SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 4 — 15 Questions

Question 1

A compliance administrator at Northwind Traders is configuring a Microsoft Purview retention policy for Microsoft 365 workloads. They need to ensure that content is retained for five years and then deleted. They also need to ensure that users cannot delete or modify the content during the retention period. Which two settings should the administrator configure? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the retention period to five years and configure the policy to delete items after retention.. To retain content for five years and then delete it, the policy must set the retention period and deletion action. To prevent users from deleting or modifying content during retention, the policy must be configured to retain items even if users delete or edit them. These two settings together ensure the content lifecycle and protection requirements are met.

Answer

Assign the retention policy to specific users rather than locations.

Answer

Enable a preservation lock on the retention policy.

Answer

Create a retention label with a record declaration.

Question 2

A company uses Microsoft 365 and wants to ensure that emails containing the sensitive information type 'Credit Card Number' are automatically encrypted when sent to external recipients. The company does not want to block the emails, only encrypt them. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview sensitivity label with encryption settings. A sensitivity label with encryption settings can be automatically applied to emails containing credit card numbers, ensuring they are encrypted when sent externally. This approach does not block the email but protects its contents. The other options either do not provide encryption or are not designed for automatic application based on sensitive information types.

Answer

Microsoft Purview Insider Risk Management policy

Answer

Microsoft Purview Data Loss Prevention (DLP) policy with an encryption action

Answer

Microsoft Purview retention label with a retention action

Question 3

A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?

Accepted Answer

Configure improvement actions with owners. To automatically assign each control to the appropriate team member for remediation in Microsoft Purview Compliance Manager, you must configure improvement actions with owners. Each improvement action can be assigned to a specific user who is responsible for implementing the remediation steps, and this assignment triggers automatic notifications and tracking within the compliance score.

Answer

Create new assessments for each regulation

Answer

Set up connectors to import external risk data

Answer

Use the Microsoft 365 admin center to delegate tasks

Question 4

A company is subject to a legal hold for an ongoing investigation. The IT administrator must prevent the deletion of any documents related to this case across SharePoint Online and OneDrive, overriding any existing deletion policies. Which Microsoft Purview capability should the administrator use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct choice because it provides legal hold capabilities that can preserve content in SharePoint Online and OneDrive for Business, overriding any deletion policies. When a legal hold is applied via eDiscovery, the system places a hold on the specified locations, preventing permanent deletion or modification of documents until the hold is released. This directly addresses the requirement to prevent deletion of case-related documents during an ongoing investigation.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Communication Compliance

Question 5

A company wants to automatically apply a 'Confidential' sensitivity label to any document that contains a credit card number, and also encrypt the document as part of the label. Which two components must be configured to achieve this? (Choose two.)

Accepted Answer

A sensitivity label with encryption settings. Option A is correct because the requirement to encrypt the document as part of the label can only be fulfilled by a sensitivity label that has encryption (Azure Rights Management) configured in its protection settings. Option C is correct because automatically applying that label to any document containing a credit card number requires an auto-labeling policy (client-side or service-side) that uses a sensitive information type such as Credit Card Number to trigger the label. Option B is incorrect because a DLP policy detects and can block or warn about sensitive content, but it does not apply sensitivity labels or encrypt documents. Option D is incorrect because the data classification dashboard is only a reporting/monitoring view of classified content and performs no labeling or encryption.

Answer

A DLP policy that detects sensitive info

Answer

A data classification dashboard

Question 6

A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution because it allows you to define retention labels and policies that automatically retain contracts for a specified period (10 years) and then trigger a permanent deletion disposition review or direct deletion. This aligns directly with the regulatory requirement to retain data for a fixed duration and then dispose of it securely.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Answer

Information Protection

Question 7

A healthcare organization uses Microsoft 365 and wants to prevent users from sending emails that contain patient health information (PHI) to external recipients. Which Microsoft Purview solution should they implement?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as patient health information (PHI), via email and other channels. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) to automatically block or warn users when they attempt to send such data to external recipients.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

eDiscovery

Question 8

A multinational corporation must retain all financial records for 7 years and then permanently delete them. The compliance officer wants to ensure that even a global administrator cannot modify or delete the retention policy. Which Microsoft Purview solution and configuration should they use?

Accepted Answer

Data Lifecycle Management with a preservation lock. C is correct because Data Lifecycle Management with a preservation lock allows an organization to apply a retention policy that cannot be modified, deleted, or turned off by any administrator, including a global administrator. This ensures financial records are retained for exactly 7 years and then permanently deleted, meeting the compliance officer's requirement for immutable retention.

