Courseiva

CCNA Describe the capabilities of Microsoft compliance solutions Questions

75 of 302 questions · Page 1/5 · Describe the capabilities of Microsoft compliance solutions · Answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' label to documents that contain salary information. Which type of sensitivity label configuration should you use?

A.Manual labeling
B.Auto-labeling with sensitive information types
C.Default labeling for SharePoint libraries
D.Mandatory labeling policy
AnswerB

Auto-labeling policies in Microsoft Purview are designed to automatically detect specific content within documents and emails, such as financial data or personally identifiable information, by using sensitive information types (SITs). When a defined SIT or condition is met, the policy automatically applies the corresponding sensitivity label without requiring any user interaction. This method is ideal for consistent, content-based data classification across an organization.

Why this answer

Auto-labeling with sensitive information types allows Microsoft Purview to automatically apply a 'Confidential' label to documents containing salary information based on predefined patterns, such as employee salary data. This configuration uses content scanning to detect sensitive data (e.g., via built-in or custom sensitive information types) and applies the label without user intervention, meeting the requirement for automatic classification.

Exam trap

The trap here is confusing auto-labeling with default labeling or mandatory labeling policies, as candidates may think a default label or a policy requiring user input can achieve automatic content-based labeling, but only auto-labeling with sensitive information types performs dynamic content scanning.

How to eliminate wrong answers

Option A is wrong because manual labeling requires users to apply labels themselves, which does not meet the requirement for automatic application. Option C is wrong because default labeling for SharePoint libraries applies a label to all documents in a library by default, but it does not dynamically detect salary information; it applies a static label regardless of content. Option D is wrong because mandatory labeling policy requires users to select a label when saving or sharing documents, but it does not automatically apply a specific label based on content detection.

Practice this question →
2
MCQmedium

A company has been fined for failing to respond to a data subject access request (DSAR) within the required timeframe. The compliance team needs to streamline the process of identifying and exporting personal data when a DSAR is received. Which Microsoft Purview solution should they use?

A.Microsoft Purview Compliance Manager
B.Microsoft Purview Communication Compliance
C.Microsoft Purview eDiscovery (Premium)
D.Microsoft Purview Data Lifecycle Management
AnswerC

Microsoft Purview eDiscovery (Premium) provides advanced capabilities specifically designed for identifying, preserving, collecting, processing, reviewing, analyzing, and exporting content in response to legal, regulatory, or internal investigations, which explicitly includes Data Subject Access Requests (DSARs). Its comprehensive toolset allows for targeted searches across diverse data sources, intelligent review workflows, and secure export of relevant data, making it the ideal solution for efficiently fulfilling such obligations.

Why this answer

Microsoft Purview eDiscovery (Premium) provides advanced search, hold, and export capabilities for responding to DSARs. Data Lifecycle Management handles retention. Communication Compliance monitors communications.

Compliance Manager assesses compliance posture but does not handle DSAR workflows.

Practice this question →
3
MCQmedium

A financial services company needs to monitor employee communications in Microsoft Teams and Exchange Online for potential policy violations, such as sharing insider trading tips. They want to automatically detect specific keywords and phrases, and then allow designated reviewers to flag and escalate the messages. Which Microsoft Purview solution should they use?

A.Microsoft Purview Communication Compliance
B.Microsoft Purview Data Lifecycle Management
C.Microsoft Purview Information Barriers
D.Microsoft Purview eDiscovery
AnswerA

Microsoft Purview Communication Compliance proactively identifies and remediates code-of-conduct policy violations and regulatory compliance risks within an organization's communications. It leverages machine learning and customizable policies to detect inappropriate content, sensitive information sharing, or potential insider trading across various communication channels, enabling organizations to monitor employee conduct effectively.

Why this answer

Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in communications like Microsoft Teams chats and Exchange Online emails. It uses customizable policies to automatically scan for sensitive keywords and phrases (e.g., insider trading terms), and then routes flagged messages to designated reviewers for investigation, flagging, and escalation. This aligns directly with the requirement to monitor employee communications for policy violations and enable reviewer workflows.

Exam trap

The trap here is that candidates often confuse Communication Compliance with eDiscovery, assuming eDiscovery can proactively monitor and flag messages, but eDiscovery is reactive and designed for legal holds and searches, not real-time policy violation detection and review workflows.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Data Lifecycle Management focuses on retaining, deleting, and managing data based on lifecycle policies, not on monitoring communications for policy violations or keyword detection. Option C is wrong because Microsoft Purview Information Barriers are used to prevent communication and collaboration between specific groups (e.g., to avoid conflicts of interest), but they do not scan for keywords or provide a review workflow for policy violations. Option D is wrong because Microsoft Purview eDiscovery is designed for legal discovery and litigation support, allowing search and export of content, but it does not proactively monitor communications in real-time or automatically flag policy violations for review.

Practice this question →
4
MCQmedium

A company uses Microsoft 365 and needs to identify and protect sensitive data, such as credit card numbers, stored in SharePoint Online and OneDrive for Business. They also want to prevent users from sharing this data externally. Which Microsoft Purview solution should they use?

A.Data Loss Prevention (DLP)
B.Data Lifecycle Management (DLM)
C.Information Protection (sensitivity labels)
D.Audit (Standard)
AnswerA

Correct. DLP policies can identify sensitive data such as credit card numbers and automatically block actions like sharing externally. It also provides policy tips to educate users.

Why this answer

Data Loss Prevention (DLP) in Microsoft Purview is the correct solution because it is specifically designed to identify, monitor, and automatically protect sensitive data like credit card numbers (using built-in sensitive information types such as Credit Card Number) across Microsoft 365 services, including SharePoint Online and OneDrive for Business. DLP policies can enforce rules to block or restrict external sharing of such data, directly meeting the requirement to prevent users from sharing sensitive data externally.

Exam trap

The trap here is that candidates often confuse Information Protection (sensitivity labels) with DLP, assuming labels alone can prevent external sharing, but labels require DLP policies to enforce sharing restrictions based on the label's classification.

How to eliminate wrong answers

Option B (Data Lifecycle Management) is wrong because it focuses on retaining, deleting, or archiving data based on lifecycle policies (e.g., retention tags, expiration dates), not on identifying or preventing the sharing of sensitive content. Option C (Information Protection with sensitivity labels) is wrong because while sensitivity labels can classify and protect data with encryption or visual markings, they do not natively include the ability to scan for specific data patterns like credit card numbers or enforce external sharing blocks without being combined with DLP policies. Option D (Audit Standard) is wrong because it only provides logging and visibility into user activities (e.g., who accessed or shared a file), but does not actively identify sensitive data or prevent sharing.

Practice this question →
5
MCQmedium

Refer to the exhibit. You run the PowerShell command to search the unified audit log for file deletions. The command returns no results, but you know a file was deleted last week. What is the most likely reason?

A.The operation name 'FileDeleted' is incorrect
B.Audit logging is not enabled for the organization
C.Audit logs are only retained for 90 days
D.The StartDate and EndDate are incorrect
AnswerB

The Microsoft 365 unified audit log is not enabled by default for all organizations; it requires explicit activation by an administrator within the Microsoft 365 compliance center or via PowerShell. If audit logging has not been enabled, no audit records are collected or stored, meaning any search, regardless of correct parameters, will return an empty result set. This fundamental prerequisite is essential for any audit data to be available.

Why this answer

The most likely reason is that audit logging is not enabled for the organization. In Microsoft 365, unified audit log search requires that audit logging be explicitly turned on (by default, it is enabled for most tenants, but it can be disabled). If audit logging is disabled, no audit records are generated, so any search—including for 'FileDeleted' operations—will return no results, even if files were actually deleted.

Exam trap

The trap here is that candidates assume the operation name is incorrect or that the date range is wrong, but the core issue is that audit logging must be enabled as a prerequisite for any audit record generation.

How to eliminate wrong answers

Option A is wrong because 'FileDeleted' is a valid operation name in the unified audit log for file deletions in SharePoint Online and OneDrive for Business. Option C is wrong because audit logs are retained for 90 days for most subscriptions (and up to 1 year with appropriate licensing), so a deletion from last week would still be within the retention period. Option D is wrong because the StartDate and EndDate parameters are used to filter results; if they were incorrect, the command would still return results for other time ranges or show an error, not return zero results when a deletion is known to have occurred.

Practice this question →
6
MCQhard

A multinational corporation has data stored across multiple clouds (Azure, AWS) and on-premises. The data governance team needs to create a single inventory of all data assets, automatically classify sensitive data (e.g., credit card numbers) across these sources, and track how data moves and transforms (lineage). Which Microsoft Purview solution should they use?

A.Microsoft Purview Data Map
B.Microsoft Purview Compliance Manager
C.Microsoft Purview Data Lifecycle Management
D.Microsoft Purview eDiscovery
AnswerA

The Microsoft Purview Data Map is the foundational component for discovering and cataloging an organization's data assets across hybrid and multi-cloud environments. It automatically scans data sources, applies built-in and custom classifiers to identify sensitive information, and maps data lineage to show how data transforms and moves. This unified inventory provides a comprehensive understanding of data locations, types, and relationships, which is crucial for effective data governance and compliance in a multinational corporation.

Why this answer

Microsoft Purview Data Map is the correct solution because it provides a unified map of data assets across multi-cloud (Azure, AWS) and on-premises sources, supports automated sensitive data classification (e.g., credit card numbers via built-in classifiers), and tracks data lineage to show how data moves and transforms. This directly meets the requirements for a single inventory, classification, and lineage tracking.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Data Map with Data Lifecycle Management, thinking both handle data classification, but Data Map specifically provides the unified inventory and lineage tracking across hybrid and multi-cloud environments, while Data Lifecycle Management only handles retention and deletion policies.

Why the other options are wrong

B

Compliance Manager is for assessing and managing compliance postures against regulations, not for creating a data inventory, classifying sensitive data across multiple clouds, or tracking data lineage.

C

Microsoft Purview Data Lifecycle Management focuses on retention, deletion, and governance of data over its lifecycle, not on creating a unified inventory, automatic classification of sensitive data across multiple clouds, or tracking data lineage.

D

Microsoft Purview eDiscovery is designed for legal discovery of content across Microsoft 365 services, not for creating a data inventory, classifying sensitive data across multi-cloud and on-premises sources, or tracking data lineage.

Practice this question →
7
MCQhard

A company wants to proactively detect and investigate potential insider security risks, such as a departing employee copying large amounts of data to a personal USB drive or sharing confidential files with unauthorized individuals. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management
B.Insider Risk Management
C.Communication Compliance
D.eDiscovery (Standard)
AnswerB

Microsoft Purview Insider Risk Management is specifically designed to identify, analyze, and act on potentially risky activities by users within the organization, whether malicious or inadvertent. It leverages machine learning and adaptive policies to correlate various signals, such as unusual file access, email forwarding, or USB device usage, to proactively detect and investigate potential insider security threats. This solution provides comprehensive tools for risk scoring, alert management, and forensic investigation of user behaviors to prevent data exfiltration or misuse.

Why this answer

Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on risky user activities that may lead to data security incidents, such as unauthorized data exfiltration by departing employees. It uses predefined and customizable policies to correlate signals from Microsoft 365 logs (e.g., copying files to USB, sharing with external users) and applies risk-scoring to prioritize alerts. This makes it the correct solution for proactively identifying potential insider threats like bulk data copying or unauthorized file sharing.

Exam trap

The trap here is that candidates often confuse Communication Compliance (which monitors communications) with Insider Risk Management (which monitors risky user behavior and data actions), leading them to select Communication Compliance when the scenario explicitly describes data exfiltration actions rather than communication violations.

How to eliminate wrong answers

Option A (Data Lifecycle Management) is wrong because it focuses on retaining, deleting, and managing data based on compliance or business requirements, not on detecting user behavior or insider threats. Option C (Communication Compliance) is wrong because it is designed to monitor communications (emails, Teams chats) for policy violations like harassment or inappropriate sharing, but it does not detect data exfiltration actions such as copying to USB drives. Option D (eDiscovery Standard) is wrong because it is used for searching and exporting content for legal or investigative purposes after an incident has been identified, not for proactive detection of risky user behavior.

Practice this question →
8
MCQeasy

An organization uses Microsoft Purview Communication Compliance. They need to monitor Microsoft Teams messages for potential insider trading language. What should they configure?

A.An eDiscovery case
B.A Communication Compliance policy
C.A Data Loss Prevention policy
D.A sensitivity label policy
AnswerB

Microsoft Purview Communication Compliance is specifically designed to help organizations detect, investigate, and act on inappropriate messages within their Microsoft 365 environment. It uses intelligent templates and machine learning to identify potential policy violations, such as harassment, threats, or regulatory non-compliance, across various communication channels like Microsoft Teams, Exchange Online, and Yammer. This proactive monitoring capability directly addresses the need to ensure appropriate communication conduct and foster a respectful workplace.

Why this answer

B is correct because Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate or policy-violating communications, including insider trading language in Microsoft Teams messages. By configuring a Communication Compliance policy, the organization can define custom conditions (e.g., keywords, patterns, or classifiers) to scan Teams chats and channels for prohibited financial language, enabling automated alerts and remediation workflows.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention (DLP), mistakenly thinking DLP can monitor for language patterns when DLP is actually focused on preventing data exfiltration, not analyzing conversation content for prohibited phrases.

How to eliminate wrong answers

Option A is wrong because an eDiscovery case is used for legal hold, search, and export of content in litigation or investigation scenarios, not for proactive, real-time monitoring of communications for policy violations like insider trading. Option C is wrong because a Data Loss Prevention (DLP) policy is designed to prevent accidental or unauthorized sharing of sensitive information (e.g., credit card numbers, PII) by blocking or warning users, not to monitor conversations for specific language patterns. Option D is wrong because a sensitivity label policy applies classification and protection labels (e.g., encryption, visual markings) to documents and emails, but it does not scan or analyze message content for prohibited language in Teams communications.

Practice this question →
9
Multi-Selecteasy

Which TWO of the following are Microsoft Purview solutions that help protect sensitive data?

Select 2 answers
A.Communication Compliance
B.eDiscovery
C.Data Loss Prevention (DLP)
D.Sensitivity labels
E.Insider Risk Management
AnswersC, D

Microsoft Purview Data Loss Prevention (DLP) is a critical solution for protecting sensitive information by identifying, monitoring, and automatically preventing its unauthorized sharing or transfer both within and outside the organization. DLP policies detect sensitive data types (e.g., PII, financial data) across various Microsoft 365 services and endpoints, enforcing actions like blocking sharing, notifying users, or encrypting content to ensure compliance and prevent data exfiltration. This directly addresses data protection by controlling data flow.

