SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 3 — 15 Questions

Question 1

Your organization is subject to GDPR and must respond to data subject deletion requests within 30 days. You have identified all personal data in Microsoft 365. Which Microsoft Purview solution should you use to permanently delete the data?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Lifecycle Management (disposition review). Data Lifecycle Management (disposition review) is the correct solution because it allows you to permanently delete personal data after a specified retention period. In this scenario, you have already identified the personal data and need to respond to a deletion request within 30 days. Disposition review provides a workflow to review and then permanently delete the data, meeting GDPR requirements.

Answer

Retention policies to preserve the data

Answer

Data Loss Prevention to block the data

Answer

eDiscovery (Premium) to export the data

Question 2

Your organization has a Microsoft Purview retention policy that retains SharePoint documents for 5 years. After 5 years, you want an administrator to review and approve deletion. Which configuration is required?

Accepted Answer

Configure a disposition review at the end of the retention period. To require an administrator to review and approve deletion after the retention period, you must configure a disposition review at the end of the retention period. Disposition review pauses the deletion and routes the item to designated reviewers who can approve destruction or extend retention. This is a specific setting within the retention policy or retention label configuration.

Answer

Apply a retention label and enable disposition review

Answer

Use eDiscovery (Premium) to export and then delete

Answer

Set the retention policy to delete automatically after 5 years

Question 3

Your organization wants to automatically retain customer emails for 5 years after they are received, and then delete them. You need to configure the appropriate Microsoft Purview solution. What should you use?

Accepted Answer

Retention label published automatically. Retention labels in Microsoft Purview can be published automatically to apply to emails based on conditions (such as being received from customers), and they can specify both a retention period (e.g., 5 years) and a disposal action (deletion). Option A is incorrect because eDiscovery cases are used for legal hold and content search, not automated retention. Option B is incorrect because DLP policies focus on preventing data loss through sharing control, not retention. Option C is incorrect because sensitivity labels are primarily for classification and protection, though they can include retention settings; however, the question specifically asks for a retention label published automatically, which is the correct solution.

Answer

eDiscovery case

Answer

Data loss prevention (DLP) policy

Answer

Sensitivity label

Question 4

You are designing a compliance solution for a global company. You need to ensure that data stored in SharePoint Online is not accessible from a specific geographic region. Which Microsoft Purview feature should you use?

Accepted Answer

Compliance boundaries. This question is problematic because no Microsoft Purview feature listed directly restricts SharePoint Online data access based on geographic region. Compliance boundaries (A) are for eDiscovery scoping, not access control. Data loss prevention policies (B) prevent data loss but do not block access by region. Retention policies (C) manage data lifecycle, not access. Sensitivity labels (D) classify and protect data but cannot enforce geographic restrictions on their own. For this requirement, you would use a non-Purview feature such as Conditional Access in Microsoft Entra ID or Multi-Geo capabilities.

Answer

Data loss prevention policy

Answer

Retention policy

Answer

Sensitivity labels

Question 5

Which THREE actions can be performed using a Microsoft Purview Data Loss Prevention (DLP) policy?

Accepted Answer

Notify users via policy tip when they try to share sensitive data. Option A is correct because Microsoft Purview DLP policies can display policy tips to users in supported workloads (Exchange, SharePoint, OneDrive, Teams) when their actions match a DLP rule, warning them before they share sensitive data. Option B is correct because DLP rules can enforce blocking actions, such as preventing users from sharing content containing sensitive information types with external recipients or via unmanaged devices. Option E is correct because DLP policies in Purview can trigger auto-labeling of content with sensitivity labels when sensitive data is detected, using the label as part of the rule action. Option C is not a DLP action; email retention for a fixed period is handled by retention policies and retention labels in Microsoft Purview Data Lifecycle Management, not DLP. Option D is not a direct DLP action; encryption of emails is typically achieved through sensitivity labels with encryption settings or Exchange mail flow rules, not through DLP policy actions themselves.

