Manage compliance by using Microsoft Purview practice questions

Retention labels

Why wrong: Retention labels are designed for records management, not for content classification or access control. They govern how long content must be kept, when it should be permanently deleted, and whether disposition reviews are required, all based on regulatory or business rules. While they attach metadata to content, that metadata is focused on retention and deletion schedules, not on sensitivity or protection. Consequently, retention labels do not implement encryption, rights restrictions, or access policies, so they cannot fulfill the automatic classification requirement.

Data Loss Prevention (DLP) policies

Why wrong: DLP policies inspect content in motion and at rest to detect sensitive information types such as credit card numbers, bank account numbers, or national identifiers. When a match occurs, they can block sharing, warn users, or trigger incident reports, but they never write classification labels onto the content itself. DLP might even use sensitivity labels as a condition for its actions, yet the policy's role is enforcement and remediation, not classification. Therefore, a DLP policy alone cannot automatically classify documents; it only reacts to existing labels or detected sensitive data.

Exchange DLP

Why wrong: Exchange DLP policies are designed for messages in transit and mailboxes, using transport rules to scan email headers, body, and attachments. They can enforce actions like encrypting, quarantining, or blocking emails, but they have no mechanism to intercept or block a user's local clipboard paste into a web browser form. Since the issue occurs on the endpoint rather than in email flow, Exchange DLP is inapplicable and therefore incorrect.

SharePoint DLP

Why wrong: SharePoint DLP applies to files and documents stored in SharePoint Online and OneDrive for Business, governing external sharing, permissions, and file-level protection. It can analyze document content and prevent unsafe sharing, but it does not observe the user's device activity or local clipboard operations. Opening a document in SharePoint does not expose clipboard or browser form events, so this policy location cannot block a paste into a web form and is incorrect.

Teams DLP

Why wrong: Teams DLP policies protect messages and files shared within Microsoft Teams chat, channels, and meetings, detecting sensitive data in conversation content and applying restrictions such as blocking or allowing message delivery. These policies operate on data within Teams and do not integrate with endpoint clipboard or browser form functionality. A paste action into an external web form is entirely outside the scope of Teams DLP, which makes this option incorrect.

Create a sensitivity label with the desired protection settings

Why wrong: A sensitivity label defines the protection outcome—such as encryption and permissions—but it does not scan content or evaluate conditions on its own. The label must exist before you configure auto-labeling, yet creating it is only a foundational step, not the mechanism that triggers automatic application. The actual labeling is performed by an auto-labeling policy that references this label.

Configure a data loss prevention (DLP) rule

Why wrong: Configuring a DLP rule addresses the prevention of sensitive data loss—blocking, restricting, or alerting on content—not the assignment of sensitivity metadata. DLP actions operate on the outbound data path (Exchange, Teams, endpoints, etc.) and cannot stamp a sensitivity label on the source document. To automatically label content based on SIT conditions, Purview requires a separate auto-labeling policy, not a DLP rule.

Retention label applied automatically

Why wrong: A retention label applied automatically controls how long content is kept and when it should be deleted, but it does not lockdown the item during the retention period. Unless the label is configured as a regulatory record or has locked disposition, users with edit permissions can still modify the document, and the label only prevents permanent deletion until the retention period expires. Therefore, it does not meet the requirement to preserve documents in their current state for legal purposes.

Data loss prevention policy

Why wrong: A data loss prevention (DLP) policy is designed to inspect content and block sensitive information from being shared outside the organization, such as credit card numbers or PII. While it can restrict actions like sending or copying data, it does not create a preserved snapshot nor lock the document from editing within the tenant. DLP operates at the transport and sharing layer, not at the storage layer, so it cannot prevent a user from modifying or deleting a document in place.

Sensitivity label with encryption

Why wrong: A sensitivity label with encryption primarily provides access controls by restricting who can open, read, or edit a document based on permissions. Even though encryption prevents unauthorized access, a user with the 'Co-Author' or 'Owner' permission can still modify the content, and encryption does not block deletion by an authorized user. This option protects confidentiality but does not satisfy the requirement to preserve documents in a legally immutable state for compliance.

