CCNA Describe the capabilities of Microsoft compliance solutions Questions — Page 2 of 4

MCQeasy

Your organization needs to classify documents containing personally identifiable information (PII) like social security numbers. Which Microsoft Purview solution should you configure?

A.Information Protection

B.Records Management

C.Auditing

D.Communication Compliance

AnswerA

Information Protection is the correct solution because it specifically provides capabilities to classify and label sensitive data within documents, whether manually by users or automatically based on content inspection. This service, often delivered through Microsoft Purview Information Protection (MPIP), enables organizations to apply sensitivity labels that not only categorize data but also enforce protective actions like encryption, access restrictions, and visual markings, directly addressing the need to classify documents containing specific information.

Why this answer

Microsoft Purview Information Protection (A) is the correct solution because it provides classification and labeling capabilities specifically designed to identify, label, and protect sensitive data such as PII (e.g., social security numbers). It uses trainable classifiers and exact data match (EDM) to automatically detect sensitive content and apply appropriate protection actions like encryption or access restrictions.

Exam trap

The trap here is that candidates often confuse Records Management (which deals with retention and deletion) with Information Protection (which deals with classification and labeling), leading them to select B when the question explicitly asks about classifying documents containing PII.

How to eliminate wrong answers

Option B (Records Management) is wrong because it focuses on managing the lifecycle of records (retention, deletion, and disposition) rather than classifying or protecting sensitive content like PII. Option C (Auditing) is wrong because it logs user and admin activities for compliance review but does not perform classification or protection of documents. Option D (Communication Compliance) is wrong because it monitors communications (e.g., emails, Teams messages) for policy violations like harassment or insider trading, not for classifying documents containing PII.

Practice this question →

MCQmedium

A financial services company is required by regulation to prevent sensitive customer financial information from being shared externally via email. The compliance team wants to automatically scan all outgoing emails for patterns that match credit card numbers or account numbers. If a match is found, the email should be blocked and the sender should receive a policy tip. Which Microsoft Purview solution should be configured?

A.Microsoft Purview Audit

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview eDiscovery

AnswerC

Microsoft Purview Data Loss Prevention (DLP) proactively identifies, monitors, and protects sensitive information across Microsoft 365 services like Exchange Online, SharePoint Online, and OneDrive for Business. It uses policies to detect specific sensitive information types, such as credit card numbers or financial account details, within content. Upon detection, DLP can automatically block sharing, encrypt files, notify administrators, or provide policy tips to users, thereby preventing unauthorized data exfiltration and ensuring regulatory compliance.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive information—such as credit card numbers and account numbers—in outgoing emails. DLP policies can scan email content and attachments for predefined sensitive information types, and when a match is found, the email can be blocked and a policy tip sent to the sender, meeting the compliance requirement.

Exam trap

The trap here is that candidates may confuse DLP with eDiscovery or Audit because all three involve compliance, but only DLP provides proactive, real-time blocking and notification for outbound sensitive data.

Why the other options are wrong

Microsoft Purview Audit logs user and admin activities but does not scan or block outgoing emails for sensitive content like credit card numbers.

Microsoft Purview Data Lifecycle Management manages retention and deletion of data, not real-time scanning and blocking of outbound emails for sensitive content like credit card numbers.

Microsoft Purview eDiscovery is used for searching and exporting content from Exchange, SharePoint, and Teams for legal investigations, not for real-time scanning and blocking of outgoing emails containing sensitive data.

Practice this question →

MCQhard

A financial services organization must comply with a regulation that requires all communications related to trades (including emails and Teams messages) to be retained for a period of 7 years. During retention, no user may edit or delete these records. After the 7 years, the records must be disposed of with an irreversible deletion that is verified by a compliance officer. Which Microsoft Purview solution should the organization use to enforce both retention and regulatory disposition?

A.Microsoft Purview Records Management (regulatory retention label)

B.Microsoft Purview Data Lifecycle Management (standard retention label)

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Insider Risk Management

AnswerA

Records Management with a retention label marked as a regulatory record permanently locks the content, preventing any modification or deletion during the retention period. It also supports disposition workflows to require approval before permanent deletion.

Why this answer

Microsoft Purview Records Management with a regulatory retention label is the correct solution because it enforces immutable retention (no user edits or deletions) and mandates a disposition review by a compliance officer before irreversible deletion. Regulatory labels lock the retention policy at the highest level, preventing any user or administrator from shortening the retention period or bypassing the disposition workflow, which aligns with the 7-year retention and verified disposal requirement.

Exam trap

The trap here is that candidates confuse 'standard retention labels' (which allow edits and deletions by authorized users) with 'regulatory retention labels' (which enforce immutable retention and require disposition review), leading them to select Data Lifecycle Management instead of Records Management.

Why the other options are wrong

Standard retention labels in Data Lifecycle Management do not support regulatory disposition with irreversible deletion verified by a compliance officer; they lack the 'regulatory' record type and disposition verification workflow required by the regulation.

Communication Compliance is designed to detect and review communications that violate organizational policies (e.g., insider trading, harassment), not to enforce immutable retention or regulatory disposition. It does not provide the required 7-year retention with irreversible deletion and compliance officer verification.

Insider Risk Management is designed to detect, investigate, and act on risky user activities (e.g., data leaks, policy violations), not to enforce retention or regulatory disposition of records. It lacks the ability to apply retention labels or trigger irreversible deletion after a fixed period.

Practice this question →

MCQeasy

Refer to the exhibit. The JSON snippet shows a sensitivity label configuration. What is the purpose of the 'SensitiveInfoTypes' property in this label?

A.It sets the retention period for content with this label.

B.It defines the user groups that can apply this label manually.

C.It specifies the sensitive information types that trigger automatic labeling.

D.It configures the encryption settings for the label.

AnswerC

This property precisely specifies the sensitive information types (SITs) that, when detected in content, will trigger the automatic application of this sensitivity label. These SITs act as conditions, allowing the system to identify and classify documents or emails containing specific patterns, such as credit card numbers or national identification numbers, without requiring manual user intervention, thereby enforcing data protection policies automatically.

Why this answer

The 'SensitiveInfoTypes' property in a sensitivity label configuration specifies which built-in or custom sensitive information types (e.g., credit card numbers, passport numbers) should be detected in content. When these types are matched, the label can be applied automatically through auto-labeling policies, ensuring consistent protection without requiring manual user action.

Exam trap

The trap here is that candidates often confuse the 'SensitiveInfoTypes' property with encryption or retention settings, because all three are configurable within a sensitivity label's wizard, but each serves a distinct purpose and is located in separate sections of the label configuration.

