Describe security, compliance, privacy, and trust in Microsoft 365 practice questions

Data Loss Prevention (DLP) policies

Why wrong: Data Loss Prevention (DLP) policies are not primarily encryption tools; they are designed to detect, monitor, and block the transmission of sensitive data via policy rules. While DLP can integrate with encryption—for example, by applying a Rights Management–based action to encrypt emails—the DLP engine itself does not perform encryption. Thus, DLP alone would not meet the requirement to encrypt sensitive emails; it can only trigger such protection as part of a broader policy.

Microsoft Purview Information Protection (Microsoft Purview Information Protection)

Why wrong: Microsoft Purview Information Protection (MIP) is centered on classifying and labeling documents and emails using sensitivity labels, which can include user-defined or automatic labeling. Although labels can be configured to apply encryption as an action, MIP is fundamentally a classification and governance framework, not a purpose-built email encryption solution. The encryption triggered by MIP policies is a separate action that requires additional configuration, whereas Microsoft Purview Message Encryption provides encryption directly through mail flow rules, making it the more precise answer for email encryption.

Exchange Online Protection (EOP)

Why wrong: Exchange Online Protection (EOP) is a cloud-based email filtering service that offers anti-malware, anti-spam, and some basic policy enforcement, but it does not include any native email encryption capability. EOP's role is to protect the email infrastructure from threats and to filter email traffic, not to apply encryption to messages. Therefore, relying on EOP alone would leave sensitive emails unencrypted, and it cannot fulfill the requirement to encrypt them.

Retention policy

Why wrong: Retention policies in Microsoft 365 Purview apply time-based rules to mailboxes and SharePoint sites, allowing administrators to define how long content is kept and when it is permanently deleted. While you could set a very long retention period, it still relies on a fixed expiry and doesn't provide the open-ended, indefinite preservation required for a legal hold. Additionally, retention policies don't block deletion by users during the retention period in the same way a Litigation Hold does, and they aren't designed to meet the regulatory requirement to preserve all content until litigation is resolved.

Litigation hold

Why wrong: Litigation hold is a mailbox-level feature in Exchange Online that preserves all content in the user's mailbox, including deleted items and versions, until the hold is explicitly removed. It places the entire mailbox on hold, meaning users can continue to work but all deletions and modifications are retained in a recoverable state. This is the correct choice for legal preservation because it provides indefinite, all-encompassing preservation without requiring a specific search query or retention time.

Data Loss Prevention (DLP)

Why wrong: Data Loss Prevention policies scan content for sensitive information types, such as credit card numbers or personal data, and enforce actions like blocking sharing or applying encryption. They are designed to prevent unauthorized disclosure, not to retain or preserve data for legal purposes, and they have no mechanism to hold deleted content. Thus, DLP would not satisfy a requirement to preserve all email and document content, as it focuses on data leakage rather than legal hold.

Microsoft Purview eDiscovery

Why wrong: Microsoft Purview eDiscovery is centered on legal and regulatory compliance workflows — it searches across mailboxes, sites, and Teams for relevant content, places holds to preserve evidence, and exports a secure copy for litigation. It does not inspect content in real time or apply policy-based actions, so it cannot block a user from emailing a patient's chart to an external address. eDiscovery is valuable for investigating a potential breach or responding to a discovery request, but it is an after-the-fact tool, not a prevention control.

Microsoft Purview Audit (Standard)

Why wrong: Microsoft Purview Audit Standard captures an immutable record of user and admin activities, such as when a document was accessed, shared, or sent via email, and the original audit event is retained for 90 days. It does not intercept or modify the flow of data, nor does it apply classification labels or encryption automatically. Audit logs are essential for forensic analysis and compliance reporting after an incident, but they provide no preventative control to stop PHI from leaving the organization.

Conditional Access

Why wrong: Conditional Access is an Entra ID policy engine that evaluates signals such as user, location, device compliance, and risk to allow or block access to cloud apps. It can require a device to be compliant, but it does not push device configuration profiles or manage endpoint settings. Restricting browser extension installation is an on-device policy that only an MDM/CDM tool like Intune can enforce, so Conditional Access alone cannot achieve this goal.