Create a retention label policy

Why wrong: Retention label policies focus on retention and disposition rules, such as retaining items for a specific number of years or deleting them after a period. They do not classify content based on its sensitivity; instead, they are applied manually or via auto-apply rules based on keywords or trainable classifiers, and they do not assign sensitivity labels. Even if a retention label is added, it does not create the 'Confidential' sensitivity label that the compliance officer needs. Therefore, this option fails to meet the content-scanning and labeling requirement.

Create a Data Loss Prevention (DLP) policy

Why wrong: Data Loss Prevention (DLP) policies in Microsoft Purview monitor and block the sharing or transfer of sensitive data, implementing actions like blocking user access or sending an alert. While DLP uses sensitive information types, its purpose is to enforce protection actions, not to apply metadata like a sensitivity label. The compliance officer needs automatic classification as 'Confidential,' which is the role of an auto-labeling policy, not a DLP policy. DLP can later consume the sensitivity label for enforcement, but it does not create the label.

Configure a default sensitivity label

Why wrong: Configuring a default sensitivity label makes that label the initial selection for all new content in a SharePoint, Teams, or file location, but it is applied without examining the content of each item. It does not distinguish between documents that actually contain confidential or sensitive data; it simply stamps the same label on everything. A user can also override the default setting, which further weakens the guarantee. The requirement calls for content-based scanning to automatically apply a confidential label only when sensitive data is detected, which a default label cannot achieve.

Sensitivity label

Why wrong: Sensitivity labels are classification and protection controls that can encrypt or visually mark content (e.g., 'Confidential'), but they are not designed to assign retention labels or manage data disposition. Although a sensitivity label can be referenced as a condition in an auto-apply retention label policy, the label itself does not trigger or apply a retention label. Thus it cannot satisfy the requirement to automatically apply a retention label to documents containing SWIFT codes.

Data Loss Prevention (DLP) policy

Why wrong: Data Loss Prevention (DLP) policies are designed to protect data from being shared inappropriately by detecting sensitive information and taking actions like blocking sharing or displaying policy tips. Even though a DLP policy can leverage a trainable classifier to identify sensitive content, its actions are focused on preventing unauthorized data exfiltration, not on managing retention or disposition. Therefore, DLP cannot be used to automatically apply a retention label to documents.

Litigation Hold

Why wrong: Litigation Hold is a mailbox-level setting in Exchange Online that preserves all mailbox content in place, including deleted items, changed messages, and original versions, for the duration of the hold. It is designed to suspend any permanent deletion or modification of a user's email and, when enabled alongside OneDrive, also protects the user's documents and files. This is the correct tool because a compliance administrator can simply enable the hold on a user without needing to define a search query or associate it with a case, ensuring that every communication is retained while allowing the user to continue working normally.

Retention policy

Why wrong: A Microsoft Purview retention policy is a lifecycle-management rule that applies to an entire location, such as 'all mailboxes' or 'all OneDrive accounts,' and cannot be narrowly scoped to just one user's full mailbox and OneDrive for legal purposes. Even when using adaptive policy scopes, the selection is based on organizational attributes (e.g., department, country) rather than a direct mapping to preserve a specific individual's communications indefinitely. Because the administrator's requirement is to preserve all communications for a particular user without affecting other users, a retention policy is not the precise or appropriate mechanism.

Data Loss Prevention (DLP) policy

Why wrong: Data Loss Prevention (DLP) policies scan outbound and internal messages and files for sensitive data patterns such as credit card numbers or social security numbers, and then apply enforcement actions like blocking the transmission or notifying the user. These policies are reactive and focus on preventing data leakage, not on preserving or holding existing content for compliance or legal scenarios. A DLP policy cannot retain copies of deleted items or keep a static snapshot of a user's communications, so it is entirely unsuited to the stated need.

Retention label policy

Why wrong: A retention label policy manages the lifecycle of content by determining how long items are retained and whether they should be disposed of at the end of that period. Retention labels do not have the intrinsic capability to classify content as confidential or to assign sensitivity-based protection; they operate in the records management and data lifecycle governance realm, not in information protection classification. Because the requirement is to automatically apply a confidentiality label based on sensitive content, a retention label policy is incorrect for this task.