How to eliminate wrong answers

Option A is wrong because retention periods are configured via retention labels and policies, not through the 'SensitiveInfoTypes' property of a sensitivity label. Option B is wrong because user groups that can apply a label manually are defined in the label's scope and permissions settings, not by referencing sensitive information types. Option D is wrong because encryption settings (e.g., 'protect with encryption') are configured separately within the label's 'Encryption' section, not by the 'SensitiveInfoTypes' property.

Practice this question →

MCQhard

A financial institution uses Microsoft 365 and must ensure that Microsoft support engineers cannot access the institution's content (e.g., Exchange Online mailboxes, SharePoint sites) without explicit approval from the institution's compliance officer. The compliance officer needs to review and approve or reject each access request. Which Microsoft Purview feature should be configured?

A.Customer Lockbox

B.Communication Compliance

C.Insider Risk Management

D.Data Lifecycle Management

AnswerA

Customer Lockbox for Microsoft 365 provides an explicit, auditable workflow for customer approval when a Microsoft engineer needs to access customer content to resolve a support issue. This feature ensures that no Microsoft support personnel can gain access to customer data without the customer's designated approver, such as a compliance officer, granting explicit permission for each specific access request. It directly addresses the requirement for a financial institution to control and approve any potential access to their sensitive data by external parties, including Microsoft support.

Why this answer

Customer Lockbox is the correct feature because it provides a controlled access approval process for Microsoft support engineers to access customer content. When a support case requires access to Exchange Online mailboxes or SharePoint sites, Customer Lockbox ensures the request is sent to the institution's compliance officer for explicit approval or rejection before access is granted, meeting the requirement for explicit approval.

Exam trap

The trap here is that candidates often confuse Customer Lockbox with Insider Risk Management, mistakenly thinking that controlling internal user access is the same as controlling Microsoft support access, but Customer Lockbox is specifically designed for external support engineer access approval workflows.

Why the other options are wrong

Communication Compliance is designed to detect and review internal/external communications for policy violations (e.g., offensive language, insider trading), not to control Microsoft support engineers' access to customer content.

Insider Risk Management is designed to detect and investigate risky user activities (e.g., data leaks, policy violations) but does not control or require approval for Microsoft support engineers' access to customer content.

Data Lifecycle Management governs retention and deletion of data based on policies, not controlling Microsoft support engineers' access to content. It does not provide approval workflows for access requests.

Practice this question →

MCQmedium

Your organization uses Microsoft Purview eDiscovery to manage a legal case. You need to place a hold on emails for specific users, but you want to allow the system to apply the hold automatically. Which eDiscovery solution should you use?

A.Microsoft Purview eDiscovery (Standard)

B.Microsoft Purview Audit (Premium)

C.Microsoft Purview Communication Compliance

D.Microsoft Purview eDiscovery (Premium)

AnswerD

Microsoft Purview eDiscovery (Premium) is the advanced solution specifically engineered to manage complex eDiscovery workflows, including the crucial capability of automatic legal holds. It enables organizations to identify custodians, automatically place legal holds on their associated data sources (e.g., Exchange mailboxes, SharePoint sites, OneDrive accounts, Teams chats), and manage these holds centrally. This automation ensures that relevant data is preserved efficiently and consistently across the organization, significantly reducing manual effort and the risk of data spoliation during litigation or investigations.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct choice because it provides advanced legal hold capabilities, including the ability to apply holds automatically based on specified criteria such as user mailboxes or SharePoint sites. Unlike the Standard version, Premium supports policy-based holds that can be set to trigger automatically without manual intervention, which is essential for managing legal cases efficiently.

Exam trap

The trap here is that candidates often confuse eDiscovery (Standard) with eDiscovery (Premium), assuming both can handle automatic holds, but only Premium supports policy-driven, automated hold placement.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview eDiscovery (Standard) only supports manual holds that require an administrator to place and manage each hold individually, lacking the automatic hold functionality described in the question. Option B is wrong because Microsoft Purview Audit (Premium) is focused on logging and investigating user activity, not on placing holds on content for legal cases. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect and manage policy violations in communications (e.g., inappropriate language or sensitive information), not to place legal holds on emails.

Practice this question →

MCQeasy

A company wants to automatically apply a 'Confidential' sensitivity label to all documents containing credit card numbers. Which Microsoft Purview feature should be used to create the auto-labeling policy?

A.Microsoft Purview Data Loss Prevention

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Auto-labeling policies

AnswerD

Microsoft Purview Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content at rest or in transit across Microsoft 365 services. These policies leverage conditions such as sensitive information types, keywords, or trainable classifiers to identify specific content patterns. Upon a match, the designated sensitivity label, like 'confidential,' is automatically applied, ensuring consistent data classification without manual user intervention.

Why this answer

Microsoft Purview Auto-labeling policies are specifically designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This feature uses exact data match or pattern-based detection to label content at rest or in transit, fulfilling the requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Data Loss Prevention (DLP) with auto-labeling because both deal with sensitive data, but DLP enforces actions like blocking or alerting, not applying sensitivity labels automatically.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Loss Prevention (DLP) is focused on preventing unauthorized sharing or leakage of sensitive data by enforcing policies on endpoints, apps, and networks, not on automatically applying sensitivity labels. Option B is wrong because Microsoft Purview Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) by analyzing messages, not to auto-label documents based on content patterns. Option C is wrong because Microsoft Purview Data Lifecycle Management (formerly Records Management) handles retention, deletion, and disposition of data, not the automatic application of sensitivity labels based on content inspection.

Practice this question →

MCQmedium

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

A.Run the Information Barriers policy in test mode

B.Define user segments in the Microsoft Purview compliance portal

C.Enable audit logging and then run the policy application

D.Use the Compliance Manager assessment for Information Barriers

AnswerA

Running an Information Barriers policy in test mode is the correct approach because it simulates the policy's enforcement without actually blocking any communications. This mode generates a detailed report outlining which users and communications would be affected by the policy, allowing administrators to review potential impacts, identify unintended restrictions, and refine the policy configuration before full activation. It provides a safe, non-disruptive method to validate the policy's effectiveness and accuracy against the organization's requirements.

Why this answer

Microsoft Purview Information Barriers include a dedicated test mode that allows administrators to validate policy behavior against user segments before enforcement. Running the policy in test mode evaluates whether communications between specified segments are correctly blocked or allowed, without actually preventing messages, enabling safe validation of the configuration.