Microsoft Defender for Cloud Apps

Why wrong: Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into cloud app usage, data exfiltration protection, and conditional access app control via reverse proxy. It does not manage device operating systems or browser extensions; that requires a device management agent or MDM profile. Its policies act on cloud app sessions in real time, not on local endpoint configuration, so it cannot restrict who installs browser extensions on a machine.

Microsoft Entra ID Identity Protection

Why wrong: Microsoft Entra ID Identity Protection analyzes identity risk indicators such as leaked credentials, impossible travel, and anonymous IP addresses to trigger automated remediation like requiring MFA or blocking sign-in. It operates purely on authentication events and identity risk signals, not on device configuration or installed software. Browser extension installation is an endpoint setting, which lies outside the scope of an identity-driven risk engine, making it an incorrect tool for this requirement.

Customer Lockbox

Why wrong: Customer Lockbox provides a customer approval workflow before Microsoft support personnel can access content stored in Microsoft 365, but it only gates access for Microsoft-side troubleshooting — it does not change the underlying encryption model. The encryption keys remain managed by Microsoft, so the compliance officer cannot use Lockbox to ensure that Microsoft never possesses the keys. In short, it addresses transparency and oversight of support access, not decentralized encryption key ownership.

Information Rights Management (IRM)

Why wrong: Information Rights Management (IRM), built on Azure Information Protection, encrypts files and applies usage policies such as preventing copying, forwarding, or printing, but the tenant's root encryption key is held by Microsoft in its key management service. While IRM can restrict what users do with content, the compliance officer cannot force exclusion of Microsoft from the key hierarchy because the encryption keys are orchestrated and recoverable by Microsoft in the tenant. IRM is therefore a policy-enforcement and rights-protection tool, not a way to deny Microsoft access to the data.

Microsoft Purview Data Lifecycle Management

Why wrong: Microsoft Purview Data Lifecycle Management addresses retention, records declaration, and deletion of content based on policies, ensuring data is kept only as long as the organization requires. It does not introduce a separate customer-controlled decryption key or alter who can decrypt the underlying data, because data at rest in Exchange, SharePoint, and OneDrive is already encrypted by Microsoft-managed keys. The compliance officer's focus on Microsoft's ability to access data is outside the scope of lifecycle management, which governs when data should expire, not who holds the cryptographic secrets.

Require MFA for all users

Why wrong: This policy enforces multi-factor authentication at sign-in, but it treats all devices the same: both Intune-compliant corporate devices and personal, unmanaged devices must pass MFA. It does not evaluate device health, enrollment, or compliance state, so a user on a non-compliant personal device can still authenticate with MFA and download sensitive files. Because it lacks conditional access conditions and session controls, it cannot satisfy the requirement to block downloads from unmanaged devices.

Block access from unknown locations

Why wrong: Blocking access from unknown locations relies on IP-based named locations and geopolitical boundaries, not on whether the endpoint is managed or compliant. A user connecting from a known office or home IP on an unmanaged personal device would pass the location check and still be able to access and download sensitive data. It also provides no session-level controls to prevent data exfiltration from a browser or desktop session, so it does not meet the stated requirements.

App protection policies

Why wrong: App protection policies (MAM) govern data handling within mobile applications, such as disabling copy/paste, preventing 'save as,' or controlling access to corporate data in Outlook mobile. However, they are limited to supported mobile apps and do not enforce MFA at the moment of sign-in, nor do they apply to browser-based access to SharePoint/Exchange or desktop apps like Word/Excel. Their focus is mobile app data-loss prevention rather than device-level compliance or conditional access gating, leaving unmanaged browser sessions unprotected.

Conditional Access policy with session control

Why wrong: A Conditional Access session control, such as sign-in frequency or session persistence, governs what happens after a user successfully signs in—for example, how long they can remain signed in or whether their session is restricted to specific apps. It does not include a built-in terms-of-use acceptance mechanism, and requiring users to accept an agreement before accessing Teams cannot be implemented with a session control. You would need a Conditional Access grant control that references a Microsoft Entra ID Terms of Use agreement, not a session control.