Why this answer

Data Loss Prevention (DLP) is a Microsoft Purview solution that helps protect sensitive data by identifying, monitoring, and automatically enforcing policies to prevent accidental or unauthorized sharing of sensitive information such as credit card numbers, social security numbers, or health records across services like Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are another Purview solution that protect sensitive data by allowing administrators to classify and apply protection (encryption, visual markings) to documents and emails, and enforce controls like 'Do Not Forward' or 'Encrypt-Only' based on the label's configuration.

Exam trap

The trap here is that candidates often confuse 'detecting risky behavior' (Insider Risk Management) or 'monitoring communications' (Communication Compliance) with 'protecting sensitive data', when only DLP and Sensitivity labels directly enforce classification and protection controls on the data itself.

Practice this question →
10
MCQhard

A law firm uses Microsoft 365. They must retain all client communication records for 10 years due to regulatory requirements. After 10 years, the records must be permanently deleted. Additionally, they need to ensure that users cannot permanently delete these records before the retention period ends. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Lifecycle Management
B.Microsoft Purview Records Management
C.Microsoft Purview eDiscovery
D.Microsoft Purview Audit
AnswerB

Correct. Records Management allows you to declare items as records, which locks them against deletion and editing, and then apply retention and disposition settings.

Why this answer

Microsoft Purview Records Management is the correct solution because it allows the law firm to apply retention labels that mark content as a regulatory record, which prevents users from permanently deleting the records before the retention period ends. It also supports disposition review and permanent deletion after the specified 10-year retention period, meeting both the retention and deletion requirements.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (which handles general retention and deletion) with Records Management (which adds the critical 'regulatory record' lock to prevent user deletion), so they incorrectly choose Option A.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management focuses on managing the lifecycle of data (e.g., automatically deleting or archiving content based on retention policies) but does not provide the ability to lock records as regulatory records to prevent user deletion; it lacks the 'records declaration' capability. Option C is wrong because Microsoft Purview eDiscovery is designed for searching, holding, and exporting content for legal or investigative purposes, not for enforcing retention or deletion schedules. Option D is wrong because Microsoft Purview Audit provides logging and monitoring of user activities (e.g., who deleted a record) but does not prevent deletion or enforce retention periods.

Practice this question →
11
MCQmedium

An organization wants to automatically retain emails for 7 years and then delete them. They also need to place a legal hold on specific users' mailboxes to preserve all emails during litigation. Which combination of Microsoft Purview features should they use?

A.Retention labels and eDiscovery
B.Retention policies and Litigation Hold
C.Data Lifecycle Management and Audit
D.Records Management and Data Loss Prevention
AnswerB

Retention policies are designed to automatically apply retention and deletion rules across entire locations, such as all Exchange mailboxes, directly addressing the requirement to "automatically retain emails for 7 years and then delete them." Litigation Hold, on the other hand, is a specific feature within Exchange Online that preserves all content in a user's mailbox indefinitely or for a specified period, overriding any retention policy deletions, to meet legal or compliance obligations. This combination effectively handles both automated lifecycle management and specific legal preservation.

Why this answer

For automatic retention and deletion, Retention policies in Microsoft Purview are ideal as they apply to entire mailboxes. To preserve emails for litigation, Litigation Hold can be enabled on specific user mailboxes, ensuring that no emails are deleted or altered. The combination of these two features meets both requirements.

Practice this question →
12
MCQeasy

Your organization uses Microsoft Purview Communication Compliance to detect potential policy violations in Microsoft Teams chats. Which action can the policy automatically take when a violation is detected?

A.Revoke the user's access to Microsoft Teams
B.Block the user from sending messages
C.Notify the user and their manager via email
D.Automatically delete the violating message
AnswerC

Communication Compliance policies are highly configurable to include automated remediation actions, and sending email notifications is a primary and effective method. When a policy violation is detected, the system can be configured to automatically send a notification to the user who sent the message, their manager, or other designated stakeholders. This action serves as an educational tool, a deterrent, and a formal record of the violation, aligning with the goal of promoting compliant behavior.

Why this answer

Microsoft Purview Communication Compliance is designed to detect and remediate policy violations, but it does not enforce access controls or modify message content directly. Instead, it can automatically notify the user and their manager via email as a configurable remediation action, allowing for human review and follow-up without disrupting communication flow.

Exam trap

The trap here is that candidates often assume Communication Compliance can enforce real-time controls like blocking or deleting messages, when in fact it is a detective and remediation tool that relies on notifications and human review rather than automated enforcement.

How to eliminate wrong answers

Option A is wrong because revoking a user's access to Microsoft Teams is an identity and access management action handled by Azure AD Conditional Access or Entra ID, not by Communication Compliance policies. Option B is wrong because blocking a user from sending messages is a real-time enforcement action that Communication Compliance does not support; it is designed for detection and remediation after the fact, not for preventing message delivery. Option D is wrong because automatically deleting the violating message would alter the audit trail and is not a built-in action in Communication Compliance; the platform focuses on alerting and escalation rather than content removal.

Practice this question →
13
MCQhard

Your organization uses Microsoft Purview to manage data classification. You need to ensure that a specific Azure Blob Storage account is automatically classified for sensitivity labels. Which step is required?

A.Register the storage account in Microsoft Purview Data Map and configure scanning
B.Create a sensitivity label and publish it to all users
C.Apply a DLP policy to the storage account
D.Enable Microsoft Purview Information Protection for Azure
AnswerA

Registering the storage account in the Purview Data Map and configuring scanning allows Purview to scan and automatically classify the data with sensitivity labels.

Why this answer

Microsoft Purview Data Map scans Azure Blob Storage and can auto-classify files based on built-in or custom classifiers. Option B is wrong because creating a sensitivity label and publishing it does not automatically classify the storage account; you need to register and scan it. Option C is wrong because DLP policies do not classify storage accounts directly.

Option D is wrong because 'enabling Microsoft Purview Information Protection for Azure' is not a required configuration step for automatic classification of a specific storage account; automatic classification relies on registering the storage account in Microsoft Purview Data Map and configuring a scan, then applying auto-labeling policies.

Practice this question →
14
MCQmedium

Your organization uses Microsoft Purview Data Lifecycle Management to retain data for regulatory compliance. You need to ensure that all documents in a SharePoint site are retained for 7 years after they are last modified. What should you create?

A.An auto-labeling policy
B.A data loss prevention policy
C.An adaptive scope based on last modified date
D.A static scope for the SharePoint site
AnswerC

Adaptive scopes can dynamically include content based on properties like last modified date.

Why this answer

To retain documents in a SharePoint site for 7 years after they are last modified, you need a retention policy with an adaptive scope that uses a query to target items based on the 'Last Modified' date. Adaptive scopes allow dynamic, attribute-based scoping (e.g., last modified date), which is required for this time-based retention trigger. A static scope would apply to all content in the site without the ability to filter by modification date.

Exam trap

The trap here is that candidates often confuse adaptive scopes with static scopes, assuming a static scope can filter by metadata like last modified date, but static scopes only apply to entire sites or folders without dynamic attribute-based filtering.

How to eliminate wrong answers

Option A is wrong because an auto-labeling policy automatically applies sensitivity or retention labels based on conditions, but it does not create a retention policy that retains items for a fixed period after modification; it labels content, which then must be paired with a retention label policy. Option B is wrong because a data loss prevention (DLP) policy is designed to prevent unauthorized sharing or leakage of sensitive data, not to enforce retention or deletion schedules based on last modified dates. Option D is wrong because a static scope for the SharePoint site would apply the retention policy to all content in the site without the ability to filter by last modified date, which is necessary to meet the 7-year retention requirement from the last modification.

Practice this question →
15
MCQhard

Refer to the exhibit. A Microsoft Purview Data Loss Prevention (DLP) policy is configured. What does this policy do?

A.It generates an alert if more than 10 emails with the Confidential label are sent to an external recipient.
B.It blocks all emails sent to external recipients with the Confidential label.
C.It prevents internal users from sending Confidential emails to each other.
D.It automatically applies the Confidential label to emails sent to external recipients.
AnswerA

This statement accurately describes the policy's behavior. The policy is configured to detect emails tagged with the 'Confidential' sensitivity label that are sent to external recipients. Crucially, it includes a threshold condition, triggering an alert only when the volume exceeds 10 such emails, indicating a potential bulk data exfiltration attempt rather than a single accidental share. This design allows for monitoring and investigation without immediately disrupting business operations for minor incidents.

Why this answer

The DLP policy rule shown in the exhibit specifies an action to 'Send an alert' when the condition 'Number of emails sent to external recipients with label Confidential exceeds 10' is met. This means the policy generates an alert (e.g., via email or incident report) when more than 10 emails containing the Confidential label are sent to external recipients, without blocking the emails.

Exam trap

Candidates often assume that any DLP policy that detects sensitive data sent externally will block the transmission. However, this policy is configured to generate an alert, not block, as shown by the alert action in the exhibit.

How to eliminate wrong answers

Option B is wrong because the policy does not include a 'Block' action; it only triggers an alert, so it does not block any emails. Option C is wrong because the condition explicitly targets 'external recipients,' not internal users, so internal-to-internal Confidential emails are not affected. Option D is wrong because the policy does not apply labels; it only reacts to emails that already have the Confidential label applied (likely via auto-labeling or manual assignment).

Practice this question →
16
MCQmedium

Refer to the exhibit. You are reviewing the results of a Microsoft Purview eDiscovery search. Which statement is correct about the search results?

A.The search returned results from both Exchange Online and SharePoint Online
B.The search only returned results from Exchange Online
C.The document is an email message
D.The email has an attachment
AnswerA

The exhibit clearly shows two distinct result types returned by the search. One result is an email message, which originates from an Exchange Online mailbox, as indicated by its typical content and format. The other result is a PowerPoint presentation (.pptx file), which is characteristically stored and retrieved from a document repository like SharePoint Online or OneDrive for Business within a Microsoft 365 environment. This demonstrates that the eDiscovery search successfully queried and retrieved relevant content from both Exchange Online and SharePoint Online.

Why this answer

The search results show items from both Exchange Online (email messages) and SharePoint Online (documents), as indicated by the 'Location' column listing both 'Exchange Online' and 'SharePoint Online' sources. This confirms that the eDiscovery search was configured to search across multiple workloads, returning results from both platforms.

Exam trap

The trap here is that candidates may assume all results are emails because eDiscovery is often associated with Exchange, but the exhibit clearly shows a document from SharePoint, testing the understanding that eDiscovery searches can span multiple Microsoft 365 workloads.

How to eliminate wrong answers

Option B is wrong because the exhibit clearly shows results from both Exchange Online and SharePoint Online, not just Exchange Online. Option C is wrong because the exhibit includes a document (e.g., 'Project Plan.docx') which is not an email message. Option D is wrong because the exhibit does not show any attachment indicator for the email message; the presence of an attachment would be indicated by a paperclip icon or similar metadata, which is absent.

Practice this question →
17
MCQmedium

An organization uses Microsoft 365. They need to prevent users from sharing credit card numbers in emails and Microsoft Teams messages. When a user attempts to share such sensitive information externally, the message should be blocked and the user should receive a policy tip notification. Which Microsoft Purview solution should they configure?

A.Data Lifecycle Management
B.Data Loss Prevention (DLP)
C.Insider Risk Management
D.Information Protection
AnswerB

Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across Microsoft 365 services. By utilizing sensitive information types, keywords, and sensitivity labels, DLP can detect when sensitive content is being shared inappropriately and enforce real-time actions, such as blocking the sharing, notifying administrators, or prompting users with policy tips, directly preventing data exfiltration.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and protect sensitive information, such as credit card numbers, through deep content analysis using built-in sensitive information types. DLP policies can be configured to block the sharing of this data in emails and Microsoft Teams messages and to display a policy tip notification to the user, enforcing compliance in real time.

Exam trap

The trap here is that candidates often confuse Information Protection (sensitivity labels) with DLP, not realizing that DLP is the solution for actively blocking and notifying on sensitive data in transit, while Information Protection is for classification and persistent protection of data at rest.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management focuses on retaining, deleting, and managing the lifecycle of data based on policies, not on preventing the sharing of sensitive information in transit. Option C is wrong because Insider Risk Management is designed to detect, investigate, and act on risky user activities (e.g., data theft or policy violations) based on behavioral analytics, not to block specific content like credit card numbers in messages. Option D is wrong because Information Protection (e.g., sensitivity labels and encryption) is used to classify and protect data at rest and in use, but it does not natively block sharing of specific sensitive data types in emails or Teams messages with policy tips; that is a DLP function.

Practice this question →
18
MCQeasy

A small consulting company, Northwind Traders, uses Microsoft 365 Business Premium and wants to implement basic compliance solutions. They have 50 users and need to: (1) prevent employees from sharing customer credit card information via email; (2) retain all deleted emails for 1 year; (3) allow users to classify documents as 'Confidential' manually; (4) generate reports on policy violations. The company has limited IT staff and wants a quick, out-of-the-box solution. What should they configure?

A.Use Microsoft Intune to set data loss prevention policies and configure document classification.
B.Use Microsoft Purview to create a DLP policy for credit card info, a retention policy for deleted emails, and publish a sensitivity label for 'Confidential'.
C.Use Microsoft 365 Defender to block sharing of credit card data and configure email retention.
D.Use Microsoft Entra ID to create conditional access policies and enable retention.
AnswerB

Purview provides all required compliance capabilities.

Why this answer

Microsoft Purview (formerly Microsoft 365 Compliance) provides out-of-the-box solutions for all three requirements: DLP policies to prevent sharing of credit card info, retention policies to retain deleted emails for 1 year, and sensitivity labels for manual document classification. Option A is wrong because Microsoft Intune focuses on device management, not compliance. Option C is wrong because Microsoft 365 Defender is primarily for security detection and response, not compliance features like retention labels.

Option D is wrong because Microsoft Entra ID is for identity and access management, not compliance policies.

Practice this question →
19
MCQeasy

Your company is subject to GDPR and must be able to respond to data subject requests (DSRs) by finding all personal data of a specific user across Microsoft 365. Which Microsoft Purview solution should you use?

A.Communication Compliance
B.eDiscovery (Standard or Premium)
C.Privileged Access Management
D.Audit (Standard or Premium)
AnswerB

eDiscovery allows searches across all Microsoft 365 data for specific users.