Microsoft Purview Information Protection scanner

Why wrong: The Microsoft Purview Information Protection scanner is a Windows Server service designed to discover, classify, and protect files residing in on-premises file shares, SharePoint Server, and Windows file servers. It cannot connect to SharePoint Online cloud locations, so it is unable to automatically apply sensitivity labels to documents stored in a Microsoft 365 cloud environment. Therefore, it does not satisfy the officer's need for automatic labeling within SharePoint Online.

Microsoft Purview Message Encryption

Why wrong: Microsoft Purview Message Encryption (OME) is a licensing-based feature that is automatically enabled for all Office 365 tenants and does not require separate administrative configuration. It provides the underlying encryption capability used by other methods, but it is not a policy component that can be configured to react to data classification conditions like PCI detection. Simply having OME enabled does not ensure all emails containing sensitive data are encrypted unless a separate policy actively triggers it.

Transport rule with encryption

Why wrong: Exchange transport rules (mail flow rules) can apply OME-based encryption by matching message conditions and assigning rights protection, but this is a legacy approach that relies on the transport pipeline at runtime. Unlike DLP with sensitivity labels, transport rules do not natively integrate with the broader Purview information protection ecosystem and are less flexible across Outlook on the web, mobile, or other endpoints. While technically feasible, Microsoft recommends the DLP-plus-sensitivity-label combination as the modern, streamlined method for email encryption.

Data Loss Prevention (DLP) policy

Why wrong: A Data Loss Prevention (DLP) policy is incorrect here because DLP is designed to detect and prevent unauthorized sharing or exfiltration of sensitive data by blocking actions or showing policy tips, not to apply sensitivity labels. While a DLP policy can reference sensitivity labels as conditions, it does not have the capability to assign or write labels onto documents. Therefore, it cannot ensure that all uploaded files are labeled.

Retention label policy

Why wrong: A retention label policy is not suitable because retention labels are intended for records management and compliance lifecycle governance—controlling how long content must be retained and when it is deleted—rather than for sensitivity classification. Applying a retention label does not protect a file with encryption or rights management, and it does not serve as a sensitivity label. Thus, it cannot meet the requirement to classify documents based on their sensitive content such as passport numbers.

Data Loss Prevention

Why wrong: Data Loss Prevention (DLP) is a policy engine that inspects content for sensitive information types such as credit card numbers or PII and enforces actions like blocking or warning before transmission. It does not offer a unified search and discovery experience across Exchange, SharePoint, and Teams, nor can it place an immutable legal hold on custodial content. While DLP might prevent future exfiltration, it cannot locate or preserve historical records with the defensibility required for litigation.

Communication Compliance

Why wrong: Communication Compliance is focused on monitoring internal and external communications for inappropriate behavior such as harassment, threats, or regulatory policy violations using trainable classifiers and machine-learning models. It generates alerts and remediation tasks rather than providing comprehensive litigation discovery; it does not index all content workloads for a broad keyword search, cannot create a custodian-based legal hold across the entire tenant, and lacks the review set and export functions needed for a court case. Its purpose is risk and conduct monitoring, not evidence preservation.

Retention Labels

Why wrong: Retention labels are information-governance controls that apply retention or deletion behavior to individual items based on manual user action or automated auto-labeling rules. They can prevent permanent deletion by retaining content for a configured period, but they do not provide a search interface to locate all items relevant to litigation, cannot target multiple workload data sources for a single discovery query, and do not support custodian-specific holds with release workflows. A label only defines lifecycle timing; it gives no capability to collect, review, or produce evidence for a legal case.

Data Loss Prevention

Why wrong: Data Loss Prevention (DLP) in Microsoft Purview inspects content for sensitive information types (credit card numbers, PII, etc.) and applies protective actions like blocking transmission or notifying users. It does not govern the content lifecycle, and a DLP match leaves the document fully editable and deletable by anyone with permissions. Consequently, DLP cannot declare a contract as an immutable record or prevent authorized modifications, so it fails the legal immutability requirement.

eDiscovery (Premium)

Why wrong: eDiscovery (Premium) is a case-based tool for identifying, preserving, collecting, and reviewing relevant content during a legal investigation. A legal hold placed on content prevents deletion by the search hold, but users can still modify the contents of documents, and the hold is intended to be temporary, tied to a specific case. It does not apply a permanent record declaration or enforce edit restrictions, so it cannot satisfy a standing regulatory requirement that contracts remain immutable.