Microsoft Entra ID Identity Protection

Why wrong: Microsoft Entra ID Identity Protection focuses on automating the detection and remediation of identity-based risks, such as leaked credentials, impossible travel, or anomalous behavior, and it can trigger responses like requiring MFA, blocking sign-in, or requesting a password change. It does not provide a workflow for end users to accept organizational policies like terms of use, nor does it record a user's consent to an agreement. While risk-based policies complement access controls, they do not replace the need for an explicit, auditable terms-of-use acceptance before a guest user enters Teams.

Privileged Identity Management

Why wrong: Privileged Identity Management (PIM) is designed for just-in-time activation of administrative roles such as Global Administrator or Exchange Administrator, with time-bound assignments, approvals, and audit history for elevated role usage. PIM does not apply to standard guest users who are simply accessing Teams; its entire workflow is tied to privileged-role activation, not to a general terms-of-use acceptance flow. Consequently, PIM would neither enforce nor track a guest user's agreement to your terms of use, and it is not a substitute for a dedicated consent mechanism.

Audit (Standard)

Why wrong: Audit (Standard) records user and administrator activities, such as sign-ins, configuration changes, and mailbox operations, into a searchable log. However, it is a passive monitoring feature: it does not include a workflow to identify recent role assignments, schedule a recurring review, or require approval of changes by an additional reviewer. It therefore fails the requirement for a monthly review process and only provides forensic evidence after the fact.

Audit (Premium)

Why wrong: Audit (Premium) extends the standard logging with higher data retention, generation of smart insights, and access to additional events like mailed items and Teams message content, and it can expose earlier activity for security investigations. Yet this added telemetry is still solely an auditing and detection layer; it lacks the governance capability to define a recurring monthly review of privileged role assignments. Thus, while more powerful for incident analysis, it does not offer the access review workflow needed to approve or reject role changes.

Privileged Access Management

Why wrong: Privileged Access Management (PAM) is designed for just-in-time temporary elevation to specific administrative tasks, such as breaking the glass in an emergency, and requires approval for each activation request on a per-task basis. It is not a tool for the ongoing, monthly recertification of all role memberships; once the elevated access expires, the underlying standing role assignments remain unchanged. Therefore, PAM addresses protection against over-exposure of credentials but does not satisfy the requirement for recurring reviews of role changes.

Microsoft Purview Audit (Standard)

Why wrong: Microsoft Purview Audit (Standard) captures the same core admin and user events as Premium, but it only retains audit logs for 90 days and does not provide the ability to create custom alert policies. While an organization could manually search these logs for threshold conditions, the absence of custom alert rules means it cannot proactively notify administrators of specific admin actions like changing mailbox permissions or adding global admins. To satisfy the requirement for both audit logging and custom alerting, a Premium license must be used.

Microsoft Purview Compliance Manager

Why wrong: Microsoft Purview Compliance Manager is a risk-based compliance scoring and assessment tool that maps Microsoft 365 controls against regulatory standards like GDPR and ISO 27001. It does not capture or store audit logs of admin actions, nor can it generate alerts based on specific events occurring in the tenant. Its role is to help an organization understand compliance posture, not to provide operational auditing or alerting, so it cannot satisfy the requirement to be notified when a privilege is changed.

Microsoft 365 Defender portal

Why wrong: The Microsoft 365 Defender portal (security.microsoft.com) is a security operations hub that centralizes incident detection, investigation, and response across endpoints, email, identities, and cloud apps. While it does support alert policies, these are designed for threat-related signals like malware, phishing, or risky sign-ins, not for auditing every admin action performed in Microsoft Purview. Audit logging and the ability to define custom alert rules on pure administrative audit events belong to Microsoft Purview Audit (Premium), so the Defender portal cannot be used as the sole mechanism for this compliance requirement.