Why this answer

eDiscovery (Standard or Premium) is the correct solution because it is specifically designed to search for and export content across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject requests (DSRs) under GDPR. It allows you to create a case, define a search query for a specific user's personal data, and export the results for review and action, directly supporting the right to access and erasure.

Exam trap

The trap here is that candidates often confuse Audit logs (which show who did what) with the actual content search needed for DSRs, mistakenly thinking Audit can retrieve personal data when it only provides metadata about actions.

How to eliminate wrong answers

Option A is wrong because Communication Compliance is used to detect and review policy violations (e.g., offensive language, insider trading) in communications, not to search for all personal data of a specific user across Microsoft 365 for DSR fulfillment. Option C is wrong because Privileged Access Management provides just-in-time access controls for elevated administrative tasks, not the ability to search and export user data for GDPR compliance. Option D is wrong because Audit (Standard or Premium) logs user and admin activities for security and compliance investigations, but it does not allow you to search for and export the actual personal data content of a specific user.

Practice this question →
20
MCQmedium

Refer to the exhibit. A legal team needs to preserve all documents in SharePoint and OneDrive for 5 years. The current policy retains for 1 year. What should the administrator do to meet the requirement?

A.Add Exchange Online to the locations.
B.Change the retention type to Delete.
C.Change the retention duration to 1825 days.
D.Change the retention action to KeepAndDelete.
AnswerC

The legal team requires documents to be preserved for five years. To meet this specific duration, the retention policy's duration setting must be adjusted. Calculating five years into days (5 years * 365 days/year) yields 1825 days. Therefore, setting the retention duration to 1825 days precisely aligns the policy with the legal preservation requirement, ensuring the content remains immutable and discoverable for the mandated period.

Why this answer

The policy retains for 365 days (1 year), but the requirement is 5 years. Changing the retention duration to 1825 days (5 years) meets the requirement. Option A is wrong because the policy already includes both locations.

Option B is wrong because changing to Delete would delete content. Option D is wrong because changing to KeepAndDelete would still delete after retention, but the duration is the issue.

Practice this question →
21
MCQhard

Your organization needs to ensure that emails containing personally identifiable information (PII) like passport numbers are automatically encrypted before being sent externally. What should you configure in Microsoft Purview?

A.A retention label that encrypts the email
B.A DLP policy with the 'Encrypt' action
C.A communication compliance policy
D.An information barrier policy
AnswerB

DLP policies can automatically apply encryption to emails containing sensitive information.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect emails containing sensitive information types (e.g., passport numbers) and apply the 'Encrypt' action to enforce encryption before the email is sent externally. This leverages Microsoft 365 Message Encryption (OME) to protect the data in transit.

Exam trap

The trap here is that candidates often confuse retention labels (which manage lifecycle) with sensitivity labels (which can apply encryption), but the question specifically requires automatic encryption triggered by content detection, which is a DLP action, not a label-based action.

How to eliminate wrong answers

Option A is wrong because retention labels are designed for retention and deletion of content, not for automatic encryption of emails; they can mark items for retention but do not trigger encryption on outbound messages. Option C is wrong because communication compliance policies are used to detect and review inappropriate or policy-violating communications (e.g., harassment, insider trading), not to automatically encrypt sensitive data. Option D is wrong because information barrier policies restrict communication and collaboration between specific groups to prevent conflicts of interest, but they do not perform content-based encryption of emails.

Practice this question →
22
MCQmedium

A company has a SharePoint Online library containing legal contracts. They must satisfy a regulatory requirement that contracts cannot be modified or deleted after they are signed. Additionally, they need to retain the contracts for 10 years after the contract end date, after which they can be disposed of manually. Which Microsoft Purview solution should they implement?

A.Sensitivity labels
B.Records Management
C.Data Loss Prevention (DLP) policy
D.Data Lifecycle Management
AnswerB

Records Management allows you to mark items as records to prevent editing/deletion and assign retention labels with specific schedules and disposition actions.

Why this answer

Records Management in Microsoft Purview allows you to declare items as records, which locks them against modification or deletion (meeting the 'cannot be modified or deleted' requirement). It also supports event-based retention, enabling you to start a 10-year retention period from the contract end date and then allow manual disposal after that period expires.

Exam trap

The trap here is that candidates confuse Data Lifecycle Management (which handles retention and deletion) with Records Management (which adds immutability and legal hold capabilities), leading them to pick D when the question explicitly requires preventing modification and deletion, not just retention.

How to eliminate wrong answers

Option A is wrong because sensitivity labels classify and protect data based on sensitivity (e.g., confidentiality), but they do not prevent modification or deletion of content; they apply encryption, markings, or access controls, not immutable retention. Option C is wrong because Data Loss Prevention (DLP) policies detect and prevent accidental sharing of sensitive information via rules and actions (e.g., blocking email), but they do not enforce retention or lock items against edits/deletion. Option D is wrong because Data Lifecycle Management (now part of Microsoft Purview Data Lifecycle Management) automates retention and deletion based on policies, but it does not provide the 'locked as a record' capability that prevents modification or deletion; it can retain and delete but not make items immutable.

Practice this question →
23
Multi-Selecthard

Which THREE capabilities are provided by Microsoft Purview Compliance Manager?

Select 3 answers
A.Pre-built compliance assessments for regulations like GDPR
B.Scoring to track compliance progress over time
C.Audit log search for user access events
D.Improvement actions to remediate compliance gaps
E.Automated data discovery across cloud sources
AnswersA, B, D

Microsoft Purview Compliance Manager provides a comprehensive library of pre-built assessment templates for various international, governmental, and industry-specific regulations and standards, such as GDPR, ISO 27001, and NIST. These templates help organizations efficiently understand their current compliance posture against specific requirements by mapping them to Microsoft 365 services and controls. This capability streamlines the process of evaluating and reporting compliance.

Why this answer

Compliance Manager provides assessments, actions, and score tracking. It does not discover data (Data Map) or log access (Audit).

Practice this question →
24
MCQmedium

Your company is implementing records management for legal retention requirements. Documents must be locked and cannot be modified or deleted after a specific event. Which Microsoft Purview capability should you use?

A.Retention label configured as a regulatory record
B.Retention policy applied to a SharePoint site
C.Sensitivity label with encryption
D.Data Loss Prevention policy
AnswerA

A retention label configured as a regulatory record is the most stringent option for records management, specifically designed for legal or regulatory compliance. Once applied to an item, it renders the content immutable, preventing any modification, deletion, or even label removal by any user or administrator, including those with elevated permissions. This ensures the absolute integrity and immutability of the record, which is critical for legal discovery and regulatory obligations.

Why this answer

A retention label configured as a regulatory record is the correct choice because it enforces immutable, locked records that cannot be modified, deleted, or have their retention period shortened by any user, including administrators. This capability is specifically designed for legal retention requirements where documents must be preserved after a triggering event, using a policy that prohibits any changes or deletions.

Exam trap

The trap here is that candidates often confuse retention policies (which are flexible and can be modified) with regulatory record labels (which are immutable and locked), leading them to choose Option B thinking any retention mechanism will suffice for legal requirements.

How to eliminate wrong answers

Option B is wrong because a retention policy applied to a SharePoint site can be modified or deleted by administrators, and it does not provide the immutable lock required for legal retention; it only applies retention settings at the container level without record-level restrictions. Option C is wrong because a sensitivity label with encryption protects data through access controls and encryption but does not prevent modification or deletion of the document itself; it focuses on confidentiality, not immutability. Option D is wrong because a Data Loss Prevention (DLP) policy monitors and prevents unauthorized sharing or exfiltration of sensitive data, but it does not enforce retention or lock documents against modification or deletion.

Practice this question →
25
MCQhard

A healthcare organization must comply with HIPAA regulations. They store patient health information (PHI) in SharePoint Online documents. The compliance team needs to automatically detect PHI (e.g., medical record numbers) in documents, apply a sensitivity label that encrypts the document, and prevent users from removing that label. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Lifecycle Management
B.Microsoft Purview Information Protection
C.Microsoft Purview Communication Compliance
D.Microsoft Purview Audit
AnswerB

Microsoft Purview Information Protection is the correct choice because it directly addresses the need to classify, label, and protect sensitive data like Protected Health Information (PHI) required by HIPAA. It enables the creation and automatic application of sensitivity labels based on identified sensitive information types, such as medical record numbers or health insurance information. These labels can enforce encryption, visual markings, and access restrictions, ensuring PHI remains secure and preventing unauthorized disclosure or removal, thereby meeting HIPAA's confidentiality and integrity requirements.

Why this answer

Microsoft Purview Information Protection (option B) is correct because it provides the ability to automatically detect sensitive data types (such as PHI) using trainable classifiers or sensitive information types, apply a sensitivity label that enforces encryption, and configure label protection settings to prevent users from removing the label. This directly meets the HIPAA compliance requirement for automated detection, encryption, and label persistence on SharePoint Online documents.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Information Protection (which handles labeling and encryption) with Microsoft Purview Data Lifecycle Management (which handles retention and deletion), because both involve document policies, but only Information Protection can detect PHI and enforce encryption labels.

Why the other options are wrong

A

Data Lifecycle Management manages retention and deletion of data, not automatic detection of PHI or application of encryption labels.

C

Microsoft Purview Communication Compliance is designed to detect policy violations in communications like email and Teams, not to automatically detect PHI in documents and apply sensitivity labels. It lacks the ability to classify and protect content in SharePoint Online documents.

Practice this question →
26
MCQhard

A user accidentally shared a confidential document with an external vendor. You need to revoke access immediately for all copies, even if the file has been downloaded. Which Microsoft Purview feature should you use?

A.Microsoft Purview Information Protection
B.Retention policy
C.Data loss prevention (DLP) policy
D.Audit log search
AnswerA

Microsoft Purview Information Protection (MPIP) provides persistent data protection by allowing organizations to classify, label, and encrypt sensitive documents. Crucially, even after a document protected with MPIP is shared, the data owner or administrator retains the ability to revoke access at any time, regardless of the document's location. This capability directly addresses the scenario of accidental oversharing by enabling immediate remediation.

Why this answer

Microsoft Purview Information Protection (formerly Azure Information Protection) allows you to classify, label, and protect documents and emails. When a confidential document is shared accidentally, you can use the 'Revoke Access' action on the protected file via the Microsoft Purview compliance portal or PowerShell. This revokes access for all copies, even if the file has been downloaded, because the protection travels with the file through persistent rights management.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) policies with Information Protection, assuming DLP can retroactively block access to already-exposed data, when in fact DLP only prevents future sharing and does not revoke access to files already in the wild.

How to eliminate wrong answers

Option B is wrong because a retention policy is designed to preserve or delete data after a specified period, not to dynamically revoke access to already-shared files. Option C is wrong because a Data Loss Prevention (DLP) policy detects and prevents sharing of sensitive information but does not retroactively revoke access to files that have already been shared or downloaded. Option D is wrong because audit log search allows you to review past activities for investigation but does not provide any mechanism to revoke access to a file.

Practice this question →
27
Multi-Selecthard

Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)

Select 2 answers
A.Identify anomalous user activities such as mass file downloads
B.Review communications for policy violations
C.Detect data exfiltration by departing employees
D.Conduct eDiscovery searches for legal cases
E.Block sharing of sensitive data via email
AnswersA, C

Microsoft Purview's Insider Risk Management solution is specifically designed to identify unusual or risky user behaviors. It leverages machine learning to analyze activity signals across Microsoft 365 services, detecting deviations from normal patterns, such as an employee suddenly downloading a large volume of files from SharePoint or OneDrive. This capability helps organizations proactively identify potential data exfiltration or policy violations before significant damage occurs.

Why this answer

Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.

Exam trap

The trap here is that candidates often confuse Insider Risk Management with other compliance solutions like Communication Compliance or DLP, leading them to select options that describe those separate services instead of the specific capabilities of Insider Risk Management.

Practice this question →
28
MCQhard

A company wants to detect potentially malicious insider activities, such as employees copying large volumes of files to external drives or sending sensitive emails to personal accounts. The security team needs to investigate these activities with visual timelines and assign cases for review. Which Microsoft Purview solution should they use?

A.Insider Risk Management
B.Communication Compliance
C.eDiscovery (Premium)
D.Data Loss Prevention
AnswerA

Insider Risk Management is the correct solution because it is specifically designed to identify, investigate, and act on potentially malicious or inadvertent insider activities. It leverages machine learning to correlate diverse signals across Microsoft 365 services, such as file access, downloads, emails, and SharePoint activities, to detect patterns indicative of data exfiltration, intellectual property theft, or policy violations. The solution provides rich investigative tools, including visual timelines of user activity and integrated case management, enabling security teams to understand context and respond effectively to complex insider threats.

Why this answer

Microsoft Purview Insider Risk Management is designed to help detect, investigate, and act on malicious and inadvertent insider risks. It provides risk scoring, visual timelines of user activities, and case management workflows. Communication Compliance focuses on communication surveillance for regulatory compliance, eDiscovery is for legal discovery, and DLP prevents data loss but does not provide investigative timelines.

Practice this question →
29
MCQmedium

A company stores financial reports in SharePoint Online that contain credit card numbers. The compliance team needs to automatically apply a sensitivity label that encrypts the documents when they detect credit card data. Which Microsoft Purview solution should they configure?

A.Information Protection
B.Data Loss Prevention
C.Data Lifecycle Management
D.Records Management
AnswerA

Microsoft Purview Information Protection (MPIP) provides sensitivity labels that can be configured to automatically detect sensitive information, such as financial data patterns, within documents stored in SharePoint Online. These labels then apply specific protection actions, including visual markings, encryption, and access restrictions, ensuring that financial reports are classified and secured based on their content without manual intervention. This directly addresses the need to protect financial reports.

Why this answer

Microsoft Purview Information Protection (A) is the correct solution because it enables the creation of auto-labeling policies that can automatically apply a sensitivity label with encryption when credit card numbers are detected in SharePoint Online documents. This directly addresses the requirement to classify and protect sensitive data at rest based on content inspection.

Exam trap

The trap here is that candidates confuse the detection and blocking capabilities of Data Loss Prevention (DLP) with the automatic classification and encryption features of Information Protection, assuming DLP can also apply labels, when in fact DLP only monitors and controls data in motion or at rest without modifying the document's protection settings.

