SC-900 Describe the capabilities of Microsoft compliance solutions Practice Test 8 — 15 Questions

Question 1

A financial organization is required by regulation to keep all customer transaction records for 10 years. After 10 years, the records must be permanently deleted. In addition, during the retention period, records must not be modifiable or deletable by any user, including administrators. Which Microsoft Purview solution should they use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Records Management. Records Management in Microsoft Purview is designed to meet regulatory requirements by allowing organizations to declare records or regulatory records. When a record is declared, it becomes immutable—no user, including administrators, can modify or delete it during the retention period. The 10-year retention and mandatory deletion after that period are enforced through a retention label configured as a record, which locks the item and triggers permanent deletion upon expiration.

Answer

Retention labels (unlocked)

Answer

Information Protection with sensitivity labels

Answer

Data Lifecycle Management

Question 2

A company uses Microsoft 365 and needs to comply with a regulatory requirement to retain all customer contracts for 5 years after the contract's end date, after which they must be automatically deleted. Additionally, the legal department needs the ability to preserve all documents related to an ongoing lawsuit, overriding any deletion timelines. Which Microsoft Purview solution should the company use?

Accepted Answer

Data Lifecycle Management with retention labels and eDiscovery holds. Data Lifecycle Management (DLM) with retention labels allows the company to apply a retention label to customer contracts that retains them for 5 years after the contract end date and then automatically deletes them. eDiscovery holds can be placed on all documents related to an ongoing lawsuit, which overrides any deletion timelines, ensuring that content is preserved until the hold is released. This combination directly meets both the regulatory retention and legal preservation requirements.

Answer

Information Barriers

Answer

Communication Compliance

Answer

Audit (Premium)

Question 3

A healthcare organization must demonstrate compliance with HIPAA by assessing their current posture against regulatory controls, tracking improvement actions, and generating reports for auditors. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a built-in assessment template for HIPAA, enabling the organization to assess its current compliance posture against regulatory controls, track improvement actions, and generate auditor-ready reports. It offers a compliance score, automated control mapping, and evidence collection workflows specifically designed for regulatory frameworks like HIPAA.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Insider Risk Management

Question 4

A company is involved in litigation and needs to search for specific emails and documents across Exchange Online, SharePoint Online, and Teams. They also need to place a hold on relevant content to prevent deletion. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery. Microsoft Purview eDiscovery (specifically eDiscovery (Premium)) is the correct solution because it is designed for legal investigations, enabling organizations to search for content across Exchange Online, SharePoint Online, and Teams, and to place holds on that content to preserve it from deletion or alteration. This directly addresses the litigation requirement for both search and hold capabilities.

Answer

Records Management

Answer

Data Lifecycle Management

Answer

Data Loss Prevention

Question 5

A company uses Microsoft Purview Compliance Manager to improve their compliance posture. They are preparing for a SOC 2 audit and need to score compliance with SOC 2 controls, track improvement actions, and assign tasks to responsible teams. Which component of Compliance Manager should they use to assign and track specific actions to improve their compliance score?

Accepted Answer

Improvement action. Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.

Answer

Assessment

Answer

Control

Answer

Template

Question 6

A financial institution uses Microsoft 365 and needs to prevent employees from accidentally sharing sensitive financial data (e.g., account numbers) via email. They also need to inform the sender with a policy tip if they attempt to send such data and block the email if it's shared externally. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, warn, and block the accidental sharing of sensitive data—such as financial account numbers—via email. DLP policies can be configured with conditions that trigger a policy tip to inform the sender and automatically block the email if it is sent externally, meeting both requirements.

Answer

Information Protection (Sensitivity labels)

Answer

Communication Compliance

Answer

Records Management

Question 7

A company uses Microsoft 365 and needs to identify and protect sensitive data, such as credit card numbers, stored in SharePoint Online and OneDrive for Business. They also want to prevent users from sharing this data externally. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is the correct solution because it is specifically designed to identify, monitor, and automatically protect sensitive data like credit card numbers (using built-in sensitive information types such as Credit Card Number) across Microsoft 365 services, including SharePoint Online and OneDrive for Business. DLP policies can enforce rules to block or restrict external sharing of such data, directly meeting the requirement to prevent users from sharing sensitive data externally.

Answer

Data Lifecycle Management (DLM)

Answer

Information Protection (sensitivity labels)

Answer

Audit (Standard)

Question 8

A financial services company uses Microsoft Purview and must comply with a regulation that requires communication surveillance for market abuse. They need to capture all electronic communications (email, Teams chats) of traders and scan for specific keywords and trading patterns. Which Microsoft Purview solution is specifically designed for this?