Microsoft Purview eDiscovery (Premium)

Why wrong: Microsoft Purview eDiscovery (Premium) is designed for legal discovery and litigation, enabling you to search, collect, and export content such as emails, documents, and chats from mailboxes, SharePoint sites, and Teams. It does not capture or expose activity audit logs, so you cannot use it to identify that a user downloaded a file or to review a sequence of user actions. Its purpose is to find the content itself based on queries and place it on hold for legal review, not to analyze operational activities. Thus it is not suitable for this security investigation.

Microsoft Purview Communication Compliance

Why wrong: Microsoft Purview Communication Compliance is a supervision solution that monitors electronic communications like email, Microsoft Teams chats, and third-party sources for policy violations such as offensive language, harassment, or sharing sensitive information in messages. It applies machine-learning-based classifiers and policies to detect inappropriate or non-compliant content within communications, but it does not audit general user activities like file downloads outside of message attachments. While a downloaded file could be mentioned in a communication, this tool does not provide a comprehensive activity log of every file access or download event, making it irrelevant to the analyst's alert.

Microsoft Purview Data Loss Prevention (DLP)

Why wrong: Microsoft Purview Data Loss Prevention (DLP) protects sensitive data by enforcing policies that inspect content for predefined patterns (e.g., credit card numbers, PII) and automatically block or alert on actions such as copying or sending that data, often at the endpoint or in cloud apps. It is proactive and policy-driven, operating in real time to prevent leakage, but it does not maintain a historical audit log of all user downloads of files, especially non-sensitive files. The alert about a user who 'downloaded' something may not involve sensitive data, and DLP's actions would only trigger on matching content types, not on generic download events across the environment. Therefore, DLP cannot provide the retrospective evidence needed for this investigation.

Microsoft Purview compliance portal

Why wrong: The Microsoft Purview compliance portal is centered on regulatory and compliance workflows such as eDiscovery, data classification, and audit log search. Its audit log records changes captured by unified audit, but it does not present the full interactive and non-interactive sign-in event schema with fields like conditional access results, MFA outcomes, or risk indicators. For investigating potentially malicious sign-in attempts, an identity-focused log is required, not a compliance-oriented tool.

Microsoft 365 admin center

Why wrong: The Microsoft 365 admin center offers a management view of users, groups, and tenant health, and it shows only a limited summary of user sign-in activity on user detail pages. Detailed sign-in data—including filtering by date, application, or status, plus export capabilities and risk assessment—is available only from Microsoft Entra ID's Sign-in logs. Because the admin center is a management console, it is not the authoritative source for comprehensive sign-in investigation.

Microsoft Defender for Cloud Apps

Why wrong: Microsoft Defender for Cloud Apps is a CASB that provides usage analytics, anomaly detection, and app-to-app access controls across multiple cloud providers. It consumes and enriches underlying sign-in data from Microsoft Entra ID to generate risk-based alerts, but it does not produce or store the original sign-in log entries. When the requirement is to 'review all sign-in attempts' at the directory level, the source of record remains Entra ID's Sign-in logs rather than Defender's aggregated view.

Microsoft Purview Audit (Standard)

Why wrong: Microsoft Purview Audit (Standard) does capture administrative activity in the unified audit log, but it retains records for only 90 days, which is far shorter than the one-year retention offered by Premium. Moreover, it lacks the ability to create custom alert policies, so security teams would have to manually search and review logs instead of being proactively notified. These limitations mean Standard cannot fulfill both the retention and monitoring requirements as effectively as Premium.

Microsoft Defender for Cloud Apps

Why wrong: Microsoft Defender for Cloud Apps is primarily a service for shadow IT discovery, app governance, and anomaly detection across cloud applications, rather than a native auditing solution for Microsoft 365 administrative actions. While it can generate alerts on suspicious user or admin behavior, it does not provide the comprehensive, tamper-evident audit log that captures all admin activities across Exchange, SharePoint, and Teams. Furthermore, it does not offer the same compliance-grade log retention or deep integration with Microsoft Purview's auditing capabilities.