Exam trap

The trap here is that candidates may confuse prerequisite configuration steps (like defining segments or enabling audit logging) with the actual testing mechanism, or assume that Compliance Manager can validate Information Barrier policies when it is designed for broader compliance posture assessment.

How to eliminate wrong answers

Option B is wrong because defining user segments is a prerequisite step for creating Information Barrier policies, not a method to test the configuration before enforcement. Option C is wrong because enabling audit logging captures events for compliance review but does not simulate or test the blocking behavior of Information Barrier policies. Option D is wrong because Compliance Manager is a risk assessment tool for regulatory compliance, not a feature for testing Information Barrier policy enforcement.

Practice this question →

MCQeasy

Your organization wants to automatically retain all customer emails for 7 years and then delete them. Which Microsoft Purview feature should you configure?

A.Data Lifecycle Management retention policy

B.Information Protection sensitivity labels

C.Audit log retention

D.eDiscovery hold

AnswerA

A Data Lifecycle Management retention policy is the correct solution because it allows an organization to define how long content should be retained and, optionally, when it should be deleted across various Microsoft 365 services. These policies can be applied broadly to entire locations, such as all Exchange mailboxes or SharePoint sites, ensuring automatic and consistent retention of all customer data according to organizational or regulatory requirements.

Why this answer

Microsoft Purview Data Lifecycle Management retention policies are designed to automatically retain and then delete content (e.g., Exchange emails, SharePoint files, Teams messages) based on a specified retention period. Configuring a retention policy with a 7-year retention period and a delete action after that period meets the requirement to retain customer emails for 7 years and then delete them.

Exam trap

SC-900 often tests the confusion between retention (lifecycle management) and eDiscovery holds—candidates may pick eDiscovery hold thinking it deletes data, but holds only preserve data indefinitely.

How to eliminate wrong answers

Option B is wrong because Information Protection sensitivity labels are used to classify and protect data (e.g., encryption, watermarking), not to enforce retention and deletion schedules. Option C is wrong because Audit log retention (now Audit in Purview) governs the retention of audit records for compliance and investigation, not the lifecycle of customer emails. Option D is wrong because eDiscovery hold is used to preserve content for legal or investigative purposes, and it does not automatically delete content after a period—it prevents deletion.

Practice this question →

Multi-Selecthard

Which TWO of the following are required to use Microsoft Purview Audit (Premium)?

Select 2 answers

A.Unified audit log enabled in the Microsoft 365 Defender portal

B.An E5 or A5 license for each user

C.An Azure subscription for log storage

D.Power BI Pro licenses for all users

E.Microsoft Sentinel enabled

AnswersA, B

Microsoft Purview's auditing capabilities, including Audit (Standard) and Audit (Premium), fundamentally rely on the Unified Audit Log (UAL). The UAL captures a comprehensive record of user and administrator activities across various Microsoft 365 services, making it essential for forensic investigations, compliance, and regulatory adherence. Without the UAL enabled, Purview cannot collect the necessary activity data to provide audit insights or support eDiscovery.

Why this answer

Option A is correct because Microsoft Purview Audit (Premium) builds on the unified audit log, so auditing must first be turned on in the Microsoft 365 Defender portal (or via Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true) before premium features such as longer retention and high-value events can be captured. Option B is correct because Audit (Premium) capabilities are licensed through Microsoft 365 E5/A5 (or the E5/A5 Compliance add-on) assigned to each user whose premium audit data is generated. Option C is not required because audit records are stored in Microsoft's service, not in a customer Azure subscription.

Option D is not required because Power BI Pro is unrelated to audit ingestion or retention. Option E is not required because Microsoft Sentinel is a separate SIEM product and is not a prerequisite for Audit (Premium).

Exam trap

The trap here is that candidates assume an Azure subscription or additional services like Sentinel are required for premium auditing, when in fact the only prerequisites are the unified audit log being enabled and an E5/A5 license per user.

Practice this question →

MCQmedium

A security team needs to investigate a potential data leak where an employee may have emailed sensitive customer information to a competitor. They want to search the unified audit log for specific email activities, such as 'Send' or 'Forward', and generate a detailed report. Which Microsoft Purview solution should they use?

A.Microsoft Purview Compliance Manager

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview Audit (Standard or Premium)

D.Microsoft Purview eDiscovery (Premium)

AnswerC

Microsoft Purview Audit (Standard or Premium) is the essential service for investigating user and administrator activities across Microsoft 365 services, including potential data leaks. It provides access to the unified audit log, which records a vast array of events such as file access, sharing, deletions, and email activities. Investigators can use the Audit log search tool to pinpoint specific actions, users, and timeframes related to a suspected leak, with Premium offering extended retention and advanced capabilities for in-depth forensic analysis.

Why this answer

Microsoft Purview Audit (Standard or Premium) is the correct solution because it captures and logs specific email activities such as 'Send' and 'Forward' from Exchange Online. The security team can search the unified audit log for these operations and export a detailed report for investigation. Compliance Manager, DLP, and eDiscovery do not provide this direct audit log search capability for individual email actions.

Exam trap

The trap here is that candidates confuse Data Loss Prevention (DLP) with audit logging, assuming DLP can retrospectively search for past email actions, when in fact DLP only applies proactive policies and alerts, not historical audit log queries.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Compliance Manager is a risk-assessment and compliance-score tool, not an audit log search tool; it cannot retrieve specific email activities like 'Send' or 'Forward'. Option B is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data leaks by applying policies to block or alert on sensitive content, but it does not provide a searchable audit log of past email actions for forensic investigation. Option D is wrong because Microsoft Purview eDiscovery (Premium) is used for legal hold, collection, and review of content for litigation, not for searching the unified audit log for email send/forward events.

Practice this question →

MCQmedium

A company uses Microsoft 365 and must comply with a regulation that requires all business records, including emails and documents, to be retained for exactly 5 years. They need to automatically apply a retention label to any item that contains the keyword 'Contract' when the item is created or modified. Which Microsoft Purview solution should they use to configure this automatic labeling?

A.Data Lifecycle Management

B.Data Loss Prevention (DLP)

C.Audit

D.Compliance Manager

AnswerA

Microsoft Purview Data Lifecycle Management (formerly Information Governance) enables organizations to manage content throughout its lifecycle. It allows the creation of retention labels that can be automatically applied to content in Microsoft 365 locations like Exchange, SharePoint, and OneDrive based on specific conditions, such as keywords, sensitive information types, or trainable classifiers. This capability directly supports compliance regulations by ensuring data is retained or deleted according to policy, without manual intervention, thus meeting the requirement for automatic labeling based on content.

Why this answer

Data Lifecycle Management (DLM) in Microsoft Purview enables automatic retention labeling based on sensitive content, such as keywords like 'Contract'. It uses auto-labeling policies to apply retention labels at the time of creation or modification, ensuring compliance with the 5-year retention requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Data Loss Prevention (DLP), assuming DLP can apply retention labels, but DLP only enforces actions like blocking or warning, not retention labeling.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) policies are designed to prevent unauthorized sharing or leakage of sensitive data, not to apply retention labels for lifecycle management. Option C is wrong because Audit in Microsoft Purview records user and admin activities for forensic analysis, but it cannot automatically label items based on content. Option D is wrong because Compliance Manager provides risk assessments and recommendations for regulatory compliance, but it does not apply retention labels or enforce retention policies.

Practice this question →

MCQmedium

A legal team is handling a lawsuit and needs to gather all electronically stored information (ESI) related to a specific case from across Microsoft 365, including emails, Teams messages, and SharePoint documents. They need to place a hold on the custodians' data to prevent deletion or modification, and then collect, review, and export the data. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview eDiscovery (Standard)

C.Microsoft Purview Audit (Premium)

D.Microsoft Purview Data Lifecycle Management

AnswerA

Microsoft Purview eDiscovery (Premium) is the comprehensive solution specifically engineered for managing the entire electronic discovery workflow required for complex legal cases. It enables legal teams to identify specific custodians, place defensible legal holds on their data across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams, and then perform advanced collection, processing, review, and analysis of electronically stored information (ESI) using features like analytics and predictive coding. This robust capability ensures all relevant data is preserved and efficiently prepared for litigation.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for legal cases, including the ability to place legal holds on custodians' data across Exchange, Teams, SharePoint, and OneDrive to preserve ESI, and then collect, review, and export that data. The Premium tier adds advanced features like custodian management, review sets, and predictive coding, which are essential for complex litigation scenarios.

Exam trap

The trap here is that candidates confuse eDiscovery (Standard) with eDiscovery (Premium), assuming the Standard tier can handle custodian holds and advanced review, but only Premium provides the full legal hold and collection workflow required for complex litigation.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview eDiscovery (Standard) lacks custodian-based holds, advanced review sets, and predictive coding; it is designed for basic search and export, not for managing complex legal holds and multi-source collection. Option C is wrong because Microsoft Purview Audit (Premium) focuses on logging and investigating user and admin activities, not on placing holds or collecting and exporting ESI for litigation. Option D is wrong because Microsoft Purview Data Lifecycle Management is used for retention and deletion policies (e.g., managing data expiration), not for legal hold, collection, or review of ESI in active litigation.

Practice this question →

MCQhard

A legal team is preparing for a lawsuit and needs to perform a detailed investigation of user activities across Microsoft 365 services. They need to view the 'before' and 'after' values whenever a critical item in SharePoint or Exchange is updated or deleted. The investigation requires high-volume export performance and the ability to search by specific activities like 'MailboxFolderAccess' and 'Send'. Which Microsoft Purview solution should be enabled and configured to meet these advanced auditing requirements?

A.Microsoft Purview Audit (Premium)

B.Microsoft Purview Audit (Standard)

C.Microsoft Purview eDiscovery (Standard)

D.Microsoft Purview Data Lifecycle Management

AnswerA

Microsoft Purview Audit (Premium) is the correct choice because it provides the advanced auditing capabilities essential for a comprehensive legal investigation. It offers extended retention of audit logs, high-volume export functionality, and crucially, detailed logging of 'before' and 'after' values for specific activities. This granular detail allows legal teams to perform deep forensic analysis of user actions and content changes, providing irrefutable evidence for a lawsuit.

Why this answer

Microsoft Purview Audit (Premium) is required because it captures detailed 'before' and 'after' values for critical updates and deletions in SharePoint and Exchange, supports high-volume export performance, and allows searching for specific activities like 'MailboxFolderAccess' and 'Send'. These capabilities go beyond the Standard audit log, which only records basic event metadata without the old/new values and lacks the advanced search and export throughput needed for litigation.

Exam trap

The trap here is that candidates confuse Audit (Standard) with Audit (Premium), assuming Standard logs all details, but Standard only records basic metadata without before/after values or high-volume export, which are exclusive to Premium.

Why the other options are wrong

Microsoft Purview Audit (Standard) does not provide the 'before' and 'after' values for updates or deletions, nor does it support high-volume export or search by specific activities like 'MailboxFolderAccess' and 'Send'. These advanced capabilities require Audit (Premium).

Microsoft Purview eDiscovery (Standard) is designed for content search and export for legal cases, not for detailed activity auditing with 'before' and 'after' values or high-volume export of audit logs. The question specifically requires auditing capabilities (viewing changes, searching specific activities), which are provided by Audit (Premium), not eDiscovery.

Data Lifecycle Management focuses on retaining or deleting data based on policies, not on detailed auditing of user activities or viewing before/after values for updates/deletions. It does not provide the high-volume export or specific activity search capabilities required for the legal investigation.

Practice this question →

MCQhard

A company operates in multiple countries and must comply with GDPR (EU) and CCPA (California). The compliance officer needs a single tool to assess the company's compliance posture against both regulations, get a consolidated compliance score, and receive prioritized improvement actions that can be assigned to responsible teams. The tool should also track progress over time. Which Microsoft Purview solution should the compliance officer use?

A.Microsoft Purview Compliance Manager

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview eDiscovery (Standard)

D.Microsoft Purview Insider Risk Management

AnswerA

Microsoft Purview Compliance Manager is specifically designed to help organizations manage their compliance posture against a wide array of international, national, and industry-specific regulations, such as GDPR and CCPA. It provides a comprehensive solution for assessing, monitoring, and improving compliance by offering a compliance score, actionable improvement recommendations, and the ability to assign tasks to meet specific control requirements. This tool is essential for companies operating globally, needing to track their adherence to multiple, evolving regulatory frameworks.

Why this answer

Microsoft Purview Compliance Manager is the correct solution because it provides a unified dashboard to assess compliance posture against multiple regulations like GDPR and CCPA. It offers a consolidated compliance score, prioritized improvement actions that can be assigned to responsible teams, and tracks progress over time through continuous assessments and automated control mapping.

Exam trap

The trap here is that candidates may confuse Compliance Manager's scoring and action assignment features with DLP's data protection policies, but DLP lacks the regulatory assessment and progress tracking capabilities required for this scenario.

Why the other options are wrong

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent unauthorized sharing of sensitive data, not to assess compliance posture against regulations like GDPR and CCPA or provide a consolidated compliance score and prioritized improvement actions.

Microsoft Purview eDiscovery (Standard) is designed for legal discovery and preservation of electronic content, not for assessing compliance posture against regulations like GDPR and CCPA or providing a consolidated compliance score and improvement actions.

Practice this question →

MCQhard

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. An HR manager wants to ensure that employee records are kept for at least 1 year after last modification. The policy is applied to Exchange, SharePoint, and OneDrive. What is the outcome?

A.The policy will not retain content; it will delete matching content after 365 days, which may not be intended

B.Employee records in Exchange are retained for 365 days after last modification, then deleted

C.Employee records in SharePoint are deleted after 365 days from last modification if they have Department=HR

D.The policy retains content for 365 days and then automatically moves to archive

AnswerA

This policy is configured with a "delete" action after 365 days, meaning it will permanently remove content that matches its criteria once the retention period expires. It does not include a "retain" action to preserve content for a specified duration, only to dispose of it. If the intent was to ensure content availability or prevent early deletion, this configuration is counterproductive, as it solely focuses on content disposition.

Why this answer

The policy is configured as 'Delete only' with a retention period of 365 days. This means that after 365 days from the last modification, the content will be permanently deleted. It does not retain content for any minimum period; it simply deletes it after the specified duration.

The HR manager wants to keep records for at least 1 year, but this policy will delete them exactly at the 1-year mark, which may not be intended if the manager expects retention beyond that point or if the policy should also preserve content until deletion.

Exam trap

The trap here is that candidates often confuse 'retention' with 'retain and delete' and assume a retention policy automatically preserves content indefinitely, when in fact a 'Delete only' policy will delete content after the specified period without any retention grace period.

How to eliminate wrong answers

Option B is wrong because it incorrectly implies that Exchange items are retained for 365 days and then deleted, but the policy is applied to all workloads (Exchange, SharePoint, OneDrive) and the outcome is the same: deletion after 365 days, not retention. Option C is wrong because the policy does not include any adaptive scope or filter for Department=HR; it applies to all content in the specified locations, not just HR records. Option D is wrong because the policy is configured as 'Delete only' with no archive action; retention policies in Microsoft Purview do not automatically move content to archive unless a separate archive policy is configured.

Practice this question →

MCQmedium

A company is subject to a legal hold for an ongoing investigation. The IT administrator must prevent the deletion of any documents related to this case across SharePoint Online and OneDrive, overriding any existing deletion policies. Which Microsoft Purview capability should the administrator use?

A.Data Lifecycle Management

B.eDiscovery (Premium)

C.Audit (Premium)

D.Communication Compliance

AnswerB

eDiscovery (Premium) is the correct service for placing content on legal hold. It enables organizations to identify, preserve, collect, process, and review electronically stored information (ESI) for legal or investigative purposes. A key feature is the ability to apply eDiscovery holds to specific content locations, such as mailboxes and SharePoint sites, which prevents the permanent deletion of data, even if existing retention policies would otherwise dictate its removal. This ensures data integrity for ongoing investigations.

Why this answer

eDiscovery (Premium) is the correct choice because it provides legal hold capabilities that can preserve content in SharePoint Online and OneDrive for Business, overriding any deletion policies. When a legal hold is applied via eDiscovery, the system places a hold on the specified locations, preventing permanent deletion or modification of documents until the hold is released. This directly addresses the requirement to prevent deletion of case-related documents during an ongoing investigation.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (which manages retention and deletion policies) with the legal hold capability, not realizing that only eDiscovery (Premium) can override existing policies to preserve content for an investigation.

Why the other options are wrong

Data Lifecycle Management (DLM) governs retention and deletion policies but does not provide the ability to place a legal hold that overrides existing deletion policies. For legal holds, eDiscovery (Premium) is required.

Communication Compliance is designed to detect and manage inappropriate communications (e.g., offensive language, conflicts of interest) but does not provide the ability to place a legal hold to prevent deletion of documents across SharePoint and OneDrive.

Practice this question →

MCQmedium

A company is involved in litigation. The legal team needs to preserve all relevant electronic documents that reside in Exchange Online, SharePoint Online, and OneDrive for Business. They must prevent users from deleting or modifying these documents while the lawsuit is active. Additionally, they need to search across these locations for specific keywords and export the results for review. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Standard or Premium)

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management (retention policies/labels)

D.Microsoft Purview Data Loss Prevention (DLP)

AnswerA

Microsoft Purview eDiscovery (Standard or Premium) is the correct solution because it is specifically designed to identify, preserve, collect, and produce electronically stored information (ESI) for legal and investigative purposes. It enables organizations to place immutable legal holds on content across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams, ensuring data integrity. Furthermore, it provides robust search capabilities to pinpoint relevant information and allows for secure export of collected content in a defensible format for legal review.

Why this answer

Microsoft Purview eDiscovery (Standard or Premium) is the correct solution because it provides end-to-end workflow for legal holds (preservation), content search across Exchange Online, SharePoint Online, and OneDrive for Business, and export of results. The legal hold feature prevents deletion or modification by locking the original content, while the search and export capabilities meet the keyword search and review requirements.

Exam trap

The trap here is that candidates often confuse retention policies (Data Lifecycle Management) with legal holds, but retention policies are for scheduled lifecycle management, not for ad-hoc litigation holds that require immediate preservation and search across multiple workloads.

Why the other options are wrong

Data Lifecycle Management focuses on retaining or deleting data based on policies, not on preserving data for legal hold with search and export capabilities. It does not provide the ability to place a hold on content to prevent modification or deletion during litigation.

Data Loss Prevention (DLP) policies are designed to prevent accidental sharing of sensitive data, not to preserve content for litigation or enable search and export across locations.

Practice this question →

MCQhard

Refer to the exhibit. You run the PowerShell command shown to investigate a potential data exfiltration incident. The output is empty. Which is the most likely reason?

A.The user does not have a mailbox

B.The command syntax is incorrect

C.The user did not download or access any files in the past 7 days

D.Audit logging is not enabled for the tenant

AnswerD

For Search-UnifiedAuditLog to return any audit records, unified audit logging must first be explicitly enabled for the entire Microsoft 365 tenant. If this foundational setting is disabled, no user or administrator activities, including file downloads or access, are recorded in the audit log, regardless of user actions or command syntax. Consequently, any attempt to search the audit log will yield no results, indicating a lack of recorded data rather than a lack of activity or a syntax error.

Why this answer

The Search-UnifiedAuditLog cmdlet retrieves entries from the unified audit log. If the output is empty, the most likely cause is that unified audit logging is not enabled for the tenant. In Microsoft 365, unified audit logging must be turned on in the compliance portal or via PowerShell (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true).