Answer

eDiscovery (Standard)

Answer

Compliance Manager

Answer

Information Protection with sensitivity labels

Question 9

A company is subject to a legal investigation and must preserve all email communications related to the case for an indefinite period, even if users try to delete them. The compliance officer needs a solution that can place a hold on specific user mailboxes and prevent any permanent deletion of relevant content. Which Microsoft Purview feature should be used?

Accepted Answer

Litigation hold. Litigation hold is the correct feature because it places a hold on an entire mailbox, preserving all content including deleted items and versions, and prevents permanent deletion by users or automated processes. Unlike retention labels or policies, litigation hold applies to the entire mailbox and is designed specifically for legal investigations where indefinite preservation is required.

Answer

Retention labels

Answer

Data loss prevention

Answer

Compliance Manager

Question 10

A financial services organization needs to prevent communication between its research analysts and investment bankers to comply with regulatory requirements. Which Microsoft Purview solution should the compliance team implement?

Accepted Answer

Information Barriers. Information Barriers (IB) in Microsoft Purview is specifically designed to prevent communication and collaboration between certain user groups to comply with regulatory requirements, such as those in financial services that require separation between research analysts and investment bankers. IB policies enforce restrictions on Microsoft Teams, SharePoint, and OneDrive to block unauthorized communication and file sharing, directly addressing the need to avoid conflicts of interest.

Answer

Data Loss Prevention (DLP)

Answer

Data Lifecycle Management

Answer

Microsoft Purview eDiscovery

Question 11

A financial institution uses Microsoft 365 and must ensure that Microsoft support engineers cannot access the institution's content (e.g., Exchange Online mailboxes, SharePoint sites) without explicit approval from the institution's compliance officer. The compliance officer needs to review and approve or reject each access request. Which Microsoft Purview feature should be configured?

Accepted Answer

Customer Lockbox. Customer Lockbox is the correct feature because it provides a controlled access approval process for Microsoft support engineers to access customer content. When a support case requires access to Exchange Online mailboxes or SharePoint sites, Customer Lockbox ensures the request is sent to the institution's compliance officer for explicit approval or rejection before access is granted, meeting the requirement for explicit approval.

Answer

Communication Compliance

Answer

Insider Risk Management

Answer

Data Lifecycle Management

Question 12

A financial services organization must prevent employees in the Research department from communicating via email or Microsoft Teams with employees in the Investment Banking department to avoid conflicts of interest. Additionally, they need to prevent any credit card numbers from being shared in emails sent to external recipients. Which combination of Microsoft Purview solutions should they implement?

Accepted Answer

Information Barriers and Data Loss Prevention. Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest (e.g., research vs. investment banking). Data Loss Prevention (DLP) policies detect and protect sensitive information such as credit card numbers from being shared externally. Communication Compliance focuses on monitoring communications for regulatory compliance but does not block communications, and Insider Risk Management analyzes risky user activities but does not enforce segmentation.

Answer

Communication Compliance and Insider Risk Management

Answer

Information Barriers and Communication Compliance

Answer

Data Lifecycle Management and Data Loss Prevention

Question 13

A company's security team needs to detect and investigate potential data theft by employees who have legitimate access to sensitive data. They want a solution that uses heuristics and behavioral analytics to identify risky user actions such as data exfiltration to personal cloud storage. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that may lead to data theft, using heuristics and behavioral analytics. It correlates signals from Microsoft 365 and Azure services to identify patterns like data exfiltration to personal cloud storage, which aligns directly with the scenario's requirements.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Information Barriers

Question 14

A company must retain all vendor contracts for 10 years to meet regulatory requirements. After 10 years, the contracts must be permanently destroyed with no possibility of recovery. The compliance team wants to automate this lifecycle and ensure that during the retention period, the contracts cannot be edited or deleted by users. Which Microsoft Purview solution should they use?

Accepted Answer

Records Management. Records Management in Microsoft Purview is designed to declare records (regulatory or legal) that must be retained for a specific period and then disposed of in a compliant manner. It enforces immutability during the retention period—users cannot edit or delete records—and supports a disposition review or automatic permanent deletion after the retention period ends, exactly matching the requirement for 10-year retention followed by destruction with no recovery.

Answer

Data Lifecycle Management (DLM)

Answer

eDiscovery (Premium)

Answer

Sensitivity Labels

Question 15

A compliance officer needs to evaluate their organization's security and compliance posture against multiple regulatory frameworks such as HIPAA, GDPR, and ISO 27001. The solution must provide a continuous assessment score, actionable improvement actions, and the ability to track implementation progress. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a continuous compliance assessment score against multiple regulatory frameworks (including HIPAA, GDPR, and ISO 27001), offers actionable improvement actions, and enables tracking of implementation progress through a centralized dashboard. It maps controls to specific regulations and generates a compliance score based on implemented controls, making it the only option that meets all stated requirements.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery