing Microsoft Purview Data Lifecycle Management to retain medical records for 7 years. Which THREE components must be configured to achieve this retention requirement?

Accepted Answer

Create a retention label policy to publish the label.. Option A is correct because a retention label with the appropriate duration is needed. Option B is correct because a retention label policy publishes the label. Option C is correct because adaptive scopes allow targeting specific users or content. Option D is wrong because Data Loss Prevention policies are for preventing data leaks, not retention. Option E is wrong because sensitivity labels are for classification, not retention.

Answer

Apply a sensitivity label to classify the records.

Answer

Implement Data Loss Prevention (DLP) policies to prevent data exfiltration.

Question 13

Refer to the exhibit. The JSON shows a Microsoft Purview retention policy configuration. After applying this policy, an administrator notices that emails in user mailboxes older than one year are being permanently deleted instead of being retained. Which setting should the administrator check first to resolve this issue?

Accepted Answer

The 'RetentionType' is set to 'KeepAndDelete', which deletes after retention period.. Option C is correct because the 'RetentionType' set to 'KeepAndDelete' means items are retained for the duration and then permanently deleted. Option A is wrong because the location list is correct. Option B is wrong because the trigger is valid. Option D is wrong because the duration is correctly set to 365 days.

Answer

The 'Locations' array does not include all necessary workloads.

Answer

The 'RetentionDuration' is too short for email retention.

Answer

The 'RetentionTrigger' should be 'When items were last modified' instead of 'created'.

Question 14

Contoso Pharmaceuticals is implementing Microsoft Purview to meet regulatory compliance (HIPAA and GDPR). They need to: (1) automatically classify and protect patient health information (PHI) and personally identifiable information (PII) in Exchange Online, SharePoint Online, and OneDrive for Business; (2) detect and prevent unauthorized sharing of sensitive data; (3) retain audit logs for 7 years; and (4) allow users to manually apply classification labels to documents. The company has 5,000 users and uses Microsoft 365 E5 licenses. The security team wants to minimize manual effort and ensure consistent protection. What should the compliance administrator configure first?

Accepted Answer

Create sensitivity labels with auto-labeling policies configured to detect PHI and PII, and publish them via label policies.. Option A is correct because sensitivity labels with auto-labeling for file types containing PHI/PII provide consistent automated classification and protection across the specified workloads. Option B is wrong because DLP policies can block sharing but do not classify or protect data inherently. Option C is wrong because retention policies handle retention, not classification or protection. Option D is wrong because auditing is for logging, not classification.

Answer

Configure Data Loss Prevention (DLP) policies to block sharing of content containing PHI and PII.

Answer

Set up retention policies for Exchange, SharePoint, and OneDrive to retain data for 7 years.

Answer

Enable auditing for all workloads and configure alert policies for unauthorized access.

Question 15

Fabrikam Inc., a global financial services company, uses Microsoft Purview to manage compliance. They have the following requirements: (1) Prevent users from sending emails containing credit card numbers (CCN) to external recipients; (2) automatically encrypt emails containing CCN; (3) notify users when an email is blocked; (4) allow users to override the block for business justifications; (5) generate incident reports for compliance teams. The company uses Microsoft 365 E5 licenses and has Exchange Online configured. The compliance team wants to implement a solution with minimal administrative overhead. What should the administrator configure?

Accepted Answer

Create a Data Loss Prevention (DLP) policy in the Microsoft Purview compliance portal with conditions for CCN, and configure actions to block, encrypt, notify, and allow override.. Option B is correct because a DLP policy can block, encrypt, notify, and allow override, with incident reports. Option A is wrong because sensitivity labels with auto-labeling classify but do not prevent sending. Option C is wrong because information barriers prevent communication between groups, not data exfiltration. Option D is wrong because message encryption without DLP does not block or provide override.

Answer

Configure information barriers between the finance department and external recipients.

Answer

Create a sensitivity label that automatically classifies emails with CCN and configure a label policy to encrypt them.

Answer

Enable Microsoft Purview Message Encryption and create a mail flow rule in Exchange to encrypt emails with CCN.

SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 22 — 15 Questions

Exhibit

SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 22 — 15 Questions

Exhibit