Without this, no audit records are generated, so the cmdlet returns no results regardless of user activity.

Exam trap

Common mistake: Candidates often assume that an empty output from Search-UnifiedAuditLog means no activity occurred. However, the most frequent reason is that unified audit logging is not enabled, which prevents any audit records from being captured.

How to eliminate wrong answers

Option A is wrong because even if the user does not have a mailbox, the cmdlet would return an error (e.g., 'The user does not have a mailbox'), not an empty output. Option B is wrong because the command syntax shown is correct for the Search-MailboxAuditLog cmdlet, as it uses valid parameters (-Identity, -LogonTypes, -StartDate, -EndDate). Option C is wrong because if the user had downloaded or accessed files, the cmdlet would return results only if audit logging were enabled; an empty output does not prove no activity occurred, as the lack of audit logging suppresses all entries.

Practice this question →

MCQeasy

Your organization is implementing a data loss prevention (DLP) policy to prevent sensitive data from being shared via email. Users in the finance department need to send financial reports to external auditors. What should you configure?

A.Add the auditors' domains to a DLP allow list

B.Configure a DLP policy with an override option allowing users to justify the sharing

C.Assign a sensitivity label that automatically encrypts the email

D.Configure a DLP policy with a block action for all external sharing

AnswerB

Configuring a DLP policy with an override option that allows users to justify sharing is the most appropriate solution for balancing security with legitimate business needs. This feature enables organizations to enforce strong data protection while providing a controlled mechanism for users to temporarily bypass a policy when a valid business reason exists, such as sharing specific audit-related documents externally. The justification provided by the user is logged, creating an essential audit trail for compliance and review, ensuring accountability without completely blocking necessary collaboration.

Why this answer

A DLP policy with an override (user override / allow with justification) lets finance users send reports to external auditors while still enforcing the policy — the user must provide a business justification, which is logged for audit. This balances data protection with the legitimate business need, which is exactly what Microsoft Purview DLP user overrides are designed for.

Exam trap

SC-900 often tests the difference between a DLP allow list (permanent bypass) and a user override (justified, audited exception) — candidates pick the allow list because it sounds like the simplest way to let auditors receive mail.

How to eliminate wrong answers

Option A is wrong because adding auditors' domains to a DLP allow list creates a permanent policy exception that bypasses DLP entirely for those domains — it is not scoped to the finance use case and removes the audit trail. Option C is wrong because a sensitivity label with auto-encryption protects the content in transit and at rest but does not govern whether the email can be sent externally; it addresses confidentiality, not DLP policy enforcement. Option D is wrong because a blanket block on all external sharing would prevent the legitimate auditor communication entirely, breaking the business process rather than enabling it.

Practice this question →

MCQhard

Refer to the exhibit. An administrator runs this KQL query in Microsoft Purview Audit. What is the purpose of this query?

A.To find the total number of file uploads by all users in the last 30 days

B.To find files larger than a certain size uploaded by a specific user

C.To list all files deleted by a specific user in the last 30 days

D.To identify file types that a specific user uploaded more than 10 times in the last 30 days

AnswerD

This option accurately describes the KQL query's purpose. The query filters events for a *specific user* within the *last 30 days*, focusing exclusively on *file upload* activities. It then *groups these uploads by file type* and subsequently filters the results to display only those *file types that the user uploaded more than 10 times*, effectively identifying frequently uploaded file types by that individual.

Why this answer

The KQL query uses `| summarize Count = count() by FileType` to group audit log entries by file type, then `| where Count > 10` filters for file types that appear more than 10 times. The `where UserId == 'user@domain.com'` restricts the results to a specific user, and `| where TimeGenerated > ago(30d)` limits the time range to the last 30 days. This directly identifies file types uploaded more than 10 times by that user, matching option D.

Exam trap

The trap here is that candidates may misread the query as counting total uploads (option A) or listing files (option C), but the `summarize by FileType` and `where Count > 10` clearly indicate aggregation by file type with a frequency threshold, not a simple list or total count.

How to eliminate wrong answers

Option A is wrong because the query filters by a specific user (`UserId == 'user@domain.com'`), not all users, and it groups by file type rather than counting total uploads. Option B is wrong because the query does not reference file size at all; there is no `FileSize` field or size comparison operator. Option C is wrong because the query looks for upload operations (implicitly via `Operation == 'FileUploaded'` or similar), not deletions, and it groups by file type rather than listing individual files.

Practice this question →

Multi-Selecteasy

Which THREE of the following are retention actions in Microsoft Purview Data Lifecycle Management? (Select THREE.)

Select 3 answers

A.Delete the content after a specified period

B.Automatically archive the content

C.Apply a sensitivity label to the content

D.Retain the content for a period and then delete it

E.Retain the content for a specified period

AnswersA, D, E

This is a core retention action within Microsoft Purview, designed to ensure that content is permanently removed from an organization's systems after a predefined period. This action is critical for compliance with data privacy regulations like GDPR, which mandate the deletion of personal data once its purpose has been fulfilled. It helps prevent over-retention, reduces data sprawl, and minimizes legal and security risks associated with holding unnecessary data.

Why this answer

In Microsoft Purview Data Lifecycle Management, retention settings define what happens to content when its retention period expires, and the three supported retention actions are: retain only (option E — keep the content for a specified period, with no deletion action), delete only (option A — delete the content after a specified period, applicable when content has no retention requirement), and retain then delete (option D — retain the content for a period and then delete it, the most common action that satisfies both preservation and disposition needs). These three actions map directly to the retention action choices presented when configuring a retention label or retention policy in Purview. Option B is incorrect because automatic archiving is not a retention action in Data Lifecycle Management; archiving is handled through Exchange Online archive mailboxes or third-party/records management features, not as a retention action.

Option C is incorrect because applying a sensitivity label is an Information Protection (Microsoft Purview Information Protection) capability used for classification and encryption, not a retention action, even though retention labels can be applied to content.

Exam trap

The trap here is that candidates confuse 'retention actions' with other compliance actions like archiving or sensitivity labeling, which are separate features in Microsoft Purview, leading them to select options that are not part of Data Lifecycle Management.

Practice this question →

MCQhard

A financial services organization must prevent employees in the Research department from communicating via email or Microsoft Teams with employees in the Investment Banking department to avoid conflicts of interest. Additionally, they need to prevent any credit card numbers from being shared in emails sent to external recipients. Which combination of Microsoft Purview solutions should they implement?

