MS-102 Manage compliance by using Microsoft Purview Practice Question
You are the Microsoft 365 Administrator for a multinational organization that must comply with various regulatory requirements, including GDPR, SOX, and internal data retention policies. You are deploying Microsoft Purview compliance solutions. Which four of the following actions are valid steps when managing compliance using Microsoft Purview? (Choose all that apply. There are four correct answers.)
⚠ Common exam trap
Microsoft often tests the misconception that sensitivity labels can directly control external sharing of documents within a site, when in reality they control site-level settings (e.g., privacy) while external sharing is governed by SharePoint sharing policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a DLP policy that prevents users from sharing credit card numbers via email with external recipients.
Creating a DLP policy that prevents sharing credit card numbers via email with external recipients is a valid step because Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information types (e.g., credit card numbers) and enforce actions such as blocking external sharing. This directly supports compliance with regulations like GDPR and SOX by preventing unauthorized data exfiltration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a DLP policy that prevents users from sharing credit card numbers via email with external recipients.
Why this is correct
A Data Loss Prevention (DLP) policy in Microsoft 365 can be configured to detect the presence of sensitive information such as credit card numbers in emails and block sharing with external recipients. Using policy rules with conditions, actions, and user notifications, the policy scans outbound messages and prevents the transmission, thereby helping organizations comply with data protection standards like PCI-DSS.
- ✓
Use a retention label to automatically delete documents containing trade secrets after 7 years.
Why this is correct
Retention labels allow administrators to apply a configurable retention period to documents based on classification or content. By assigning a label that deletes content after 7 years, the document is automatically disposed of through a disposition review or directly based on the label's retention action, ensuring regulatory compliance and lifecycle management.
- ✓
Configure a sensitivity label with sublabels that apply different markings (e.g., 'Confidential' and 'Highly Confidential') to the same document.
Why this is correct
Sensitivity labels support sublabels, which are child labels under a parent label. You can configure sublabels with different markings, such as 'Confidential' and 'Highly Confidential,' to be applied to the same document depending on context. This enables granular classification while keeping the parent label's protection settings intact.
- ✓
Enable auditing in the Microsoft 365 compliance portal to track user activities such as file downloads and mailbox access.
Why this is correct
Enabling auditing in the Microsoft 365 compliance portal activates unified auditing across services like Exchange, SharePoint, and OneDrive. It captures events such as file downloads and mailbox access, storing them in a searchable audit log. This provides administrators with a forensic trail to investigate security incidents, insider threats, or compliance violations.
- ✗
Assign a retention policy to a user's mailbox that deletes all emails immediately after they are sent.
Why it's wrong here
A retention policy cannot be set to delete emails immediately upon sending. Retention policies in Exchange and Microsoft 365 are designed to retain content for a minimum period and optionally delete it only after that retention period expires. Settings allow deletion 'on a specific date' but not zero days, and immediate deletion would violate preservation requirements for legal and compliance purposes.
- ✗
Apply a sensitivity label to a SharePoint site that blocks all external sharing of documents stored in that site.
Why it's wrong here
Applying a sensitivity label to a SharePoint site does not by itself block all external sharing of documents. Sensitivity labels for sites can restrict access or apply encryption, but external sharing settings are governed by the site's sharing configuration as defined in SharePoint admin center, such as allowing or disallowing guest links. The label alone cannot override those external sharing policies.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
DLP policy
A DLP policy is a set of rules that an organization uses to prevent sensitive data from being lost, stolen, or accidentally exposed, whether it is in use, in motion, or at rest.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This MS-102 question is part of Courseiva's 241-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.