SC-200 Respond to security incidents Practice Question
An organization uses Microsoft Purview Communication Compliance to detect insider trading. An alert is generated for a user who sent a message containing sensitive financial data. The compliance officer needs to initiate a legal hold on the user's mailbox to preserve evidence. Which role must the officer have to perform this action?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eDiscovery Manager (Legal Hold)
Legal hold requires the 'Legal Hold' role in Microsoft Purview (eDiscovery). Communication Compliance roles alone do not include hold capabilities. Exchange Online roles may not have cross-functional hold.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Communication Compliance admin
Why it's wrong here
This role is designed to manage communication compliance policies, which scan for inappropriate messages, but it does not grant the legal hold capability. Legal hold requires the eDiscovery Manager role with the Legal Hold sub-role specifically. Communication Compliance admin is narrowly scoped to compliance monitoring and not to litigation holds.
- ✗
Compliance Administrator (Global)
Why it's wrong here
While this is a broad role that manages compliance features across Microsoft 365, it does not include the specific 'Legal Hold' permission needed to place a mailbox on hold. Microsoft recommends using the least-privileged eDiscovery role for holds, and the Compliance Administrator role lacks the granular legal hold sub-role.
- ✓
eDiscovery Manager (Legal Hold)
Why this is correct
The eDiscovery Manager role group has a sub-role for Legal Hold that specifically allows managing holds on mailboxes and sites. This is the required identity to place a mailbox on hold in the Microsoft Purview compliance portal. Without this sub-role, even other eDiscovery roles cannot place holds.
- ✗
Exchange Online Mailbox Search role
Why it's wrong here
This role grants the ability to perform mailbox content searches but does not include the permission to place a hold. Legal holds are a separate compliance capability managed through eDiscovery, not via a search-specific role. This role may be used to find content but cannot preserve it.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 1,303-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.