Accepted Answer

Communication Compliance. Communication Compliance is the Microsoft Purview solution specifically designed to capture and analyze electronic communications (email, Teams chats) for regulatory compliance, such as detecting market abuse. It allows organizations to define policies that scan for specific keywords and trading patterns, automatically flagging messages that violate compliance rules. This directly addresses the requirement for communication surveillance in financial services under regulations like MiFID II or Dodd-Frank.

Answer

Data Lifecycle Management

Answer

eDiscovery (Standard)

Answer

Insider Risk Management

Question 9

A financial services organization needs to automatically classify and protect sensitive documents containing credit card information in SharePoint Online and OneDrive for Business. They want a purple-colored label to be applied automatically when the document is saved, and the document should be encrypted with a predefined template that restricts editing to internal users only. Which Microsoft Purview solution should they configure?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling in Microsoft Purview can automatically apply a purple-colored label to documents containing credit card information when saved in SharePoint Online or OneDrive for Business. This label can be configured with encryption using a predefined template that restricts editing to internal users only, meeting the organization's classification and protection requirements.

Answer

Data Loss Prevention (DLP) policies

Answer

Data Lifecycle Management (retention labels)

Answer

Audit (Unified Auditing)

Question 10

A company is involved in litigation and needs to preserve all Exchange Online mailboxes and SharePoint sites related to the case. The legal team also requires the ability to search, review, and export relevant content. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for preserving, searching, reviewing, and exporting content from Exchange Online mailboxes and SharePoint sites. It supports legal hold placement on custodians and data sources, advanced search with keyword and proximity queries, review sets with analytics, and export in a format suitable for litigation. This directly matches the requirement to preserve all relevant mailboxes and sites while enabling the legal team to search, review, and export content.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Premium)

Question 11

A company uses Microsoft 365. The compliance department requires that all financial documents be retained for 10 years and then automatically deleted, while marketing documents must be retained for 3 years and then deleted. Additionally, they want to apply a default retention policy to all SharePoint Online sites. Which Microsoft Purview solution should the company use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it allows organizations to define retention and deletion policies based on content type and location. In this scenario, the company needs to apply different retention periods (10 years for financial documents, 3 years for marketing documents) and a default retention policy for all SharePoint Online sites, which is exactly what Data Lifecycle Management's retention policies and labels provide.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Data Loss Prevention (DLP)

Question 12

A company uses Microsoft 365 and needs to classify and protect sensitive documents by applying encryption and visual markings (headers/footers) based on the content's sensitivity. They also want to automatically revoke access to documents that leave the organization. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (B) is the correct solution because it provides the capabilities to classify and protect sensitive documents using sensitivity labels. These labels can enforce encryption and apply visual markings like headers and footers based on content sensitivity. Additionally, Information Protection supports automatic revocation of access to documents that leave the organization through features like rights management and conditional access policies.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 13

A company wants to detect potentially malicious insider activities, such as employees copying large volumes of files to external drives or sending sensitive emails to personal accounts. The security team needs to investigate these activities with visual timelines and assign cases for review. Which Microsoft Purview solution should they use?

Accepted Answer

Insider Risk Management. Insider Risk Management in Microsoft Purview is purpose-built to detect, triage, and investigate risky insider activities such as mass file downloads, exfiltration to USB drives, and sending sensitive content to personal email accounts. It correlates signals from Microsoft 365, endpoints, and HR data into visual timelines and supports creating cases for investigator review. This matches the requirement for detection plus investigation workflow.

Answer

Communication Compliance

Answer

eDiscovery (Premium)

Answer

Data Loss Prevention

Question 14

A compliance officer wants a central dashboard to assess the organization's compliance posture against regulatory standards such as GDPR and ISO 27001. They need actionable recommendations to improve their compliance score and track progress over time. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a central dashboard that assesses an organization's compliance posture against regulatory standards like GDPR and ISO 27001, offers actionable recommendations to improve the compliance score, and tracks progress over time through continuous assessments and improvement actions.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit

Question 15

A company uses Microsoft 365 and needs to automatically apply a retention label to documents that contain personally identifiable information (PII) in SharePoint Online. The label should retain the documents for 5 years and then delete them. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the solution specifically designed to apply retention labels and policies that automatically retain content for a specified period and then delete it. In this scenario, the requirement to automatically apply a retention label to documents containing PII in SharePoint Online and then retain them for 5 years before deletion is a core capability of Data Lifecycle Management, which uses auto-labeling policies based on sensitive information types.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery