Hard Difficulty Questions

Microsoft Purview Data Loss Prevention + Microsoft Entra ID Identity Protection

Why wrong: DLP policies control sharing behavior but do not enforce device-based access restrictions on documents. Identity Protection focuses on sign-in risk, not device state.

Microsoft Defender for Office 365 + Microsoft 365 Business Premium

Why wrong: Defender for Office 365 protects against threats in email and SharePoint, but does not provide sensitivity labels or device-based conditional access.

Microsoft Purview Audit + Microsoft Entra ID Privileged Identity Management

Why wrong: Audit logs activities for investigation, and PIM manages privileged access, but neither enforces document-level access controls or device restrictions.

Microsoft Purview Audit (Premium)

Why wrong: Audit (Premium) requires E5 or an add-on license; it is not included with E3 alone.

Microsoft Purview eDiscovery (Standard)

Why wrong: eDiscovery is used for searching and holding content (emails, documents), not for auditing user activity logs.

Microsoft Purview Content Search

Why wrong: Content Search is used to find content across mailboxes and sites, not to retrieve audit logs.

Data Loss Prevention (DLP) policy

Why wrong: DLP policies can prevent sharing of sensitive data but do not encrypt the file; once downloaded, the file loses protection.

Microsoft Entra ID Conditional Access

Why wrong: Conditional Access controls access to cloud apps based on user, device, or location, but does not protect the file after download.

Microsoft Defender for Cloud Apps session policy

Why wrong: Session policies monitor and control activity in the cloud, but do not embed persistent protection into files.

Sensitivity labels and Microsoft Purview Information Protection (Microsoft Purview Information Protection)

Why wrong: Labels classify content but require DLP to enforce blocking actions on sharing.

Microsoft Purview Compliance Manager

Why wrong: Compliance Manager assesses compliance posture, does not block data sharing.

Exchange Online Protection (EOP) and Microsoft Defender for Microsoft 365

Why wrong: These protect against threats like malware and phishing, not against accidental sharing of sensitive data.

Data Lifecycle Management (via sensitivity labels)

Why wrong: Data Lifecycle Management is implemented through labels and auto-labeling policies; while it assists in lifecycle management, retention policies are the primary solution for automatic retention and deletion across workloads.

Audit (Standard)

Why wrong: Audit logs user activity but does not provide the search and export capabilities needed to respond to DSARs.

Data Loss Prevention (DLP) policy with a block action

Why wrong: DLP policies block sharing but do not control access or permissions once the document is stored.

Retention policy with a restrict action

Why wrong: Retention policies preserve or delete data; they cannot restrict viewing or editing permissions.

Privileged Identity Management (PIM)

Why wrong: PIM manages privileged access for administrators, not document-level permissions.

Microsoft Purview Information Barriers

Why wrong: Information barriers are used to prevent communication between certain groups (e.g., legal and finance) to avoid conflicts of interest. They do not inspect content for sensitive data or provide policy tips. DLP is the correct solution.

Microsoft Purview Records Management

Why wrong: Records management focuses on labeling content as records and applying retention/deletion policies. It does not actively block content sharing based on sensitive data. DLP policies are used for prevention.

Microsoft Purview Communication Compliance

Why wrong: Communication Compliance helps organizations detect inappropriate messages (e.g., harassment) for review. It does not block messages in real-time or show policy tips. DLP is designed for real-time prevention of data leakage.

Data Loss Prevention (DLP)

Why wrong: DLP can detect PHI and trigger encryption, but the actual encryption is performed by Message Encryption. The solution configured for encryption is Message Encryption.

Sensitivity labels

Why wrong: Sensitivity labels can be set to encrypt emails, but they require user intervention to apply, and the scenario requires automatic classification of PHI. Auto-labeling for emails is less straightforward than DLP.

Information protection policies

Why wrong: This is a broad category; the specific solution for email encryption is Message Encryption.

Data Lifecycle Management (retention policies)

Why wrong: Incorrect. Retention policies are for managing data retention/expiration, not for preserving data for legal hold purposes.

Communication Compliance

Why wrong: Incorrect. This solution is for detecting policy violations in communications, not for placing holds on data.

Audit log

Why wrong: Incorrect. Audit logs record activities but do not preserve content for legal hold.

Litigation Hold

Why wrong: Litigation Hold preserves mailbox data but does not cover SharePoint, OneDrive, or Teams. It is less comprehensive than an eDiscovery case hold.

Auto-apply retention labels

Why wrong: Retention labels are for policy-based retention, not for ad-hoc legal holds and do not provide built-in search/export for litigation.

Data Loss Prevention (DLP) policy

Why wrong: DLP policies prevent unauthorized sharing of sensitive information; they do not preserve data for legal purposes.

Data Loss Prevention (DLP)

Why wrong: DLP policies detect and block sensitive data sharing but do not automatically encrypt documents or apply persistent protection.

Microsoft Purview Audit

Why wrong: Audit logs user and admin activities but does not protect or encrypt documents.

Customer Lockbox

Why wrong: Customer Lockbox is for approving Microsoft support access to data, not for document encryption or classification.

Create policy, Identify locations, Deploy in production, Monitor alerts and refine

Why wrong: Creating a policy before identifying where sensitive data is located may result in an ineffective policy that doesn't cover all data sources.

Deploy in production, Monitor alerts and refine, Identify locations, Create policy

Why wrong: Deploying before creating a policy or identifying locations is not feasible; the policy must exist and be configured before deployment.

Identify locations, Deploy in production, Create policy, Monitor alerts and refine

Why wrong: The policy must be created and tested before it can be deployed; deploying before creating the policy is logically impossible.

Microsoft Purview Audit (Premium)

Why wrong: Incorrect. Audit (Premium) provides longer retention and more API access, but is more expensive than needed for just 90-day retention and basic alerts.

Microsoft Entra ID sign-in logs

Why wrong: Incorrect. These logs focus on user sign-ins, not admin actions like creating accounts or resetting passwords, and they have a different retention and alerting model.

Microsoft Defender for Cloud Apps

Why wrong: Incorrect. This solution is for identifying and managing cloud app usage (shadow IT), not for auditing admin actions within Microsoft 365.

Change the default sharing link type to 'Specific people' and add the partner's domain to an allow list

Why wrong: This only changes the default link behavior; users could still share with external users using other link types. It does not block external sharing globally.

Apply sensitivity labels with encryption to all files

Why wrong: Sensitivity labels with encryption protect content regardless of sharing, but they do not prevent external sharing of unencrypted files and require user classification, which is less direct than sharing settings.

Configure a DLP policy to block external sharing except for the partner domain

Why wrong: DLP policies can inspect content and block sharing based on rules, but they are event-driven and can be complex to maintain; site-level sharing settings are more straightforward for this requirement.

Microsoft 365 E5 Information Protection and Governance add-on

Why wrong: This is not a standard add-on name. Information protection capabilities are part of the E5 Compliance add-on or E5 license.

Microsoft 365 E5 eDiscovery and Audit add-on

Why wrong: This is not a separate add-on; eDiscovery and advanced audit are included in the E5 Compliance add-on. Moreover, they focus on searching and auditing, not retention policies.

Microsoft 365 E5 Compliance add-on for all users and E5 eDiscovery add-on for a subset

Why wrong: The E5 Compliance add-on alone is sufficient; the eDiscovery add-on is not separate and would be redundant.

Purchase Microsoft 365 Business Basic licenses through a volume licensing program

Why wrong: Volume licensing may offer discounts, but for a nonprofit with limited budget, the nonprofit program provides much lower costs.

Use free consumer accounts like Outlook.com and Office Online

Why wrong: Consumer accounts are not designed for business use and lack manageability, compliance, and business-grade email.

Sign up for a Microsoft 365 Business Premium trial and rely on extensions

Why wrong: Trials are temporary and not a sustainable long-term solution; they do not address the need for reduced cost.

Microsoft Purview Audit (Standard)

Why wrong: While Standard retains logs for 90 days, it does not support custom alerting; only basic search and export are available.

Microsoft Defender for Cloud Apps

Why wrong: Defender for Cloud Apps focuses on shadow IT and anomalous behavior across cloud apps, not specifically on auditing admin actions with custom alerts for all Microsoft 365 activities.

Microsoft Entra ID reporting

Why wrong: Microsoft Entra ID reports cover sign-ins and user provisioning but do not include all admin actions across services like Exchange, SharePoint, or Teams.

Microsoft Purview Data Loss Prevention (DLP)

Why wrong: Incorrect. DLP focuses on preventing data leaks, not logging admin actions or providing long-term audit retention.

Microsoft Purview Information Protection

Why wrong: Incorrect. Information Protection classifies and protects data, but does not log admin activities or create alerts.

Microsoft Purview eDiscovery

Why wrong: Incorrect. eDiscovery is used for legal holds and searching content, not for operational audit logging and alerting.

Microsoft, because they provide the SaaS platform

Why wrong: Incorrect. Microsoft is responsible for securing the infrastructure, applications, and platform, but not for user password choices or reuse on external sites.

Both Microsoft and the customer share equal responsibility

Why wrong: Incorrect. While both have responsibilities, the specific failure (password reuse) falls under the customer's domain of identity management.

It depends on the contract terms with Microsoft

Why wrong: Incorrect. The shared responsibility model is standardized; identity security is always the customer's responsibility regardless of contract details.

Upgrade all 100 users from Business Premium to Microsoft 365 E5

Why wrong: This would cost more than necessary because Business Premium already includes many features. E5 includes everything, but it's not cost-effective when only advanced compliance is needed.

Purchase Microsoft 365 E5 eDiscovery and Audit add-on

Why wrong: There is no separate add-on named 'eDiscovery and Audit'; eDiscovery (Premium) is included in the E5 Compliance add-on. This option does not exist and would not cover Communication Compliance.

Purchase Microsoft 365 E5 Compliance and Information Protection add-on

Why wrong: This is not a valid product name. The correct add-on is 'Microsoft 365 E5 Compliance'. Additionally, Information Protection features are included in the E5 Compliance add-on but the name is inaccurate.