Communication Compliance

Why wrong: Communication Compliance is a supervision and risk-control feature that detects messages in email, Microsoft Teams, and Yammer that violate organizational policies such as harassment, threats, or inappropriate sharing. It routes matched communications to reviewers and can store them for investigation, but it has no mechanism to apply retention labels, block document modifications, or declare records. Because it only monitors and reports on communications, it cannot make contracts immutable.

sensitivity label configured with a retention marking

Why wrong: A sensitivity label with a retention marking is incorrect because sensitivity labels are designed for classification and protection—they apply encryption, permissions, or visual headers/footers/watermarks, not lifecycle retention. There is no concept of a 'retention marking' in sensitivity labels; any markings are visual, and sensitivity labels cannot schedule deletion or archive actions. Furthermore, even if a sensitivity label automatically classifies content, it cannot trigger a retention label or retention event. Retention behavior is exclusively controlled by retention labels and policies, not by sensitivity labels.

Data Loss Prevention (DLP) policy with a condition matching 'Project Alpha'

Why wrong: A Data Loss Prevention (DLP) policy with a condition matching 'Project Alpha' is incorrect because DLP policies are enforcement mechanisms that detect sensitive data and prevent unauthorized sharing—for instance, blocking email transmission or restricting external sharing—not tooling for retention lifecycle management. DLP rules can include conditions like keywords, but their actions are limited to alerts or restrictions; they cannot assign retention labels or enforce deletion/archival schedules. Applying retention requires a retention label with an action and an auto-apply policy, not a DLP rule. DLP and retention are complementary but operate in different compliance domains.

eDiscovery hold (Core or Advanced)

Why wrong: An eDiscovery hold in Purview (Core or Advanced) preserves content that matches a specific search query or is associated with an eDiscovery case, not an entire mailbox. It allows you to target specific mailboxes, dates, or keywords, but it requires case management and does not automatically apply a blanket hold to all mailbox items. For a simple, whole-mailbox hold on a single departing user, an eDiscovery hold is more complex and less direct than Litigation Hold.

retention policy with 'Preserved forever' state

Why wrong: A retention policy applied to a mailbox may preserve items, but it applies to all mailboxes in the scope and is less granular for individual legal holds. Litigation Hold is designed specifically for individual mailbox holds.

In-Place Hold (Exchange Online)

Why wrong: In-Place Hold is a legacy hold mechanism inherited from on-premises Exchange Server and has been deprecated in Exchange Online; it is not available through current admin portals. It used the same underlying technology as Litigation Hold but lacked the simplicity and cloud-managed experience of the modern hold option. Administrators should use Litigation Hold or eDiscovery holds instead, making this a non-viable choice.

B: Information Protection (sensitivity labels)

Why wrong: Sensitivity labels are used to classify and protect emails with encryption, permissions, and visual markings, but they do not automate time-based retention or deletion. While labels can be configured to apply a retention label in some cases, that is a different feature and not the label itself; the label alone has no deletion timer. Therefore, sensitivity labels do not meet the requirement for automatic email lifecycle management.

C: Data Loss Prevention (DLP policy)

Why wrong: Data Loss Prevention (DLP) policies inspect email content to detect sensitive information such as credit card numbers or social security numbers and then take actions like blocking or warning the sender. These policies act at the moment of transmission and have no mechanism to schedule later retention or deletion of messages. DLP is an inappropriate choice for enforcing email retention schedules.

D: eDiscovery (content search)

Why wrong: eDiscovery (content search) is designed to search for, place holds on, and export content for legal or regulatory investigations. A hold actually prevents deletion of content, so it works in opposition to the requirement to automatically delete emails after a period. Content search does not provide any automatic retention-then-deletion behavior based on time.

A: Data Lifecycle Management

Why wrong: Data Lifecycle Management (DLM) governs how long content is retained and when it should be deleted. It applies retention labels and policies based on criteria such as age, location, or existing metadata, but it does not analyze document content to identify categories. Because it lacks machine learning-based content recognition, DLM cannot automatically discover documents by topic or context.

C: eDiscovery

Why wrong: eDiscovery is an investigation-centric tool that performs keyword, property, and metadata searches across content sources to find evidence for legal or compliance cases. It can preserve and export results, but it does not use machine learning to automatically recognize and classify content. Searching with eDiscovery requires manual query construction, so it cannot continuously identify documents based on learned patterns.