Answer

Automatically retain emails for 7 years

Answer

Encrypt emails containing sensitive data

Question 6

Refer to the exhibit. A Microsoft Purview sensitivity label is configured as shown. What is the purpose of this label?

Accepted Answer

To encrypt the document and add a visual marking. The label configuration includes encryption and a visual marking (header/footer). These settings ensure that documents with this label are protected and clearly identified. Option A is incorrect because while sensitivity labels can restrict sharing, preventing sharing with external users via DLP is a function of DLP policies, which are separate from the label's direct configuration for encryption and visual marking. Option B is incorrect because the label does not specify auto-labeling conditions; auto-labeling requires a separate policy. Option D is incorrect because retention of documents is managed by retention labels and retention policies, not sensitivity labels.

Answer

To prevent sharing with external users via DLP

Answer

To automatically apply the label based on content

Answer

To automatically retain the document for a specific period

Question 7

Refer to the exhibit. A Microsoft Purview DLP policy is configured as shown. What will happen when a user tries to email an external recipient a document containing a credit card number?

Accepted Answer

The email will be blocked and the user will receive a notification. The DLP policy is configured with the action 'Block' and the user notification is enabled. When a user attempts to email a document containing a credit card number to an external recipient, the policy blocks the email from being sent and displays a notification to the user explaining the policy violation. This is the default behavior for a 'Block' action with user notification in Microsoft Purview DLP.

Answer

The email will be sent but the attachment will be removed

Answer

The email will be delivered and the admin will be alerted

Answer

The email will be sent and the event will be logged for audit

Question 8

A compliance administrator creates a retention policy as shown in the exhibit. What is the overall effect of this policy on content in SharePoint Online?

Accepted Answer

Content is retained for 7 years and then automatically deleted.. The retention policy in the exhibit is configured to retain content for 7 years and then delete it. This means content in SharePoint Online will be kept for the specified duration and automatically purged at the end of the retention period, which matches option D.

Answer

Content is deleted immediately after 7 years from creation.

Answer

Content is automatically labeled after 7 years.

Answer

Content is retained indefinitely after 7 years.

Question 9

A company wants to automatically classify sensitive documents in Microsoft 365 based on credit card numbers and retain them for 7 years. Which two Microsoft Purview solutions should they use together?

Accepted Answer

Sensitivity labels and retention policies. Sensitivity labels classify and protect content, and retention policies ensure data is kept for the required period. Data Loss Prevention (DLP) prevents sharing but does not retain; eDiscovery is for search and export; insider risk management detects risky activities. Therefore, sensitivity labels and retention policies are the correct combination.

Answer

Microsoft Purview compliance portal and Microsoft 365 Defender

Answer

Insider risk management and communication compliance

Answer

Data Loss Prevention (DLP) and eDiscovery

Question 10

Which THREE capabilities does Microsoft Purview provide to help meet regulatory compliance requirements?

Accepted Answer

Audit logging. Microsoft Purview offers audit logging, retention policies, data classification, insider risk management, and communication compliance. All five options are distinct capabilities within Microsoft Purview that directly help organizations meet various regulatory compliance requirements. The distinction between 'core' and 'related but not core' is not accurate in the context of the SC-900 curriculum, which lists all these as capabilities.

Question 11

Refer to the exhibit. The JSON shows a Microsoft Purview retention policy configuration. After applying this policy, an administrator notices that emails in user mailboxes older than one year are being permanently deleted instead of being retained. Which setting should the administrator check first to resolve this issue?

Accepted Answer

The 'RetentionType' is set to 'KeepAndDelete', which deletes after retention period.. The 'KeepAndDelete' retention type retains items for the specified duration and then permanently deletes them. In this scenario, emails older than one year are deleted after the 365-day retention period expires. Checking the 'RetentionType' setting is the first step to identify why emails are being deleted instead of retained.

Option B is incorrect because the 'Locations' array includes all necessary workloads (Exchange, SharePoint, OneDrive). The issue is not related to missing workloads.