Why the other options are wrong

B

Data Loss Prevention (DLP) policies can detect credit card numbers and block or warn users, but they do not automatically apply sensitivity labels or encrypt documents. The requirement is to label and encrypt, which is a function of Information Protection.

D

Records Management is used for managing retention and disposition of records, not for automatically applying sensitivity labels based on content detection like credit card numbers.

Practice this question →
30
MCQhard

Your organization is implementing Microsoft Purview Information Protection and needs to ensure that files shared externally cannot be forwarded or printed. Which protection mechanism should be applied?

A.Azure Information Protection with rights management
B.Microsoft Purview Data Lifecycle Management retention policy
C.Sensitivity label with user-defined permissions
D.DLP policy with block action
AnswerA

Azure Information Protection (AIP) leverages Azure Rights Management Service (RMS) to apply encryption and usage restrictions directly to documents and emails. This allows organizations to define granular controls, such as preventing forwarding, printing, or copying, even after the content has been shared outside the organization. These protections persist with the data, ensuring automatic enforcement of usage rights regardless of where the file resides or who accesses it.

Why this answer

Azure Information Protection with rights management (now part of Microsoft Purview Information Protection) allows you to apply persistent protection that restricts actions like forwarding and printing on files shared externally. This is achieved through Azure Rights Management (Azure RMS) encryption and usage rights, which travel with the file regardless of where it is stored or sent.

Exam trap

The trap here is that candidates often confuse sensitivity labels with user-defined permissions as a reliable way to enforce restrictions, but user-defined permissions rely on end-user configuration and do not guarantee consistent, organization-wide protection like Azure Information Protection with rights management does.

How to eliminate wrong answers

Option B is wrong because a Microsoft Purview Data Lifecycle Management retention policy is designed to retain or delete data based on compliance requirements, not to enforce usage restrictions like preventing forwarding or printing. Option C is wrong because a sensitivity label with user-defined permissions allows end users to set their own protection settings, which is not a guaranteed, centrally enforced mechanism to block forwarding and printing for all external sharing scenarios. Option D is wrong because a DLP policy with block action can prevent sensitive data from being shared externally in the first place, but it cannot enforce persistent restrictions (like no forwarding or printing) on files that have already been shared.

Practice this question →
31
MCQhard

A company stores sensitive financial data on on-premises Windows Server file shares. The compliance team needs to automatically discover files containing credit card numbers, classify them by applying a sensitivity label, and optionally enforce protection actions like encryption. They want this solution to run on the on-premises file servers without needing to manually scan. Which Microsoft Purview solution should the compliance team deploy?

A.Microsoft Purview Data Loss Prevention (DLP) for on-premises
B.Microsoft Purview Information Protection scanner
C.Microsoft Purview Audit
D.Microsoft Purview eDiscovery
AnswerB

The Microsoft Purview Information Protection scanner is specifically designed to discover, classify, and protect sensitive data residing on on-premises file shares and SharePoint servers. It scans content based on configured sensitive information types and automatically applies sensitivity labels, which can include visual markings, encryption, and content access restrictions. This proactive approach ensures that existing sensitive financial data is identified and secured without manual intervention, directly addressing the need for on-premises data protection.

Why this answer

The Microsoft Purview Information Protection scanner is designed to run on on-premises Windows Server file shares to automatically discover, classify, and protect sensitive data. It uses content inspection to identify patterns like credit card numbers, applies sensitivity labels, and can enforce encryption without requiring manual scanning.

Exam trap

The trap here is confusing Data Loss Prevention (DLP) for on-premises, which monitors data in motion, with the Information Protection scanner, which handles data at rest classification and labeling.

Why the other options are wrong

A

Microsoft Purview Data Loss Prevention (DLP) for on-premises can detect sensitive data and enforce policies like blocking or warning, but it does not automatically classify files by applying sensitivity labels. The question specifically requires classification via sensitivity labels, which is a core function of the Information Protection scanner.

C

Microsoft Purview Audit is designed for logging and investigating user and admin activities, not for automatically discovering, classifying, or protecting sensitive data on file shares.

D

Microsoft Purview eDiscovery is designed for searching and exporting content from Microsoft 365 and Exchange Online, not for automatically discovering and classifying sensitive data on on-premises Windows Server file shares.

Practice this question →
32
MCQmedium

Your organization needs to retain all customer communications data for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?

A.Microsoft Purview Audit
B.Microsoft Purview eDiscovery
C.Microsoft Purview Data Loss Prevention
D.Microsoft Purview Data Lifecycle Management
AnswerD

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for retaining all customer communications, as it provides comprehensive capabilities for managing the entire lifecycle of information. DLM allows organizations to create and apply retention policies and retention labels across various Microsoft 365 services, including Exchange, SharePoint, OneDrive, and Teams. These policies ensure that data is preserved for a specific duration to meet regulatory and business requirements, and then automatically deleted when its retention period expires, effectively governing both retention and disposition.

Why this answer

Microsoft Purview Data Lifecycle Management (D) is the correct solution because it enables organizations to define retention and deletion policies for data, ensuring that customer communications data is retained for the required 7-year regulatory period and then securely disposed of. This solution directly addresses data retention requirements by applying policies at the workload level (e.g., Exchange Online, SharePoint) to manage the lifecycle of content based on specific rules, such as regulatory compliance.

Exam trap

The trap here is that candidates often confuse eDiscovery (which holds data for legal cases) with retention policies, but eDiscovery holds are indefinite and not designed for scheduled lifecycle management, whereas Data Lifecycle Management is the correct tool for time-based regulatory retention.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit is designed for logging and investigating user and admin activities, not for setting retention periods on data. Option B is wrong because Microsoft Purview eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for enforcing time-based retention policies. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) focuses on preventing unauthorized sharing or leakage of sensitive data through policy enforcement, not on managing how long data is retained.

Practice this question →
33
MCQhard

A multinational corporation must comply with GDPR and requires that personal data of EU users be retained for a maximum of 90 days after account closure. After that, all personal data must be permanently deleted. Which combination of Microsoft Purview capabilities should be used?

A.Configure an eDiscovery case to delete content after 90 days
B.Create a retention label with a retention period of 90 days and then delete the content automatically
C.Apply a sensitivity label that expires after 90 days
D.Use a Data Loss Prevention policy to block retention after 90 days
AnswerB

Creating a retention label with a 90-day retention period is the correct approach for this compliance requirement. Retention labels allow organizations to define how long content should be kept, and critically, what action should occur afterward, including automatic deletion. This ensures that data is retained for the necessary compliance duration and then systematically disposed of, aligning with GDPR's data minimization principles.

Why this answer

A retention label can be configured to retain data for a specified period (90 days) and then automatically trigger a disposition review or permanent deletion. This meets the GDPR requirement to retain data for 90 days and then delete it. Option B is correct. eDiscovery cases (A) are used for legal holds and searches, not automated lifecycle management.

Sensitivity labels (C) do not enforce retention or deletion; they classify data. DLP policies (D) are designed to prevent unauthorized sharing, not to manage retention periods.

Practice this question →
34
MCQmedium

Your organization uses Microsoft Purview to manage data governance. You need to ensure that sensitive financial data containing credit card numbers is automatically detected and labeled when stored in SharePoint Online. Which compliance solution should you configure?

A.Information Protection auto-labeling
B.eDiscovery (Premium)
C.Data Lifecycle Management
D.Audit (Premium)
AnswerA

Information Protection auto-labeling within Microsoft Purview is designed to automatically detect and classify sensitive data across an organization's digital estate. By leveraging auto-labeling policies, administrators can configure the system to identify specific Sensitive Information Types (SITs) or trainable classifiers within content. Upon detection, the appropriate sensitivity label is applied, enabling consistent data protection and governance without manual intervention, directly addressing the need for automatic classification.

Why this answer

Microsoft Purview Information Protection auto-labeling is the correct solution because it can automatically detect sensitive data types, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply sensitivity labels to documents in SharePoint Online. This ensures that financial data is classified and protected at rest without manual intervention, aligning with the requirement for automatic detection and labeling.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (retention/deletion) with Information Protection (classification/labeling), or assume eDiscovery can automatically label content, when in fact eDiscovery is purely for search and export in legal contexts.

How to eliminate wrong answers

Option B is wrong because eDiscovery (Premium) is designed for legal discovery and investigation workflows, not for automatic detection and labeling of sensitive data. Option C is wrong because Data Lifecycle Management focuses on retention and deletion policies for content, not on classifying or labeling data based on sensitivity. Option D is wrong because Audit (Premium) provides logging and investigation of user and admin activities, but does not perform automatic detection or labeling of sensitive content.

Practice this question →
35
MCQmedium

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to ensure that when a user attempts to share a document containing credit card numbers via email, the document is blocked and the user receives a policy tip. What should you configure in the DLP policy?

A.Set the action to 'Audit only'
B.Set the action to 'Block with override'
C.Set the action to 'Block'
D.Set the action to 'Notify only'
AnswerB

Set the action to 'Block with override' [CORRECT]

Why this answer

The requirement is to block the sharing of a document containing credit card numbers via email while also providing a policy tip to the user. In Microsoft Purview DLP, the 'Block with override' action blocks the sensitive data from being shared but allows the user to override the block (e.g., by providing a business justification), and it automatically triggers a policy tip to inform the user. This matches the scenario exactly.

Exam trap

The trap here is that candidates often confuse 'Block' with 'Block with override', assuming any blocking action will automatically show a policy tip, but only 'Block with override' explicitly enables the user-facing tip and override capability.

How to eliminate wrong answers

Option A is wrong because 'Audit only' only logs the activity without blocking or notifying the user, so it does not prevent the sharing or provide a policy tip. Option C is wrong because 'Block' prevents the action entirely but does not allow the user to override or receive a policy tip; it silently blocks without user interaction. Option D is wrong because 'Notify only' sends a policy tip but does not block the action, so the document would still be shared.

Practice this question →
36
MCQmedium

A company must retain all financial records for exactly 7 years and then automatically delete them. They need to automatically apply a retention label to any document that contains the words 'Invoice' or 'Statement'. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management (retention labels with auto-apply)
B.Data Loss Prevention (DLP)
C.eDiscovery (Standard)
D.Audit
AnswerA

Data Lifecycle Management, specifically through retention labels with auto-apply policies, is the precise solution. These labels can be configured to automatically identify financial records using keywords, sensitive information types, or specific content properties. Once applied, the label enforces a precise retention period, such as seven years, ensuring the content is preserved for the required duration and then automatically deleted, fulfilling both retention and deletion obligations for compliance.

Why this answer

Data Lifecycle Management (DLM) with auto-apply retention labels is the correct solution because it allows you to define a retention label that automatically applies to documents containing the keywords 'Invoice' or 'Statement' using a sensitive info type or trainable classifier. You can then configure the label to retain the data for exactly 7 years and trigger automatic deletion at the end of that period. This directly meets the requirement for both automated classification and lifecycle enforcement.

Exam trap

The trap here is that candidates confuse Data Lifecycle Management (which handles retention and deletion) with Data Loss Prevention (which handles security and access control), because both involve 'labels' and 'policies' in Microsoft Purview.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) is designed to prevent unauthorized sharing or leakage of sensitive data through policies that block or warn users, not to manage retention or deletion schedules. Option C is wrong because eDiscovery (Standard) is used for searching and exporting content for legal or investigative purposes, not for applying retention labels or automating data lifecycle policies. Option D is wrong because Audit (Microsoft Purview Audit) provides logging and visibility into user and admin activities, but it cannot apply retention labels or enforce data retention/deletion rules.

Practice this question →
37
MCQeasy

Your organization needs to create a policy that prevents users from sharing credit card numbers in emails. Which Microsoft Purview solution should you configure?

A.Communication Compliance
B.Retention policy
C.eDiscovery
D.Data loss prevention (DLP) policy
AnswerD

A Data loss prevention (DLP) policy is specifically engineered to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and cloud apps. DLP policies achieve this by detecting content that matches predefined sensitive information types or custom conditions and then enforcing actions like blocking, auditing, or notifying users and administrators to prevent unauthorized sharing, transfer, or use of that data. This directly addresses the need to prevent the use of specific data types.

Why this answer

Data loss prevention (DLP) policies in Microsoft Purview are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers—across Exchange Online, SharePoint, OneDrive, and Teams. By configuring a DLP policy with a credit card number sensitive info type, the organization can block users from sending emails containing those patterns, either by preventing the email from being sent or by triggering a policy tip. This directly addresses the requirement to prevent sharing of credit card numbers in emails.

Exam trap

The trap here is that candidates often confuse Communication Compliance with DLP because both deal with content monitoring, but Communication Compliance focuses on policy violations in communications (e.g., harassment) rather than preventing the sharing of sensitive data like credit card numbers.

How to eliminate wrong answers

Option A is wrong because Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) based on customizable policies, not to block the sharing of sensitive data like credit card numbers. Option B is wrong because a Retention policy controls how long content is kept or deleted, not the real-time prevention of data sharing in emails. Option C is wrong because eDiscovery is used for searching and exporting content for legal or investigative purposes, not for proactively blocking sensitive information from being shared.

Practice this question →
38
MCQmedium

A company is involved in a legal case and must preserve all emails and documents sent by a specific employee (custodian) that are related to a particular matter. The legal team needs to collect this data into a tamper-proof container for review, ensuring that no original items are modified or deleted. Which Microsoft Purview solution should they use?

A.Retention labels
B.eDiscovery (Standard)
C.eDiscovery (Premium)
D.Data Lifecycle Management
AnswerC

eDiscovery (Premium) is the comprehensive solution for managing legal, regulatory, and internal investigations within Microsoft 365, providing end-to-end data preservation, collection, and analysis. It offers robust capabilities including integrated custodian management, targeted legal holds across various data sources, advanced indexing, conversation reconstruction for platforms like Microsoft Teams, and secure review sets with analytics. This allows for efficient identification, collection, processing, and analysis of relevant data, ensuring defensible preservation and streamlined review for complex legal matters.

Why this answer

eDiscovery (Premium) is the correct solution because it provides advanced capabilities for legal investigations, including the ability to place a legal hold on specific custodians (the employee) and preserve all relevant emails and documents in a tamper-proof container. This ensures that no original items are modified or deleted during the review process, meeting the requirements of the legal case.

Exam trap

The trap here is confusing eDiscovery (Standard) with eDiscovery (Premium) because both involve searching for content, but only Premium offers custodian management and legal hold capabilities required for preserving data in a tamper-proof container for legal cases.

How to eliminate wrong answers

Option A is wrong because retention labels are used for classifying and retaining data based on organizational policies, not for legal holds or collecting data into a tamper-proof container for eDiscovery. Option B is wrong because eDiscovery (Standard) lacks the advanced features like custodian management, legal hold, and the ability to collect data into a tamper-proof container for review; it is designed for basic search and export. Option D is wrong because Data Lifecycle Management focuses on automating retention and deletion of data based on policies, not on preserving data for legal cases or providing a tamper-proof container for review.

Practice this question →
39
MCQmedium

Refer to the exhibit. An administrator creates a DLP rule as shown. What is the expected outcome when a user tries to share a file containing a U.S. Social Security Number with an external recipient?

A.The sharing is blocked only if the user is not the file owner.
B.The sharing is allowed, but an audit event is generated.
C.The file is shared, but the user is notified and must provide justification.
D.The sharing is blocked, and the user receives a notification.
AnswerD

This option accurately describes the combined effect of a DLP rule configured with `BlockAccess` and `UserNotification` enabled. The `BlockAccess` action ensures that the attempted sharing of sensitive content is prevented. Simultaneously, the `UserNotification` setting ensures that the user attempting the action receives a policy tip or email notification, explaining that their action was blocked due to a DLP policy violation.

Why this answer

The DLP rule is configured with an action of 'Block' (or 'BlockAccess') and user notification enabled. When a user attempts to share a file containing a U.S. SSN with an external recipient, the rule blocks the sharing and displays a notification to the user explaining that the action is blocked.

Option A is incorrect because the rule applies to all users, not just non-owners. Option B is incorrect because the rule does more than generate an audit event; it actively blocks the sharing. Option C is incorrect because the rule blocks the action outright, rather than allowing it with justification.

Practice this question →
40
MCQmedium

Your organization uses Microsoft Purview to label documents. Users report that some documents are automatically labeled as 'Confidential' even though the content is public. Which action should you take to resolve this issue?

A.Enable auditing to track label usage
B.Disable auto-labeling in all sensitivity label policies
C.Review and adjust the auto-labeling rules in the sensitivity label policies
D.Require users to manually apply labels
AnswerC

Reviewing and adjusting the auto-labeling rules within the sensitivity label policies directly addresses the root cause of incorrect label application. These rules are based on specific conditions, such as sensitive information types, keywords, or trainable classifiers. By refining these conditions, organizations can ensure that auto-labeling accurately identifies and applies the correct sensitivity labels only to truly confidential content, thereby optimizing data protection and compliance without sacrificing the efficiency of automation.

Why this answer

The issue is that auto-labeling rules are incorrectly classifying public content as 'Confidential'. By reviewing and adjusting the auto-labeling rules in the sensitivity label policies, you can refine the conditions (e.g., sensitive info types or pattern matching) to prevent false positives. This directly addresses the misconfiguration causing automatic labeling of non-sensitive content.

Exam trap

The trap here is that candidates may think disabling auto-labeling or switching to manual labeling is the simplest fix, but the correct approach is to refine the rules to match the organization's intent without losing automation for genuine sensitive data.

How to eliminate wrong answers

Option A is wrong because enabling auditing only tracks label usage after the fact; it does not prevent or fix the misclassification of public content. Option B is wrong because disabling auto-labeling entirely would stop all automatic labeling, which is an overreaction and would break legitimate auto-labeling needs for truly sensitive data. Option D is wrong because requiring manual application shifts the burden to users and does not resolve the underlying misconfiguration in the auto-labeling rules.

Practice this question →
41
MCQhard

A financial services company must comply with a regulation that requires all audit-related documents to be retained for 7 years and then permanently deleted. The compliance officer wants to ensure that even if a user modifies or deletes a file, the original content is preserved for the full 7 years, and at the end of the period the files are automatically destroyed without any manual approval. The company uses Microsoft 365 and stores these documents in SharePoint Online and Microsoft Teams. Which Microsoft Purview solution should the compliance officer configure?

A.Microsoft Purview Retention Labels with a disposition review that requires manual approval at the end of the retention period
B.Microsoft Purview Retention Policy with a record label to mark items as regulatory records
C.Microsoft Purview Data Lifecycle Management using a retention policy configured to retain items for 7 years and then delete them automatically
D.Microsoft Purview eDiscovery with a hold policy to preserve the documents indefinitely
AnswerC

Microsoft Purview Data Lifecycle Management (formerly Information Governance) provides the necessary framework to manage data throughout its lifecycle. A retention policy, configured within this solution, can be precisely set to retain items for a specified duration, such as 7 years, to meet regulatory obligations. Upon the expiration of this retention period, the policy automatically triggers the deletion of the content, ensuring compliance with requirements for both preservation and eventual disposal without requiring manual intervention.

Why this answer

Microsoft Purview Data Lifecycle Management allows you to create a retention policy that retains items for a fixed period (7 years) and then automatically deletes them without any manual intervention. This meets the regulatory requirement for automatic destruction at the end of the retention period, and the policy applies to both SharePoint Online and Microsoft Teams, preserving the original content even if a user modifies or deletes the file.

Exam trap

The trap here is that candidates often confuse retention policies with record labels or eDiscovery holds, mistakenly thinking that marking items as records or placing them on hold satisfies the automatic deletion requirement, but these options either require manual approval or preserve data indefinitely, failing the 'automatically destroyed' condition.

Why the other options are wrong

A

The requirement specifies automatic deletion without manual approval, but a disposition review requires manual approval at the end of the retention period, which contradicts the need for automatic destruction.

B

The requirement demands automatic deletion after 7 years without manual approval, but a retention policy with record labels does not automatically delete; it requires a disposition review or manual action. Additionally, regulatory records prevent deletion, not enforce it.

D

eDiscovery hold policies preserve content indefinitely or until the hold is removed, but they do not enforce automatic deletion after a fixed retention period. The requirement is for automatic deletion after 7 years, not indefinite preservation.

Practice this question →
42
MCQhard

An organization must prove to an auditor that only authorized users have accessed sensitive HR files over the past year. The compliance team needs to generate a report of all access events to these files. Which Microsoft Purview solution should be used?

A.Microsoft Purview Audit (Premium)
B.Microsoft Purview Data Lifecycle Management
C.Microsoft Purview Compliance Manager
D.Microsoft Purview Information Protection
AnswerA

Microsoft Purview Audit (Premium) provides comprehensive, high-fidelity logging of user and admin activities across Microsoft 365 services, including detailed access events to sensitive data and resources. It offers extended log retention, advanced search capabilities, and intelligent insights, which are crucial for forensic investigations and demonstrating precise compliance to auditors regarding who accessed what, when, and from where. This capability directly enables an organization to prove that only authorized individuals accessed specific information.

Why this answer

Microsoft Purview Audit (Premium) is the correct solution because it provides detailed logging of all access events to sensitive files, including who accessed them, when, and from where. The compliance team can generate a comprehensive report of these events over the past year, meeting the auditor's requirement to prove only authorized users accessed the HR files. Audit (Premium) offers extended retention (up to 10 years) and advanced search capabilities, making it ideal for forensic investigations and compliance audits.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Information Protection (which labels and encrypts data) with auditing capabilities, mistakenly thinking that protecting data inherently logs access, when in fact Audit (Premium) is the dedicated solution for recording and reporting access events.

How to eliminate wrong answers

Option B (Microsoft Purview Data Lifecycle Management) is wrong because it focuses on managing data retention, deletion, and lifecycle policies (e.g., archiving or expiring content), not on auditing or reporting access events. Option C (Microsoft Purview Compliance Manager) is wrong because it is a risk assessment and compliance score tool that helps organizations track their compliance posture against regulations, not a solution for generating access event reports. Option D (Microsoft Purview Information Protection) is wrong because it deals with classifying, labeling, and encrypting sensitive data (e.g., applying sensitivity labels), not with logging or auditing who accessed specific files.

Practice this question →
43
MCQmedium

A compliance officer wants a central dashboard to assess the organization's compliance posture against regulatory standards such as GDPR and ISO 27001. They need actionable recommendations to improve their compliance score and track progress over time. Which Microsoft Purview solution should they use?

A.Microsoft Purview Information Protection
B.Microsoft Purview Data Lifecycle Management
C.Microsoft Purview Compliance Manager
D.Microsoft Purview Audit
AnswerC

Compliance Manager offers a compliance score, detailed assessments, and recommended actions to improve adherence to various regulations.

Why this answer

Microsoft Purview Compliance Manager is the correct solution because it provides a central dashboard that assesses an organization's compliance posture against regulatory standards like GDPR and ISO 27001, offers actionable recommendations to improve the compliance score, and tracks progress over time through continuous assessments and improvement actions.

Exam trap

The trap here is that candidates often confuse Compliance Manager with Information Protection or Audit, mistakenly thinking that data protection or logging alone provides compliance assessment and scoring, but only Compliance Manager offers a centralized dashboard with actionable recommendations and progress tracking against regulatory frameworks.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying, labeling, and protecting sensitive data (e.g., encryption and access controls), not on assessing compliance posture against regulatory standards or providing a compliance score. Option B is wrong because Microsoft Purview Data Lifecycle Management handles data retention, deletion, and records management policies, not compliance scoring or actionable recommendations for regulatory standards. Option D is wrong because Microsoft Purview Audit provides detailed logging and investigation of user and admin activities, but it does not offer a compliance score, regulatory assessments, or improvement recommendations.

Practice this question →
44
MCQmedium

A financial organization is required by regulation to keep all customer transaction records for 10 years. After 10 years, the records must be permanently deleted. In addition, during the retention period, records must not be modifiable or deletable by any user, including administrators. Which Microsoft Purview solution should they use to meet these requirements?

A.Retention labels (unlocked)
B.Records Management
C.Information Protection with sensitivity labels
D.Data Lifecycle Management
AnswerB

Records Management uses retention labels with a disposition review, and when a label is marked as a record, content cannot be modified or deleted. After the retention period, a disposition review can trigger permanent deletion.

Why this answer

Records Management in Microsoft Purview is designed to meet regulatory requirements by allowing organizations to declare records or regulatory records. When a record is declared, it becomes immutable—no user, including administrators, can modify or delete it during the retention period. The 10-year retention and mandatory deletion after that period are enforced through a retention label configured as a record, which locks the item and triggers permanent deletion upon expiration.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Records Management, not realizing that only Records Management provides the immutability lock required to prevent modification or deletion by administrators during the retention period.

How to eliminate wrong answers

Option A is wrong because unlocked retention labels do not enforce immutability; they allow users to modify or delete the labeled content, which fails the requirement that records must not be modifiable or deletable by any user. Option C is wrong because Information Protection with sensitivity labels focuses on classifying and protecting data through encryption and access controls, not on enforcing immutable retention or mandatory deletion after a fixed period. Option D is wrong because Data Lifecycle Management manages retention and deletion policies but does not provide the immutability lock required to prevent modification or deletion by administrators during the retention period.

Practice this question →
45
Multi-Selecteasy

Which TWO Microsoft Purview solutions can be used to automatically classify sensitive data at rest?

Select 2 answers
A.Data Lifecycle Management
B.Communication Compliance
C.eDiscovery
D.Auditing
E.Information Protection
AnswersA, E

Data Lifecycle Management in Microsoft Purview includes retention policies and retention labels. These labels can be configured for automatic application based on sensitive information types, keywords, or trainable classifiers, thereby automatically classifying data at rest to manage its retention and deletion throughout its lifecycle. This ensures compliance without manual intervention.

Why this answer

Data Lifecycle Management (DLM) automatically classifies sensitive data at rest by applying retention labels based on sensitive content detection, such as credit card numbers or social security numbers, using trainable classifiers or exact data match. Information Protection (IP) extends this by enabling automatic labeling of documents and emails based on sensitive information types, ensuring data is classified and protected while stored in SharePoint, OneDrive, or Exchange Online.

Exam trap

The trap here is that candidates often confuse Communication Compliance (which monitors communications) with Information Protection (which classifies data), or they think eDiscovery or Auditing can classify data, when in fact they are reactive or investigative tools, not proactive classification solutions.

Practice this question →
46
MCQmedium

A compliance officer needs to monitor internal emails for inappropriate language and potential data leaks. The officer wants to detect policy violations and allow users to report concerns. Which Microsoft Purview solution should be used?

A.Microsoft Purview Data Lifecycle Management
B.Microsoft Purview Communication Compliance
C.Microsoft Purview Audit
D.Microsoft Purview Information Protection
AnswerB

Microsoft Purview Communication Compliance is engineered to help organizations detect, investigate, and remediate policy violations in internal and external communications. It leverages machine learning and customizable policies to identify sensitive information, harassment, regulatory non-compliance, or other inappropriate content across platforms like Exchange, Teams, and Viva Engage, providing a robust workflow for review and investigation. This tool directly addresses the need for monitoring communication content.

Why this answer

Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in internal and external communications, including inappropriate language and potential data leaks. It also provides a built-in mechanism for users to report concerns, aligning directly with the compliance officer's requirements.

Exam trap

The trap here is that candidates often confuse Information Protection (which labels and encrypts data) with Communication Compliance (which monitors communications for policy violations), leading them to select option D instead of B.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management focuses on managing data retention and deletion policies, not on monitoring communications for policy violations or user reporting. Option C is wrong because Microsoft Purview Audit provides logging and investigation of past activities, not real-time detection of inappropriate language or data leaks in communications. Option D is wrong because Microsoft Purview Information Protection is used for classifying and protecting sensitive data through labels and encryption, not for monitoring communications or enabling user reporting of concerns.

Practice this question →
47
Multi-Selecteasy

Which TWO Microsoft Purview solutions can be used to manage data retention and deletion?

Select 2 answers
A.Retention policies
B.eDiscovery
C.Sensitivity labels
D.Retention labels
E.Data Loss Prevention (DLP)
AnswersA, D

Microsoft Purview retention policies are designed to apply retention and deletion rules broadly across entire locations, such as Exchange mailboxes, SharePoint sites, and Microsoft Teams. They ensure that content is retained for a specified period or deleted after a certain time, based on organizational or regulatory requirements, managing data at a container level.

Why this answer

Retention policies (A) are used to assign retention and deletion settings at the container level (e.g., entire SharePoint site, Exchange mailbox, or OneDrive account), automatically applying to all content within that scope. Retention labels (D) are used to assign retention and deletion settings at the item level (e.g., a specific document or email), allowing granular control and manual or auto-classification. Both are core Microsoft Purview solutions for managing data lifecycle, including retention and deletion.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which control access and protection) with retention labels (which control lifecycle), or mistakenly think eDiscovery or DLP can set retention/deletion rules.

Practice this question →
48
MCQhard

A financial services company is subject to regulations that require monitoring of employee communications for potential market manipulation. The compliance team needs to create policies that automatically detect messages containing phrases like 'insider info' or 'confidential trade' in Microsoft Teams chats and Exchange Online emails. Detected messages should be routed to designated reviewers for investigation, and the company wants a built-in Microsoft Purview solution to handle this process. Which Microsoft Purview solution should they use?

A.Microsoft Purview Communication Compliance
B.Microsoft Purview Insider Risk Management
C.Microsoft Purview Information Protection
D.Microsoft Purview Data Lifecycle Management
AnswerA

Microsoft Purview Communication Compliance is specifically designed to help organizations meet stringent regulatory compliance requirements by proactively identifying and managing inappropriate communications. It leverages machine learning and predefined or custom policies to scan messages across various communication channels for specific keywords, phrases, and content patterns indicative of policy violations like insider trading, harassment, or regulatory breaches. Detected items are then routed for review and remediation, ensuring adherence to internal policies and external regulations.

Why this answer

Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect and investigate policy violations in organizational communications, such as Microsoft Teams chats and Exchange Online emails. It allows compliance teams to create custom policies that automatically scan for sensitive phrases like 'insider info' or 'confidential trade' and route flagged messages to designated reviewers for investigation, meeting the regulatory monitoring requirements.

Exam trap

The trap here is that candidates often confuse Insider Risk Management (which focuses on user behavior patterns) with Communication Compliance (which focuses on content scanning), leading them to select Option B when the question explicitly requires detection of specific phrases in messages.

Why the other options are wrong

C

Microsoft Purview Information Protection focuses on classifying and protecting sensitive data (e.g., via labels and encryption), not on monitoring communications for policy violations like market manipulation phrases.

D

Data Lifecycle Management focuses on retaining and deleting data based on policies, not on detecting and reviewing specific message content for regulatory compliance.

Practice this question →
49
MCQhard

You are the compliance administrator for Contoso, a multinational corporation with headquarters in the US and subsidiaries in Europe and Asia. Contoso uses Microsoft 365 E5 and Microsoft Purview. The company handles personal data subject to GDPR and CCPA. You need to design a compliance solution that meets the following requirements: - Automatically classify and protect documents containing personal data in SharePoint Online and OneDrive for Business. - Ensure that data subject requests (DSRs) for access and deletion can be fulfilled within the regulatory timeframes. - Prevent accidental sharing of sensitive data via email and Teams. - Maintain an audit trail of all activities related to personal data for at least one year. - Manage data retention to comply with local laws that require different retention periods for different types of data. Which combination of Microsoft Purview solutions should you use?

A.Sensitivity labels with auto-labeling, DLP, eDiscovery, Data Lifecycle Management, and Audit (Premium)
B.Insider Risk Management, DLP, eDiscovery, and Data Lifecycle Management
C.Data Lifecycle Management, Information Barriers, DLP, and Audit (Premium)
D.Sensitivity labels, Communication Compliance, eDiscovery, and Audit (Standard)
AnswerA

Correct. Sensitivity labels with auto-labeling classify and protect personal data, DLP blocks sharing via email/Teams, eDiscovery handles DSRs, Data Lifecycle Management manages retention, and Audit Premium provides 1-year audit trail.

Why this answer

It includes all the necessary Purview solutions: Sensitivity labels with auto-labeling classify and protect documents containing personal data; DLP prevents accidental sharing via email and Teams; eDiscovery enables fulfilling data subject requests (DSRs) for access and deletion; Data Lifecycle Management allows configuring different retention periods for different data types; Audit (Premium) provides one-year audit trail retention. Options B, C, and D each miss one or more critical components needed to meet all requirements.

Exam trap

The question tests the distinction between Purview solutions: understand that DSR fulfillment requires eDiscovery, not Communication Compliance or Insider Risk Management. Also note that Audit (Premium) is needed for 1-year retention, not Audit (Standard).

Practice this question →
50
MCQeasy

A company is involved in litigation and needs to search for specific emails and documents across Exchange Online, SharePoint Online, and Teams. They also need to place a hold on relevant content to prevent deletion. Which Microsoft Purview solution should they use?

A.Records Management
B.Data Lifecycle Management
C.eDiscovery
D.Data Loss Prevention
AnswerC

Microsoft Purview eDiscovery solutions are specifically designed to enable organizations to identify, preserve, collect, process, review, and produce electronically stored information (ESI) in response to legal or regulatory requests. It provides advanced search capabilities across diverse data sources, allows for placing immutable legal holds to prevent data alteration, and facilitates the secure export of relevant data for legal proceedings. This functionality directly addresses the need to search for specific emails and manage them for litigation purposes.

Why this answer

Microsoft Purview eDiscovery (specifically eDiscovery (Premium)) is the correct solution because it is designed for legal investigations, enabling organizations to search for content across Exchange Online, SharePoint Online, and Teams, and to place holds on that content to preserve it from deletion or alteration. This directly addresses the litigation requirement for both search and hold capabilities.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (retention) with eDiscovery holds, not realizing that retention policies are for scheduled deletion/preservation, while eDiscovery holds are for legal preservation that overrides any deletion policies and includes search capabilities.

How to eliminate wrong answers

Option A is wrong because Records Management focuses on declaring records, applying retention labels, and managing disposition reviews for regulatory compliance, not on searching or placing holds for litigation. Option B is wrong because Data Lifecycle Management (formerly known as retention policies and labels) governs how long content is kept and when it is deleted, but it does not provide the search or hold functionality needed for eDiscovery in litigation. Option D is wrong because Data Loss Prevention (DLP) is designed to prevent accidental or unauthorized sharing of sensitive data through policies and alerts, not to search for or preserve content for legal purposes.

Practice this question →
51
MCQmedium

A company uses Microsoft 365 and wants to automatically apply a 3-year retention label to any document that contains a patent number in the format PAT-XXXXXX. The label should be applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator configure?

A.Microsoft Purview Data Lifecycle Management
B.Microsoft Purview Communication Compliance
C.Microsoft Purview Data Loss Prevention (DLP)
D.Microsoft Purview Audit (Premium)
AnswerA

Microsoft Purview Data Lifecycle Management is the correct solution because it provides robust auto-labeling policies specifically designed for applying retention labels. These policies leverage sensitive information types, keywords, or trainable classifiers to automatically detect and apply appropriate retention labels to content across Microsoft 365 services like SharePoint, OneDrive, and Exchange. This ensures that data is retained or deleted according to organizational policies without requiring manual intervention, streamlining compliance efforts.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Retention) allows administrators to create auto-apply retention labels based on sensitive information types, such as a custom regex for patent numbers. When configured with a 'created or modified' condition, the label is automatically applied at the time the document is saved or edited, ensuring compliance with the 3-year retention requirement.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with Data Lifecycle Management, assuming DLP can apply retention labels, but DLP only detects and protects data in transit or at rest without managing retention schedules.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) in Exchange Online, Teams, and Yammer, not to apply retention labels based on document content. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) can detect sensitive data like patent numbers and trigger alerts or block actions, but it cannot automatically apply retention labels; DLP policies enforce data protection, not lifecycle management. Option D is wrong because Microsoft Purview Audit (Premium) provides detailed logging of user and admin activities for forensic investigation, but it has no capability to apply retention labels or manage data lifecycle policies.

Practice this question →
52
Drag & Dropmedium

Order the steps to deploy Microsoft Intune for mobile device management.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Intune deployment includes setup, enrollment policies, compliance policies, app assignment, and enrollment.

Practice this question →
53
Multi-Selecteasy

Which TWO Microsoft Purview compliance solutions are used to manage data retention and deletion?

Select 2 answers
A.Data Lifecycle Management
B.Data Loss Prevention
C.Records Management
D.Communication Compliance
E.Audit
AnswersA, C

Microsoft Purview Data Lifecycle Management (DLM) is a compliance solution designed to govern information throughout its entire lifecycle. It enables organizations to define and apply retention labels and policies to content across Microsoft 365 services, ensuring that data is kept for necessary periods and then defensibly deleted when no longer required, aligning with regulatory and business obligations.

Why this answer

Data Lifecycle Management (A) is correct because it enables organizations to apply retention and deletion policies to content based on its age or classification, automatically managing data across SharePoint, OneDrive, Exchange, and Teams. Records Management (C) is correct because it provides a solution for declaring records, applying retention labels that lock content to prevent modification or deletion, and managing disposition reviews for permanent deletion. Both solutions are part of Microsoft Purview's information governance capabilities, specifically designed to control data retention and deletion.

Exam trap

The trap here is that candidates may confuse Data Loss Prevention (DLP) with data retention because both involve data lifecycle concepts, but DLP is solely about preventing data breaches through policy enforcement, not about scheduling retention or deletion.

Practice this question →
54
MCQmedium

A company wants to automatically classify sensitive documents in Microsoft 365 based on credit card numbers and retain them for 7 years. Which two Microsoft Purview solutions should they use together?

A.Sensitivity labels and retention policies
B.Microsoft Purview compliance portal and Microsoft 365 Defender
C.Insider risk management and communication compliance
D.Data Loss Prevention (DLP) and eDiscovery
AnswerA

Sensitivity labels, a core component of Microsoft Purview Information Protection, enable automatic classification of documents based on their content, such as the presence of credit card numbers, using sensitive information types (SITs). Once documents are classified and labeled, retention policies can be applied to these labels, ensuring the content is retained for a specified duration, like seven years, to meet regulatory or organizational compliance requirements. This combination provides both intelligent identification of sensitive data and its subsequent lifecycle management.

Why this answer

Sensitivity labels classify and protect content, and retention policies ensure data is kept for the required period. Data Loss Prevention (DLP) prevents sharing but does not retain; eDiscovery is for search and export; insider risk management detects risky activities. Therefore, sensitivity labels and retention policies are the correct combination.

Practice this question →
55
MCQmedium

An organization is subject to regulatory requirements that mandate retention of employee records for 5 years after termination. After the retention period, the records must be permanently deleted. The compliance team wants to automatically enforce this process across all Microsoft 365 locations (Exchange, SharePoint, Teams). Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Loss Prevention (DLP)
B.Microsoft Purview Data Lifecycle Management
C.Microsoft Purview Records Management
D.Microsoft Purview Communication Compliance
AnswerB

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for managing content retention and deletion throughout its lifecycle. It enables organizations to create and apply retention policies that automatically preserve content for specified periods to meet regulatory, legal, or business obligations. Once the retention period expires, DLM ensures the content is permanently deleted, thereby addressing the question's requirement for mandated retention and eventual disposal.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it allows organizations to define retention and deletion policies that apply automatically across Exchange, SharePoint, and Teams. This solution enforces the 5-year retention period after termination and then permanently deletes the records, meeting the regulatory requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Records Management, but Records Management is for declaring records and managing their disposition (e.g., with a retention label), while Data Lifecycle Management provides the automated, policy-based retention and deletion across all locations without requiring manual labeling.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent unauthorized sharing or leakage of sensitive data, not to enforce retention or deletion schedules. Option C is wrong because Microsoft Purview Records Management is used for declaring records and managing their disposition, but it requires a retention label to be applied (often manually or via auto-labeling) and is not the primary tool for automated lifecycle policies across all locations; Data Lifecycle Management provides the underlying retention policy that Records Management can leverage. Option D is wrong because Microsoft Purview Communication Compliance is focused on monitoring and reviewing communications (e.g., for regulatory compliance or insider risk), not on data retention or deletion.

Practice this question →
56
MCQmedium

A compliance officer needs to automatically detect documents containing passport numbers in SharePoint Online and apply a retention label that retains the documents for 10 years before deleting them. They also want to prevent users from permanently deleting these documents before the retention period ends. Which Microsoft Purview solution should they use to achieve this?

A.Microsoft Purview Information Protection
B.Microsoft Purview Data Lifecycle Management
C.Microsoft Purview Data Loss Prevention (DLP)
D.Microsoft Purview Audit
AnswerB

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for automatically detecting documents and managing their retention and deletion. DLM utilizes retention labels and policies that can be automatically applied to content based on specific conditions, such as sensitive information types or keywords. These policies ensure that documents are retained for required periods and then disposed of according to compliance regulations, including managing holds for legal discovery and disposition reviews.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it enables organizations to automatically apply retention labels to sensitive content—such as documents containing passport numbers—based on sensitive information types. It also enforces a retention period (10 years) and prevents users from permanently deleting documents before that period ends, meeting both the detection and preservation requirements.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Data Loss Prevention, assuming DLP handles retention, when in fact DLP only prevents data exfiltration and does not manage retention periods or deletion prevention.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying and protecting data through sensitivity labels and encryption, not on managing retention periods or preventing permanent deletion. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to detect and prevent unauthorized sharing or leakage of sensitive data, not to enforce retention schedules or block permanent deletion. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, but it does not automatically detect sensitive content or apply retention policies.

Practice this question →
57
MCQhard

Refer to the exhibit. You are analyzing a Microsoft Purview Data Lifecycle Management retention policy. What is the outcome of this policy?

A.Content from the HR department in Exchange and SharePoint is retained for 365 days and then deleted
B.Content from the HR department in Exchange and SharePoint is deleted after 90 days
C.Content from all employees in Exchange and SharePoint is retained for 365 days
D.Content from the HR department in Exchange and SharePoint is retained for 365 days
AnswerA

Correct. The policy retains content for 365 days and then deletes it, as shown in the exhibit.

Why this answer

The exhibit shows a Microsoft Purview Data Lifecycle Management retention policy scoped to the HR department with a retention period of 365 days and a deletion action at the end. Therefore, content from the HR department in Exchange and SharePoint is retained for 365 days and then deleted, matching option A.

Exam trap

The trap is that candidates may overlook the deletion action and assume the policy only retains without deletion, or misread the scope as applying to all employees instead of the HR department.

How to eliminate wrong answers

Option A is wrong because it incorrectly states that content is retained for 365 days and then deleted, which is actually the correct outcome described in option D, but option A is not listed as correct in the answer choices. Option B is wrong because it claims content is deleted after 90 days, but the policy specifies a retention period of 365 days, not 90. Option C is wrong because it states the policy applies to 'all employees,' but the exhibit clearly shows the scope is limited to the HR department only.