D: Communication Compliance

Why wrong: Communication Compliance is focused on monitoring emails and Microsoft Teams messages for policy violations like harassment, inappropriate sharing, or regulatory non-compliance. Its classification capabilities are tailored to communication content, not general SharePoint document libraries. Thus it cannot be used to identify confidential engineering specs or HR files stored as documents in SharePoint.

Data Loss Prevention (DLP) policy

Why wrong: A DLP policy is designed for enforcement actions, such as blocking or restricting the sharing of sensitive data, not for assigning sensitivity labels to content. While DLP can use a sensitivity label as a condition to trigger a rule, it cannot change or apply a label when a match occurs. Therefore, it would not fulfill the requirement to automatically apply a sensitivity label to documents.

Retention label policy

Why wrong: A retention label policy governs the data lifecycle by applying retention rules that preserve or permanently delete content after a specified period. It does not classify content by sensitivity or apply encryption, because it is focused on storage disposition rather than protection. Thus, while it can label content, that label is a retention tag, not a sensitivity label, so it cannot satisfy the compliance requirement.

Microsoft Purview Data Loss Prevention (DLP) policy

Why wrong: A Microsoft Purview DLP policy is the correct choice because it can continuously scan SharePoint sites for sensitive info types (e.g., credit card numbers) using built-in or custom data loss prevention rules. By setting the action mode to 'Audit only,' the policy identifies and logs matches to the Purview audit log and can raise alerts, without blocking access, copying, or applying any protective action—satisfying the requirement to merely identify documents for review.

Microsoft Purview eDiscovery content search

Why wrong: eDiscovery content search is wrong because it is a manual, on-demand tool: an administrator must construct a KQL query (e.g., for credit card numbers) and run it, after which results are exported or added to a review set. It does not continuously monitor SharePoint to automatically identify new or existing sensitive documents on an ongoing basis, and it is designed for legal discovery and investigations rather than routine compliance identification. Thus it fails the 'automatic identification' requirement stated in the question.

Microsoft Purview Records Management retention label

Why wrong: A Records Management retention label is incorrect because it is designed to govern information lifecycle—specifically how long content is kept and when it is deleted or declared a record—not to detect or flag sensitive data like credit card numbers. Retention labels do not inspect document content for sensitive info types; they only apply classification metadata based on a label policy or user action. Therefore, using a retention label would neither identify the presence of sensitive data nor support a review workflow for such content.

Data loss prevention (DLP) policies and retention labels

Why wrong: Incorrect. Retention labels manage retention and deletion but do not support encryption. DLP policies can detect sensitive data but cannot apply encryption via retention labels.

Sensitivity labels and retention policies

Why wrong: Incorrect. Retention policies also do not provide encryption; they control how long content is retained.

Auto-labeling policies and communication compliance policies

Why wrong: Incorrect. Communication compliance policies are for monitoring communications, not for applying encryption labels.

Sensitivity labels

Why wrong: Sensitivity labels are designed to classify, encrypt, and watermark content, but they do not scan the body or attachments of an outgoing email for specific data patterns; they rely on user selection, manual application, or automatic classification rules that run after the message is composed. A label can restrict access to the email after it is sent, but it cannot interrupt the send action or reject the message when disallowed data is detected. Therefore, sensitivity labels cannot fulfill the requirement to prevent users from sending emails containing sensitive information in real time.

Communication compliance

Why wrong: Communication compliance is a supervision solution that helps organizations detect inappropriate or potentially risky communications by applying trainable classifiers and policies to email and Teams messages; it is designed for after-the-fact review, alerting, and investigation by designated reviewers. Even when a message is flagged, it still reaches the intended recipient because communication compliance does not enforce transport-level blocks or reject actions. Hence, it is not suited to preventing an email from being sent at the moment of transmission.

eDiscovery

Why wrong: eDiscovery is an investigation tool used to search, preserve, and export content across Exchange Online, SharePoint, and OneDrive for legal or regulatory purposes, typically during litigation or compliance investigations. It operates only on stored records and can place holds on mailboxes to prevent deletion, but it has no ability to inspect messages in the outbound pipeline or stop a send operation. For a positive prevention control, eDiscovery is far outside the scope of DLP's proactive interception.