Microsoft Entra ID reporting

Why wrong: Microsoft Entra ID reporting only captures identity-related events, such as sign-in logs, user provisioning, and password changes, and does not extend to administrative actions performed within other Microsoft 365 workloads like Exchange, SharePoint, or Teams. Since those service-level admin activities are entirely absent from Entra ID logs, this option cannot give complete coverage of all administrative activities. It would leave significant gaps, making it unsuitable for the security team's monitoring needs.

Microsoft Planner

Why wrong: Microsoft Planner is a task and project management tool within Microsoft 365, designed to organize work into plans and assignments. It does not offer any authentication or conditional access controls, nor does it enforce security policies like multi-factor authentication. Therefore, any requirement for an additional verification factor during sign-in cannot be satisfied by Planner, as it operates at the application layer without interacting with identity security.

Microsoft Forms

Why wrong: Microsoft Forms is an online survey and quiz creation tool that allows users to collect responses via forms or polls. It does not provide any identity verification, sign-in security, or access control mechanisms; anyone with the link can respond unless specific settings are applied, and those settings still do not enforce MFA. Consequently, Forms cannot fulfill a security or compliance requirement for multi-factor authentication, as it is purely a data-collection service with no authentication authority.

Microsoft Stream

Why wrong: Microsoft Stream is a video hosting and sharing service where organizations upload, manage, and stream video content. It focuses on media management and playback permissions, but it does not implement or enforce security verifications like MFA; access to Stream is governed by the underlying Azure AD authentication, not by Stream itself. Thus, Stream is irrelevant to a help desk requirement for stronger sign-in security, because it cannot independently add a second authentication factor or enforce conditional access policies.

Microsoft Stream

Why wrong: Microsoft Stream is a video hosting and sharing service within Microsoft 365, designed primarily for storing, managing, and playing recorded video content. While it does offer some compliance features like retention labels or eDiscovery of video files, it does not provide any capability to evaluate sign-in conditions or enforce MFA or device-based access policies. Therefore, it cannot fulfill the requirement of implementing conditional access controls for identity and resource protection.

Microsoft Planner

Why wrong: Microsoft Planner is a lightweight task and project management application in Microsoft 365, used to create plans, organize tasks, and assign work items within teams using boards and buckets. Its purpose is operational productivity, not security or compliance enforcement; it contains no mechanisms to inspect authentication requests, enforce multi-factor authentication, or restrict resource access based on user location or device state. Thus, it is not a suitable tool for the compliance administrator's access-control requirement.

Microsoft Forms

Why wrong: Microsoft Forms is a data collection service used to create surveys, quizzes, and polls, with responses stored in Excel or SharePoint. Although it may support basic permissions for who can submit or view forms, it does not function as an identity management or policy system; it cannot apply conditional access rules such as blocking access from certain locations or requiring a compliant device. Therefore, it lacks the technical capability needed for this compliance-focused access requirement.

Microsoft Planner

Why wrong: Planner is a Kanban-style task and project management app in Microsoft 365, used to assign work, track progress, and collaborate on plans. It does not include any capability to enforce conditional access policies, manage user identities, or govern who can sign in to Microsoft 365 resources. Therefore, it cannot satisfy a requirement for identity-based access management.

Microsoft Forms

Why wrong: Forms is for creating surveys, quizzes, and polls, collecting data in Excel, and analyzing responses. Although it has some data-retention settings and access via sharing links, it does not act as an identity provider or control authentication and authorization for Microsoft 365. So it is not the service to implement when the need is centralized identity and access management.

Microsoft Stream

Why wrong: Stream is a video management service for uploading, organizing, and sharing recorded meetings, training sessions, and other video content. It relies on Microsoft 365 permissions and Entra ID for authentication, but it does not itself provide identity verification or access control policies. Thus, Stream is irrelevant to a requirement for controlling how users sign in to Microsoft 365.

Microsoft Planner

Why wrong: Microsoft Planner is a Microsoft 365 project management tool used to organize tasks into plans, buckets, and assignments. It has no identity or authentication monitoring functions, so it does not evaluate user activities, detect compromised accounts, or identify risky sign-ins; therefore it is not a security control for this requirement.