Practice this question →
58
MCQhard

A financial services company uses Microsoft Purview and must comply with a regulation that requires communication surveillance for market abuse. They need to capture all electronic communications (email, Teams chats) of traders and scan for specific keywords and trading patterns. Which Microsoft Purview solution is specifically designed for this?

A.Communication Compliance
B.Data Lifecycle Management
C.eDiscovery (Standard)
D.Insider Risk Management
AnswerA

Microsoft Purview Communication Compliance is specifically engineered to proactively detect and remediate regulatory compliance risks, such as market abuse, insider trading, and harassment, within an organization's electronic communications. It leverages machine learning and policy-based scanning across platforms like Microsoft Teams, Exchange, and Yammer to identify potential violations. Financial services companies rely on this capability to meet stringent industry regulations by reviewing flagged messages and taking appropriate action, ensuring adherence to standards like FINRA or SEC rules.

Why this answer

Communication Compliance is the Microsoft Purview solution specifically designed to capture and analyze electronic communications (email, Teams chats) for regulatory compliance, such as detecting market abuse. It allows organizations to define policies that scan for specific keywords and trading patterns, automatically flagging messages that violate compliance rules. This directly addresses the requirement for communication surveillance in financial services under regulations like MiFID II or Dodd-Frank.

Exam trap

The trap here is confusing Communication Compliance with Insider Risk Management, as both deal with user behavior, but Communication Compliance is specifically for capturing and scanning communications for regulatory surveillance, while Insider Risk Management focuses on broader risk indicators like data theft or policy violations.

How to eliminate wrong answers

Option B (Data Lifecycle Management) is wrong because it focuses on retaining, deleting, or archiving data based on lifecycle policies, not on scanning communications for keywords or patterns. Option C (eDiscovery Standard) is wrong because it is designed for legal discovery and holds on content, not for proactive, real-time surveillance of communications for regulatory compliance. Option D (Insider Risk Management) is wrong because it detects risky user behavior (e.g., data exfiltration) using analytics and indicators, not specifically for capturing and scanning all trader communications for market abuse keywords and patterns.

Practice this question →
59
MCQhard

A multinational corporation wants to detect scenarios where employees in the finance department are accessing and downloading customer credit card data from a CRM system and then emailing that data to personal accounts. The security team needs to define policies that identify this pattern of activity, analyze user behavior over time (e.g., building a user's baseline), and automatically escalate high-risk incidents for investigation. Which Microsoft Purview solution should they deploy?

A.Microsoft Purview Communication Compliance
B.Microsoft Purview Data Loss Prevention (DLP)
C.Microsoft Purview Insider Risk Management
D.Microsoft Purview eDiscovery (Premium)
AnswerC

Microsoft Purview Insider Risk Management proactively identifies and mitigates potential data security risks originating from within an organization. It leverages machine learning to analyze user activity across various signals (e.g., file access, email, Teams, SharePoint) to establish behavioral baselines. By detecting deviations from these baselines and correlating multiple anomalous events, it uncovers patterns indicative of data theft, intellectual property leakage, or policy violations, whether malicious or inadvertent.

Why this answer

Microsoft Purview Insider Risk Management is designed to detect risky user activities that violate organizational policies, such as accessing sensitive data and exfiltrating it via email. It uses machine learning to establish user baselines over time and automatically escalates high-risk incidents for investigation, directly matching the scenario's requirements.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with Insider Risk Management because both deal with data protection, but DLP enforces rules on data in motion or at rest without analyzing user behavior baselines or detecting insider threat patterns over time.

Why the other options are wrong

A

Communication Compliance focuses on detecting inappropriate communications (e.g., harassment, sensitive info sharing) but does not analyze user behavior over time or build baselines to identify anomalous patterns like finance employees emailing credit card data to personal accounts.

B

Data Loss Prevention (DLP) policies can block or alert on sensitive data being emailed, but they do not analyze user behavior over time or build baselines to detect anomalous patterns like an employee accessing and downloading data before emailing it. DLP lacks the user behavior analytics and risk scoring that Insider Risk Management provides.

D

Microsoft Purview eDiscovery (Premium) is used for legal investigations and litigation support to search, hold, and export content, not for real-time detection of risky user behavior or policy-based escalation of insider data exfiltration scenarios.

Practice this question →
60
MCQmedium

Your organization uses Microsoft Purview to manage compliance. You need to create a policy that ensures data is retained for a specific period and then automatically deleted. Which solution should you use?

A.Microsoft Purview Audit
B.Microsoft Purview Compliance Manager
C.Microsoft Purview Information Protection
D.Microsoft Purview Data Lifecycle Management
AnswerD

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for managing the retention and deletion of data across an organization's Microsoft 365 environment. It allows administrators to create and apply retention policies and labels that automatically retain content for specified periods or delete it after a certain time or event. DLM ensures that data is kept for legal, regulatory, or business requirements and then defensibly disposed of when no longer needed, directly addressing retention and deletion needs.

Why this answer

Microsoft Purview Data Lifecycle Management (D) provides the ability to create retention and deletion policies that automatically retain data for a specified period and then delete it. This solution directly addresses the requirement to manage data retention and deletion schedules within Microsoft Purview.

Exam trap

The trap here is that candidates often confuse Information Protection (which handles classification and labeling) with Data Lifecycle Management (which handles retention and deletion), leading them to select option C instead of D.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit is used for logging and investigating user and admin activity, not for creating retention or deletion policies. Option B is wrong because Microsoft Purview Compliance Manager is a risk assessment and compliance score tool, not a data lifecycle policy engine. Option C is wrong because Microsoft Purview Information Protection focuses on classifying, labeling, and protecting data (e.g., sensitivity labels), not on automated retention and deletion schedules.

Practice this question →
61
MCQhard

A company uses Microsoft Purview to manage data lifecycle. They configure a retention label that marks content as a regulatory record and apply it to sensitive documents. A user with edit permissions attempts to modify a document that has this label applied. What will be the outcome?

A.The user can edit the document but cannot delete it.
B.The user cannot edit or delete the document.
C.The user can edit the document if they have edit permissions, and any changes are recorded in the audit log.
D.The user can edit the document only after obtaining a legal hold.
AnswerB

When a document is marked with a regulatory record label in Microsoft Purview, it becomes immutable to meet stringent compliance requirements. This means the content is locked down, preventing any user from editing or deleting it, regardless of their assigned permissions. This highest level of restriction ensures the integrity and non-repudiation of the record throughout its defined retention period.

Why this answer

When a retention label is configured as a regulatory record, it enforces the strictest retention and disposition controls. Regulatory records are immutable by design; once applied, no user—regardless of permissions—can edit or delete the content. This is because the label locks the document to prevent any modification or deletion until the retention period expires and a disposition review is completed.

Exam trap

The trap here is that candidates confuse 'regulatory record' with a standard retention label or a legal hold, assuming that edit permissions or audit logging still allow changes, when in fact regulatory records enforce complete immutability.

Why the other options are wrong

A

Regulatory records are immutable; once applied, users cannot edit or delete the content, regardless of permissions. Option A incorrectly suggests editing is allowed.

C

A regulatory record label in Microsoft Purview locks content, preventing any edits or deletions by users, even those with edit permissions. Option C incorrectly suggests edits are allowed and only logged.

D

A regulatory record label in Microsoft Purview imposes strict immutability: content cannot be edited or deleted by any user, regardless of permissions. Legal hold is a separate mechanism for preserving content during litigation, not a prerequisite for editing regulatory records.

Practice this question →
62
MCQeasy

A healthcare organization must comply with HIPAA regulations. They need to classify and protect medical records stored in Microsoft 365. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit
B.Microsoft Purview Priva
C.Microsoft Purview Data Lifecycle Management
D.Microsoft Purview Information Protection
AnswerD

Microsoft Purview Information Protection (MIP) is the correct solution because it provides the comprehensive capabilities necessary for data classification and protection, crucial for HIPAA compliance. It enables organizations to discover, classify, and label sensitive data, such as Protected Health Information (PHI), using automated or manual methods. These sensitivity labels can then enforce protective actions like encryption, visual markings, and access restrictions, ensuring PHI is safeguarded throughout its lifecycle.

Why this answer

Microsoft Purview Information Protection (D) is the correct solution because it enables organizations to classify, label, and protect sensitive data—such as medical records—using sensitivity labels and encryption. This directly supports HIPAA compliance by ensuring that protected health information (PHI) is consistently safeguarded across Microsoft 365 services, including Exchange, SharePoint, and OneDrive.

Exam trap

The trap here is that candidates often confuse 'Audit' (logging) or 'Data Lifecycle Management' (retention) with data protection, but only Information Protection provides the classification and encryption capabilities required for HIPAA compliance.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit focuses on logging and investigating user and admin activities, not on classifying or protecting data content. Option B is wrong because Microsoft Purview Priva is designed for privacy management (e.g., subject rights requests and data minimization), not for data classification and protection of medical records. Option C is wrong because Microsoft Purview Data Lifecycle Management handles retention and deletion policies, not the active classification and encryption of sensitive data like medical records.

Practice this question →
63
MCQmedium

A legal team is involved in a lawsuit and needs to ensure that all emails and documents related to the case are preserved in their original state, even if users edit or delete them. They also need the ability to search for these items and export them for legal review. Which Microsoft Purview solution should the compliance team configure to meet these requirements?

A.Microsoft Purview Compliance Manager
B.Microsoft Purview Data Lifecycle Management
C.Microsoft Purview eDiscovery (Standard)
D.Microsoft Purview Audit (Standard)
AnswerC

Microsoft Purview eDiscovery (Standard) is specifically designed to address legal and investigative requirements by enabling organizations to identify, preserve, collect, and export electronically stored information (ESI). It allows legal teams to place immutable legal holds on content across Microsoft 365 services like Exchange, SharePoint, OneDrive, and Teams, preventing modification or deletion. Furthermore, it provides robust content search capabilities and the ability to export collected items in a defensible manner for external review, directly supporting the needs of a lawsuit.

Why this answer

Microsoft Purview eDiscovery (Standard) is the correct solution because it provides the ability to place a legal hold on content (preserving emails and documents in their original state even if users edit or delete them), perform searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams, and export the results for legal review. This directly meets the requirements of preservation, search, and export for litigation.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (retention/deletion) with eDiscovery (preservation/search/export), or mistakenly think Audit (Standard) can preserve and export content when it only records metadata about activities.

Why the other options are wrong

A

Compliance Manager helps assess and manage compliance posture through controls and assessments, but it does not preserve, search, or export content for legal hold or eDiscovery.

B

Data Lifecycle Management focuses on retaining or deleting data based on policies, not on preserving data for legal hold, search, and export. It does not provide the preservation, search, and export capabilities required for litigation.

D

Audit (Standard) logs user and admin activities but does not preserve content in its original state or provide search/export capabilities for legal review; it only records metadata of actions.

Practice this question →
64
MCQeasy

A compliance administrator needs to generate a report showing all user activities related to accessing highly sensitive documents in SharePoint. Which Microsoft Purview solution should they use?

A.Audit (Standard or Premium)
B.eDiscovery
C.Data Loss Prevention
D.Communication Compliance
AnswerA

Microsoft Purview Audit (Standard or Premium) is the correct service for generating reports on user and administrator activities across Microsoft 365 services. It captures a comprehensive record of events, such as file access, mailbox activities, and system configuration changes, which are crucial for forensic investigations, regulatory compliance, and internal policy adherence. The unified audit log allows compliance administrators to search, filter, and export these activity records to demonstrate compliance with various regulations.

Why this answer

Audit (Standard or Premium) logs and records all user activities, including access to highly sensitive documents in SharePoint. Audit (Premium) provides deeper visibility with events like 'FileAccessed' and 'SensitivityLabelApplied', enabling compliance administrators to generate detailed reports on who accessed sensitive content and when.

Exam trap

The trap here is that candidates often confuse eDiscovery (which finds content) with Audit (which tracks activities), assuming both can generate activity reports, but only Audit captures the specific user actions needed for this scenario.

How to eliminate wrong answers

Option B (eDiscovery) is wrong because it is designed for searching and exporting content for legal or investigative purposes, not for generating activity reports on user access to documents. Option C (Data Loss Prevention) is wrong because it focuses on preventing unauthorized sharing or leakage of sensitive data through policies and alerts, not on auditing historical access activities. Option D (Communication Compliance) is wrong because it monitors communications (e.g., email, Teams) for policy violations like harassment or insider trading, not SharePoint document access events.

Practice this question →
65
Multi-Selecthard

Which TWO scenarios are appropriate uses of Microsoft Purview Audit (Standard)?

Select 2 answers
A.Investigating a user who accessed a sensitive file in SharePoint.
B.Searching the audit log for admin activities in the past 60 days.
C.Generating custom reports with PowerShell for all activities.
D.Tracking when sensitivity labels are applied to documents.
E.Retaining audit logs for 2 years for compliance purposes.
AnswersA, B

Microsoft Purview Audit (Standard) is specifically designed to capture and log user activities across Microsoft 365 services, including SharePoint Online. This capability allows security administrators to efficiently search the unified audit log for specific events, such as a user accessing, viewing, or downloading a sensitive file, making it an appropriate and primary tool for investigating potential data breaches or unauthorized access incidents.

Why this answer

Microsoft Purview Audit (Standard) logs key events such as file access and admin activities, and retains logs for 90 days. Option A is correct because accessing a sensitive file in SharePoint generates an audit event captured by Audit (Standard). Option B is correct because searching the audit log for admin activities within the 90-day retention period is a core capability of Audit (Standard).

Exam trap

The trap here is that candidates assume all audit events are available in Audit (Standard), but Microsoft deliberately restricts high-value events like sensitivity label tracking and long-term retention to Audit (Premium), making options D and E tempting but incorrect.

Practice this question →
66
MCQhard

Your company uses Microsoft Purview Communication Compliance to detect and remediate inappropriate messages. You need to create a policy that monitors Microsoft Teams chats for potential harassment. Which type of policy should you create?

A.Data Loss Prevention (DLP) policy
B.Information Barriers policy
C.Communication Compliance policy
D.Retention policy
AnswerC

A Communication Compliance policy is specifically engineered within Microsoft Purview to detect, investigate, and remediate inappropriate messages across various Microsoft 365 communication channels, including Microsoft Teams, Exchange email, and Viva Engage. These policies leverage machine learning, keyword dictionaries, and trainable classifiers to identify content related to harassment, threats, sensitive information sharing, or regulatory violations. It provides a robust framework for organizations to proactively manage and mitigate communication risks, directly addressing the need to monitor for inappropriate messages.