A.Information Barriers and Data Loss Prevention

B.Communication Compliance and Insider Risk Management

C.Information Barriers and Communication Compliance

D.Data Lifecycle Management and Data Loss Prevention

AnswerA

Information Barriers are essential for preventing unauthorized communication and collaboration between specific user groups, fulfilling the "Chinese Wall" requirement in financial services. Complementing this, Data Loss Prevention (DLP) policies actively detect and prevent the sharing of sensitive information, such as credit card numbers, both internally and externally. Together, these solutions provide robust controls for communication segmentation and sensitive data protection, directly addressing both critical organizational needs.

Why this answer

Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest (e.g., research vs. investment banking). Data Loss Prevention (DLP) policies detect and protect sensitive information such as credit card numbers from being shared externally. Communication Compliance focuses on monitoring communications for regulatory compliance but does not block communications, and Insider Risk Management analyzes risky user activities but does not enforce segmentation.

Why the other options are wrong

Communication Compliance monitors for policy violations but does not enforce real-time communication blocks between departments, and Insider Risk Management focuses on detecting risky user activities, not preventing credit card data leakage in emails.

Communication Compliance monitors communications for policy violations but does not enforce restrictions on communication between specific groups; Information Barriers alone cannot prevent data loss of credit card numbers in emails to external recipients.

Data Lifecycle Management (DLM) governs data retention and deletion, not real-time communication restrictions or content scanning for credit card numbers. The question requires both blocking communications between departments (Information Barriers) and preventing credit card data in emails (Data Loss Prevention), which DLM does not address.

Practice this question →

MCQeasy

A compliance officer needs to create a policy that prevents users from sharing files containing medical record numbers (MRN) via email. Which Microsoft Purview solution should they use?

A.Sensitivity labels

B.Data Loss Prevention (DLP)

C.eDiscovery

D.Insider risk management

AnswerB

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations within an organization. A compliance officer can configure DLP policies to detect specific sensitive information types, such as Medical Record Numbers (MRNs), and then enforce actions like blocking emails or other sharing attempts containing that data, thereby directly preventing unauthorized disclosure.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as medical record numbers (MRN), via email. DLP policies can inspect email content and attachments for patterns (e.g., regex for MRNs) and automatically enforce actions like blocking the message or notifying the user, preventing data exfiltration.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which classify and protect data at rest) with DLP (which monitors and controls data in motion), leading them to choose A, even though labels alone cannot block email transmission of sensitive content.

How to eliminate wrong answers

Option A is wrong because sensitivity labels classify and protect data through encryption and visual markings, but they do not actively monitor or block data in transit like email; they are a classification tool, not a real-time enforcement mechanism for sharing. Option C is wrong because eDiscovery is used for searching and exporting content for legal or investigative purposes, not for preventing data loss or blocking file sharing in real time. Option D is wrong because insider risk management focuses on identifying risky user behavior (e.g., unusual file downloads) through analytics and alerts, but it does not directly block file sharing via email; it is a detection and investigation tool, not a prevention control.

Practice this question →

100

MCQmedium

Refer to the exhibit. You are reviewing a Communication Compliance policy. What does this policy do when a user sends an email containing EU GDPR PII to privacy@contoso.com?

A.It blocks the email from being sent.

B.It notifies the policy owner and generates a case for investigation.

C.It automatically deletes the email after 30 days.

D.It applies a sensitivity label to the email.

AnswerB

This option accurately describes the primary actions configured within a Communication Compliance policy when a violation is detected. The system is engineered to notify designated policy owners or reviewers and automatically generate a case within the Microsoft Purview compliance portal. This workflow facilitates a structured investigation and remediation process for identified policy breaches.

Why this answer

Communication Compliance policies in Microsoft 365 are designed to detect and investigate policy violations, not to enforce real-time blocking or automated deletion. When a user sends an email containing EU GDPR PII to a specified recipient like privacy@contoso.com, the policy triggers an alert, notifies the policy owner, and generates a case for investigation in the Compliance Center. This allows organizations to review and remediate potential data privacy violations without disrupting email flow.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention (DLP), assuming that any policy detecting sensitive data will automatically block the email, but Communication Compliance is purely detective and investigative, not preventative.

How to eliminate wrong answers

Option A is wrong because Communication Compliance does not have the capability to block emails from being sent; that function is handled by Data Loss Prevention (DLP) policies, which can enforce real-time blocking actions. Option C is wrong because Communication Compliance does not automatically delete emails after a set period; retention and deletion are managed by retention policies or eDiscovery holds, not by compliance detection policies. Option D is wrong because Communication Compliance does not automatically apply sensitivity labels to emails; label application is performed by auto-labeling policies or manual user action, not by communication compliance rules.

Practice this question →

101

MCQmedium

A consulting firm is involved in a legal investigation. They need to preserve all emails and documents from two specific employees (custodians) related to a contract dispute. The data must be collected and stored in a secure location for legal review without modifying the original data. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.eDiscovery (Premium)

C.Audit (Premium)

D.Communication Compliance

AnswerB

eDiscovery (Premium) is the correct solution as it provides comprehensive capabilities specifically designed for legal investigations. This service allows organizations to identify and preserve relevant custodians, place immutable legal holds on data across various Microsoft 365 services, collect data from diverse sources, and process it into a secure review set for legal analysis without altering the original content, ensuring defensibility in litigation.

Why this answer

eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing you to identify, preserve, collect, and analyze data from custodians (e.g., employees) without altering the original data. It places a legal hold on mailboxes and sites, ensuring that emails and documents related to the contract dispute are stored in a secure review location for legal review, meeting the requirement of non-modification.

Exam trap

The trap here is that candidates often confuse eDiscovery (Premium) with Audit (Premium) because both involve investigation, but Audit only logs events and does not preserve or collect the actual data for legal review.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management (DLM) focuses on automating retention and deletion policies based on data governance rules, not on preserving data for legal hold or custodian-based collection. Option C is wrong because Audit (Premium) provides detailed logging and investigation of user and admin activities, but it does not preserve or collect data for legal review; it only records events. Option D is wrong because Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) using policies, not to preserve or collect data for a legal investigation involving specific custodians.

Practice this question →

102

MCQhard

Your organization has a Microsoft Purview compliance portal. You need to audit who deleted a specific file from SharePoint Online last week. What should you do?