Microsoft Stream

Why wrong: Microsoft Stream is a Microsoft 365 video hosting service that lets users upload, share, and transcribe video content. It does not process sign-in events, IP addresses, authentication anomalies, or user risk scores, and therefore has no capability to detect risky identity behavior.

Microsoft Forms

Why wrong: Microsoft Forms is a survey, questionnaire, and quiz application that captures user responses to emails or SharePoint files. It is not an identity security product and contains no risk-detection algorithms, so it cannot identify whether an account is risky or whether a sign-in attempt is compromised.

Microsoft Planner

Why wrong: Microsoft Planner is a cloud-based task and project management application within Microsoft 365, used by teams to create plans, assign tasks, and track progress. It operates in the productivity and collaboration domain and has no connection to Azure AD identity verification, password management, or user account security. Therefore, deploying Planner would not give users the ability to reset their own passwords, so it cannot satisfy the stated requirement.

Microsoft Stream

Why wrong: Microsoft Stream is an enterprise video hosting service that stores and streams recordings, like meetings and training videos, across an organization. It does not interact with authentication protocols or directory settings; its role is content distribution, not identity security. Since the need is for a user-driven password reset capability, Stream is irrelevant and fails to address any aspect of the requirement.

Microsoft Forms

Why wrong: Microsoft Forms is a lightweight survey, quiz, and polling tool used to gather user feedback. While it can be embedded in Teams and supports some sharing permissions, it cannot query Azure AD authentication methods or issue password resets. Its purpose is data collection, not user identity management, so choosing Forms would leave users unable to self-recover their passwords.

Microsoft Stream

Why wrong: Stream hosts video content and does not meet this requirement.

Microsoft Planner

Why wrong: Planner manages tasks and does not provide this security or compliance control.

Microsoft Forms

Why wrong: Forms creates surveys and quizzes, not this security or compliance capability.

Microsoft Planner

Why wrong: Microsoft Planner is a task management tool for organizing work into boards and buckets, assigning tasks, and tracking due dates. It does not provide security or compliance controls such as conditional access, data loss prevention, or app-level protection, and it cannot enforce policies on managed or unmanaged devices. Therefore, Planner is not a valid solution for the stated security/compliance requirement.

Microsoft Forms

Why wrong: Microsoft Forms is designed to create surveys, quizzes, and polls, collecting user responses in an online form. It does not offer mobile application management, data loss prevention, or conditional access policy enforcement for Office 365 apps. The security features available, such as anti-phishing settings, are unrelated to the app-level data protection required by this scenario.

Microsoft Stream

Why wrong: Microsoft Stream is a video hosting and sharing service within Microsoft 365, focused on uploading, storing, and playing video content across an organization. It does not provide mobile application management or app-level security policies such as PIN or managed app restrictions. Its built-in governance and access controls apply to the video library itself, not to managing or protecting corporate data on mobile apps, making it irrelevant to this adoption plan requirement.

Microsoft Planner

Why wrong: Microsoft Planner is a task management application for organizing teamwork, where you assign tasks and track progress on boards. It does not perform content inspection or apply data classification policies, so it cannot detect credit card numbers, personal data, or other sensitive information. Its security model is limited to permissions for accessing plans, which does not meet the requirement to prevent unauthorized sharing of sensitive data.

Microsoft Stream

Why wrong: Microsoft Stream is a video hosting and sharing service within Microsoft 365, primarily used to store and play back recorded meetings, lectures, and presentations. While Stream applies standard permissions and access controls, it does not scan video content or associated metadata for sensitive data patterns, nor does it enforce data loss prevention policies across other workloads. Its purpose is media management, not the detection and blocking of data leakage, so it is not a valid solution for this requirement.

Microsoft Forms

Why wrong: Microsoft Forms is an application for designing surveys, quizzes, and polls, and for collecting user responses. It does not include a policy engine to analyze submitted data for sensitive information, and it lacks the ability to apply DLP actions such as blocking or warning when a user tries to share confidential data. Although Forms has some access controls, it cannot meet the stated need for a DLP control, so it is an incorrect choice.