Why this answer

Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate messages, such as harassment, in Microsoft Teams chats and other communication channels. It uses customizable policies to scan for offensive language, sensitive information, or policy violations, enabling organizations to enforce internal compliance rules.

Exam trap

The trap here is that candidates may confuse Communication Compliance with Data Loss Prevention (DLP), as both involve monitoring content, but DLP is focused on data protection (e.g., credit card numbers) while Communication Compliance targets behavioral policy violations like harassment.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy focuses on preventing the unauthorized sharing of sensitive data (e.g., credit card numbers, PII) rather than detecting harassment or inappropriate content in communications. Option B is wrong because an Information Barriers policy is used to restrict communication and collaboration between specific groups or users to prevent conflicts of interest, not to monitor for harassment. Option D is wrong because a Retention policy governs how long data is kept or deleted, not the detection or remediation of inappropriate messages.

Practice this question →
67
MCQhard

You are designing a compliance solution for a global company. You need to ensure that data stored in SharePoint Online is not accessible from a specific geographic region. Which Microsoft Purview feature should you use?

A.Compliance boundaries
B.Data loss prevention policy
C.Retention policy
D.Sensitivity labels
AnswerA

Compliance boundaries are used to define eDiscovery and audit scoping, not to restrict data access based on geographic region. They do not block access from a specific region.

Why this answer

This question is problematic because no Microsoft Purview feature listed directly restricts SharePoint Online data access based on geographic region. Compliance boundaries (A) are for eDiscovery scoping, not access control. Data loss prevention policies (B) prevent data loss but do not block access by region.

Retention policies (C) manage data lifecycle, not access. Sensitivity labels (D) classify and protect data but cannot enforce geographic restrictions on their own. For this requirement, you would use a non-Purview feature such as Conditional Access in Microsoft Entra ID or Multi-Geo capabilities.

Exam trap

The trap is that candidates often mistakenly believe Compliance boundaries can control data access by location, when in fact they are limited to eDiscovery and audit scoping. For geographic access restrictions, you would need Conditional Access (Entra ID) or Multi-Geo, which are not Purview features.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) policies are designed to detect and prevent the accidental sharing of sensitive information (e.g., credit card numbers, PII) based on content inspection, not to restrict access based on geographic location. Option C is wrong because retention policies are used to preserve or delete data after a specified period for compliance or legal hold purposes, not to control access from specific regions. Option D is wrong because sensitivity labels classify and protect data with encryption or visual markings, but they do not provide geographic access restrictions; they control who can access data based on label permissions, not where the access originates.

Practice this question →
68
MCQeasy

Your organization wants to classify documents based on whether they contain confidential business information like trade secrets. You need to use a classifier that learns from example documents. What should you use?

A.Trainable classifier
B.Exact data match
C.Data loss prevention policy
D.Sensitive information type
AnswerA

Trainable classifiers are machine learning-based solutions in Microsoft Purview that enable organizations to identify and classify custom content types by learning from example documents. Administrators provide positive and negative examples, allowing the classifier to recognize specific categories of information, such as legal contracts or project specifications, that cannot be easily defined by simple patterns. This adaptive approach is ideal for nuanced document classification where the content's meaning, rather than just specific keywords or patterns, determines its category.

Why this answer

A trainable classifier is the correct choice because it uses machine learning to analyze example documents and learn patterns that distinguish content containing confidential business information, such as trade secrets. Unlike predefined sensitive information types, trainable classifiers can be customized to identify unique or proprietary content by training on your specific sample documents. This aligns with the requirement to 'learn from example documents' rather than relying on fixed patterns or exact matches.

Exam trap

The trap here is that candidates confuse 'trainable classifier' with 'sensitive information type' because both can be used in DLP policies, but only trainable classifiers learn from example documents via machine learning, whereas SITs rely on static patterns or exact data matching.

How to eliminate wrong answers

Option B is wrong because Exact Data Match (EDM) uses a database of exact strings (e.g., employee IDs) to match against, not learning from example documents; it cannot generalize to identify trade secrets. Option C is wrong because a Data Loss Prevention (DLP) policy is a rule-based enforcement mechanism that applies classifiers or conditions to prevent data exfiltration, but it is not itself a classifier that learns from examples. Option D is wrong because a Sensitive Information Type (SIT) is a predefined pattern (e.g., credit card numbers via regex) or a custom pattern you define manually, not a machine learning model that learns from example documents.

Practice this question →
69
MCQmedium

Refer to the exhibit. An administrator runs this PowerShell command. What is the purpose of this command?

A.To set a retention policy for the HR site.
B.To apply a retention label to all files in the HR site.
C.To delete all files in the HR site that were accessed in the last 90 days.
D.To retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.
AnswerD

The `Search-UnifiedAuditLog` cmdlet, combined with the `-Operations FileAccessed, FileModified` parameters, precisely targets the auditing of these specific file activities. The `-SiteIds` parameter scopes the search to the designated HR SharePoint site, and the `-StartDate` and `-EndDate` parameters accurately define the 90-day look-back period. This command effectively retrieves a comprehensive list of audit records detailing when files were accessed or modified within that specific site and timeframe.

Why this answer

The PowerShell cmdlet `Search-UnifiedAuditLog` is used to retrieve audit records from the Microsoft 365 unified audit log. The `-StartDate` and `-EndDate` parameters define the time range (last 90 days), and the `-RecordType` parameter filters for SharePoint audit events. The `-Operations` parameter with `FileAccessed` and `FileModified` specifies that only file access and modification events should be returned, making this command's purpose to retrieve audit records of file access and modifications in the HR SharePoint site from the last 90 days.

Exam trap

The trap here is that candidates may confuse the `Search-UnifiedAuditLog` cmdlet with cmdlets that manage retention or deletion, because the question mentions 'files' and '90 days' which can mislead test-takers into thinking it applies a policy or deletes data, when in fact it only retrieves audit records.

How to eliminate wrong answers

Option A is wrong because `Search-UnifiedAuditLog` retrieves audit records, not sets retention policies; retention policies are configured using `New-RetentionCompliancePolicy` or the Compliance Center. Option B is wrong because applying a retention label requires cmdlets like `Set-ComplianceTag` or `Publish-ComplianceTag`, and this command does not label files—it only searches audit logs. Option C is wrong because deleting files would require cmdlets like `Remove-PnPFile` or SharePoint Online management commands, and this command only retrieves audit log entries; it does not perform any deletion actions.

Practice this question →
70
MCQeasy

Your organization wants to audit all activities related to accessing sensitive files in Microsoft SharePoint. Which Microsoft Purview solution should you use?

A.Audit (Premium)
B.Data lifecycle management
C.Information barriers
D.Data loss prevention
AnswerA

Microsoft Purview Audit (Premium) provides advanced auditing capabilities, including extended retention of audit logs (up to 10 years), intelligent insights, and access to high-value audit events crucial for forensic investigations. It captures a comprehensive record of user and admin activities across Microsoft 365 services, enabling organizations to track who accessed what, when, and from where, which is essential for security and compliance audits.

Why this answer

Audit (Premium) in Microsoft Purview provides detailed logging of user and admin activities, including granular events like file access, modification, and permission changes in SharePoint. This solution enables organizations to investigate and audit all activities related to sensitive files by capturing and retaining audit records with high-volume event support and custom alerting.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with auditing, because DLP also monitors sensitive files, but DLP focuses on preventing data exfiltration rather than providing a retrospective audit trail of all access activities.

How to eliminate wrong answers

Option B (Data lifecycle management) is wrong because it focuses on retaining, deleting, or archiving data based on policies, not on auditing access activities. Option C (Information barriers) is wrong because it restricts communication and collaboration between specific user groups to prevent conflicts of interest, not to audit file access. Option D (Data loss prevention) is wrong because it detects and prevents unauthorized sharing or leakage of sensitive data, but it does not provide a comprehensive audit trail of all access activities.

Practice this question →
71
Drag & Dropmedium

Arrange the steps to conduct a data classification scan using Microsoft Purview Information Protection.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Data classification involves creating labels, publishing them, setting auto-labeling rules, running scans, and reviewing results.

Practice this question →
72
MCQmedium

A healthcare organization uses Microsoft 365. They need to prevent employees from sharing emails or documents that contain patient medical record numbers (MRNs) with external recipients. If an attempt is made, the message should be blocked and the sender should receive a policy tip notification. Which Microsoft Purview solution should they configure?

A.Data Lifecycle Management
B.Records Management
C.Data Loss Prevention (DLP)
D.Information Protection
AnswerC

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including email, SharePoint, and OneDrive. DLP policies leverage sensitive information types (SITs) to detect patterns like Medical Record Numbers (MRNs) within content. Upon detection, these policies can be configured to automatically block sharing with external recipients, provide policy tips to users, and generate alerts for administrators, thereby preventing unauthorized data exfiltration.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as patient medical record numbers (MRNs), with external recipients. DLP policies can be configured to scan emails and documents for patterns (e.g., regex for MRNs), block the transmission, and display a policy tip notification to the sender, meeting all requirements.

Exam trap

The trap here is that candidates often confuse Information Protection (sensitivity labels) with DLP, but labels alone do not block sharing or provide policy tips—they require DLP policies for enforcement.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management focuses on retaining and deleting data based on age or compliance requirements, not on preventing real-time sharing of sensitive data. Option B is wrong because Records Management is used to declare records, apply retention labels, and manage disposition, not to block external sharing or provide policy tips. Option D is wrong because Information Protection (e.g., sensitivity labels) applies classification and encryption but does not inherently block external sharing or trigger policy tip notifications; it requires integration with DLP for enforcement.

Practice this question →
73
MCQhard

A security team needs to investigate a potential data breach that may involve unauthorized access to sensitive files in SharePoint Online and OneDrive for Business. They want to search the unified audit log for file access events, including accesses from mobile devices and third-party applications. Additionally, they need to create custom alert policies that trigger when specific high-privilege users download large volumes of files in a short period. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit (Premium)
B.Microsoft Purview eDiscovery (Premium)
C.Microsoft Purview Data Lifecycle Management
D.Microsoft Purview Communication Compliance
AnswerA

Microsoft Purview Audit (Premium) is the correct choice because it provides advanced capabilities essential for investigating a data breach. It offers extended retention of audit logs, granular logging of user and admin activities across Microsoft 365 services like SharePoint, OneDrive, and Exchange, and the ability to create custom alert policies. These features enable security teams to conduct thorough forensic analysis, track suspicious activities, and identify the scope and impact of a potential breach.

Why this answer

Microsoft Purview Audit (Premium) is the correct solution because it provides the deep, granular logging required to investigate data breaches, including file access events from mobile devices and third-party applications in SharePoint Online and OneDrive for Business. It also supports the creation of custom alert policies that can trigger on specific activities, such as high-privilege users downloading large volumes of files in a short period, by leveraging the unified audit log's rich schema and advanced detection capabilities.

Exam trap

The trap here is that candidates often confuse eDiscovery (Premium) with audit capabilities, but eDiscovery is for searching and preserving content for legal cases, not for real-time monitoring or alerting on access patterns.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview eDiscovery (Premium) is designed for legal discovery and holds, not for real-time monitoring or custom alert policies on file access patterns. Option C is wrong because Microsoft Purview Data Lifecycle Management focuses on retention, deletion, and classification of data, not on auditing or alerting for unauthorized access events. Option D is wrong because Microsoft Purview Communication Compliance is used to detect policy violations in communications (e.g., emails, Teams messages), not to audit file access or create alerts for download anomalies.

Practice this question →
74
MCQmedium

Refer to the exhibit. A compliance administrator runs the PowerShell commands to create a DLP policy. Users complain that they are blocked from sending emails containing credit card numbers but cannot override the block. The administrator wants to allow override with a business justification. What should they do?

A.Change the SentInfo parameter to a different sensitive info type.
B.Remove the SharePoint location from the policy.
C.Enable the DLP policy by setting the Policy's Enabled parameter to $true.
D.Change the NotifyAllowOverride parameter to $true in the rule.
AnswerD

Setting NotifyAllowOverride to $true allows users to override the block with justification.

Why this answer

The `NotifyAllowOverride` parameter controls whether users can override a DLP rule action with a business justification. Setting it to `$true` enables the override prompt, allowing users to bypass the block when they provide a valid reason. The current policy blocks emails with credit card numbers without offering this option, so changing this parameter directly addresses the requirement.

Exam trap

The trap here is that candidates often confuse enabling a policy (Option C) with enabling override behavior, not realizing that a policy can be active and blocking but still lack the override mechanism unless `NotifyAllowOverride` is explicitly set to `$true`.

How to eliminate wrong answers

Option A is wrong because changing `SentInfo` to a different sensitive info type would alter which data the policy detects, not enable override functionality; the issue is about blocking behavior, not detection scope. Option B is wrong because removing the SharePoint location from the policy does not affect email blocking or override capabilities; it only removes coverage for SharePoint content. Option C is wrong because enabling the policy (setting `Enabled` to `$true`) would activate it if it were disabled, but the users are already being blocked, indicating the policy is already enabled; the problem is the lack of an override mechanism, not policy activation.

Practice this question →
75
MCQmedium

Your organization is required to retain all HR-related documents for 7 years after an employee leaves. After that period, the documents must be permanently deleted. Which two Microsoft Purview features should you use together?

A.eDiscovery and audit logs
B.DLP policies and sensitivity labels
C.Sensitivity labels and auto-labeling
D.Retention labels and retention policies
AnswerD

Retention labels are applied directly to individual items like emails or documents, allowing for granular control over their retention and disposition based on content type or business function. Retention policies, conversely, are applied to entire locations such as Exchange mailboxes, SharePoint sites, or Teams channels, enforcing a baseline retention schedule for all content within that location. Together, these mechanisms ensure that data is retained for its required lifecycle and then appropriately disposed of, meeting regulatory and organizational compliance obligations.

Why this answer

Retention labels and retention policies. Retention labels allow you to apply retention settings (e.g., retain for 7 years then delete) to specific documents, while retention policies enforce those settings at the location level (e.g., all HR document libraries). Option A (eDiscovery and audit logs) is for search and audit, not retention.

Option B (DLP policies and sensitivity labels) is for data protection and classification, not retention. Option C (Sensitivity labels and auto-labeling) is for classification and automated labeling, not retention.

Practice this question →
Page 1 of 5 · 302 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Describe the capabilities of Microsoft compliance solutions questions.

Start 20-question session