Option C is incorrect because the 'RetentionDuration' of 365 days is appropriate for a one-year retention policy. The problem is the retention type, not the duration.

Option D is incorrect because the 'RetentionTrigger' set to 'When items were created' is standard for email retention. Changing it to 'last modified' would not prevent deletion; the deletion occurs due to the 'KeepAndDelete' type, not the trigger.

Answer

The 'Locations' array does not include all necessary workloads.

Answer

The 'RetentionDuration' is too short for email retention.

Answer

The 'RetentionTrigger' should be 'When items were last modified' instead of 'created'.

Question 12

A law firm, Wingtip Toys, uses Microsoft Purview to manage client data. They need to: (1) retain all documents related to client cases for 10 years after case closure; (2) automatically apply a 'Case' retention label to documents in specific SharePoint sites based on metadata; (3) allow case managers to manually label documents; (4) ensure that after 10 years, documents are deleted; (5) preserve data for legal hold purposes when litigation occurs. The firm has Microsoft 365 E5 licenses. The compliance team wants to minimize manual effort. What should they configure?

Accepted Answer

Create auto-apply retention labels for 'Case' documents with a retention period of 10 years and delete action, and enable litigation hold on relevant sites.. Auto-apply retention labels based on metadata automate retention, and litigation hold preserves data during litigation. Option B is wrong because sensitivity labels are primarily used for data protection (e.g., encryption, access control) and do not directly manage retention periods or deletion actions. Option C is wrong because retention policies apply to all content in a location, not selectively. Option D is wrong because Data Loss Prevention (DLP) policies are designed to prevent unauthorized sharing or transfer of sensitive data, not to manage data retention lifecycles or ensure deletion after a specific period.

Answer

Create sensitivity labels with auto-labeling for case documents, and configure records management.

Answer

Create a default retention policy for all SharePoint sites with a 10-year retention period and delete action.

Answer

Create a Data Loss Prevention (DLP) policy to block sharing of case documents, and enable eDiscovery holds.

Question 13

A compliance administrator at Fabrikam is configuring a retention policy in Microsoft Purview to retain Exchange Online mailboxes and SharePoint Online sites for seven years. Which two actions can the administrator perform with a retention policy? (Choose two.)

Accepted Answer

Retain content for a specified period and then delete it automatically.. Retention policies in Microsoft Purview are designed to manage the lifecycle of content by retaining it for a specified period and then deleting it, as well as preventing users from editing or deleting content during the retention period. These actions help organizations comply with regulations that require data to be preserved and then disposed of. Encryption, sensitivity labeling, and access restriction are handled by other Purview solutions, not by retention policies.

Answer

Encrypt content in Exchange Online and SharePoint Online automatically.

Answer

Restrict access to content to specific users or groups.

Answer

Apply a sensitivity label to content based on its location.

Question 14

A security analyst at Litware needs to investigate a recent phishing attack that targeted several users. The analyst must identify which users received the phishing email and whether any clicked the malicious link. Which Microsoft Purview solution provides this information?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct solution because it offers Threat Explorer and real-time detections specifically designed for investigating phishing and other email threats. These tools show which users received a phishing email, whether they clicked links, and allow remediation. The other solutions focus on auditing, legal discovery, or data loss prevention, and do not provide the granular phishing investigation capabilities needed.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview eDiscovery

Question 15

A compliance officer at a healthcare organization needs to identify all Microsoft 365 locations where employees stored documents containing patient diagnosis codes. The organization has Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. The officer must search across all these locations for the sensitive information type 'U.S. Health Insurance Portability and Accountability Act (HIPAA)' and then export the results for legal review. Which Microsoft Purview solution should the officer use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). eDiscovery (Premium) is the only solution that supports searching for sensitive information types like HIPAA across Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams, and provides the necessary export and review capabilities for legal purposes. The other options either lack the search functionality or are not designed for this use case.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Compliance Manager