A.Use Content Search in eDiscovery

B.Search the unified audit log in Microsoft Purview

C.Configure a retention policy for SharePoint

D.Review the data classification dashboard

AnswerB

Searching the unified audit log in Microsoft Purview is the correct approach because it provides a comprehensive record of user and administrator activities across a wide range of Microsoft 365 services, including Exchange Online, SharePoint Online, Teams, and Azure Active Directory. This log captures detailed information about specific actions performed, such as file access, permission changes, mailbox operations, and administrative configurations, along with timestamps, user identities, and IP addresses. It is the definitive source for investigating 'who did what, when, and where' within the organization's Microsoft 365 environment.

Why this answer

The unified audit log in Microsoft Purview records all user and admin activities, including file deletions in SharePoint Online. By searching this log, you can find the specific event that shows who deleted the file, when it happened, and from which location. This is the correct tool for auditing past actions like file deletions.

Exam trap

The trap here is that candidates confuse eDiscovery Content Search (which finds content) with the unified audit log (which finds actions), leading them to choose Option A instead of B.

How to eliminate wrong answers

Option A is wrong because Content Search in eDiscovery is designed to find and export content (e.g., emails, documents) based on search queries, not to audit who performed a specific action like deletion. Option C is wrong because a retention policy preserves data for compliance or legal hold purposes but does not log or reveal who deleted a file. Option D is wrong because the data classification dashboard shows sensitivity labels and data types, not a historical log of user actions such as deletions.

Practice this question →

103

MCQeasy

Your organization is implementing Microsoft 365 and needs to prevent sensitive data from being copied to USB drives. Which Microsoft Purview solution should you configure?

A.Audit logs

B.Communication Compliance

C.Sensitivity labels

D.Endpoint data loss prevention (Endpoint DLP)

AnswerD

Endpoint Data Loss Prevention (Endpoint DLP) extends DLP capabilities directly to Windows and macOS devices, enabling organizations to monitor and control sensitive information as it is used, shared, and transferred. It can detect when users attempt to copy sensitive data to removable media (like USB drives), network shares, cloud services, or print it, and then enforce policies to block, audit, or warn the user. This direct control over endpoint actions makes it the ideal solution for preventing data exfiltration via USB drives.

Why this answer

Endpoint DLP (Data Loss Prevention) monitors and controls actions users take on devices, such as copying sensitive data to USB drives. It enforces policies directly on Windows, macOS, and other endpoints to block unauthorized transfers, making it the correct solution for preventing data exfiltration via removable media.

Exam trap

The trap here is that candidates confuse Sensitivity labels with DLP, not realizing labels only classify and encrypt data but lack the endpoint-level enforcement to block physical device transfers.

How to eliminate wrong answers

Option A is wrong because Audit logs only record user activities for forensic review; they do not actively block data transfers. Option B is wrong because Communication Compliance detects and manages inappropriate communications (e.g., harassment, insider trading) but does not control data movement to USB drives. Option C is wrong because Sensitivity labels classify and protect data through encryption and visual markings, but they do not enforce device-level restrictions like blocking USB copies; they rely on other solutions like DLP for such actions.

Practice this question →

104

MCQhard

An organization uses Microsoft Purview Compliance Manager to track compliance with regulations. The compliance officer needs to create a custom assessment for a new internal policy. What should they do?

A.Use the Microsoft 365 admin center to create a compliance assessment.

B.Create a new custom assessment in Compliance Manager and add custom controls.

C.Use the built-in 'Custom' template in Compliance Manager and modify it.

D.Import a new assessment template from the Microsoft Service Trust Portal.

AnswerB

Organizations frequently have unique internal policies or industry-specific regulations not covered by the extensive library of built-in templates. Microsoft Purview Compliance Manager provides the capability to create entirely new custom assessments from scratch. This allows administrators to define specific controls, assign implementation actions, track progress, and manage risks tailored precisely to their unique organizational compliance requirements, ensuring comprehensive coverage.

Why this answer

In Microsoft Purview Compliance Manager, assessments are built on templates that contain controls. To create a custom assessment for a new internal policy, the compliance officer must create a new custom assessment and then add custom controls, because Compliance Manager does not provide a built-in template for arbitrary internal policies. Option B correctly describes this workflow: creating a new custom assessment and adding custom controls.

Exam trap

The trap here is that candidates confuse the ability to modify a built-in template (which does not exist for custom policies) with the correct process of creating a new custom assessment from scratch, leading them to select Option C.

How to eliminate wrong answers

Option A is wrong because the Microsoft 365 admin center does not have the capability to create compliance assessments; that functionality is exclusive to Microsoft Purview Compliance Manager. Option C is wrong because there is no built-in 'Custom' template in Compliance Manager; you must create a new custom assessment from scratch or from a custom template you have created. Option D is wrong because importing a template from the Microsoft Service Trust Portal only provides pre-built regulatory templates, not a way to create a custom assessment for an internal policy.

Practice this question →

105

Multi-Selecteasy

Which TWO of the following are Microsoft Purview compliance solutions?

Select 2 answers

A.Microsoft Entra ID

B.Data Loss Prevention (DLP)

C.eDiscovery

D.Microsoft Intune

E.Microsoft Defender for Cloud

AnswersB, C

Data Loss Prevention (DLP) is a core component of Microsoft Purview compliance solutions, designed to identify, monitor, and automatically protect sensitive information. DLP policies are applied across Microsoft 365 services, endpoints, and on-premises repositories to prevent the unauthorized sharing, transfer, or use of sensitive data. This capability is crucial for maintaining regulatory compliance and safeguarding organizational data.

Why this answer

Data Loss Prevention (DLP) is a Microsoft Purview compliance solution that helps organizations detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers or personally identifiable information (PII), across email, SharePoint, OneDrive, and endpoints. eDiscovery is another Purview compliance solution that allows legal and compliance teams to search, hold, and export content from Microsoft 365 services for litigation or investigation purposes. Both are core capabilities within the Microsoft Purview compliance portal, distinct from identity, device management, or cloud security tools.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID (identity) or Microsoft Intune (device management) as compliance solutions because they are part of the broader Microsoft security ecosystem, but the SC-900 exam specifically tests that Purview compliance solutions are limited to tools like DLP, eDiscovery, Information Protection, and Audit.

Practice this question →

106

MCQhard

Refer to the exhibit. A sensitivity label is configured as shown. Which statement about the label's behavior is accurate?

A.When applied, users can choose who can access the document and what permissions they have.

B.The label disables encryption and only adds a header and footer.

C.The label automatically encrypts the document with a predefined template.

D.The label does not apply any protection; it only adds visual markings.

AnswerA

This option is correct because a sensitivity label configured with 'UserDefined' protection empowers the user applying the label to specify who can access the document and precisely what permissions they possess. Instead of a fixed set of rights, the user can dynamically assign granular access controls, such as view-only, edit, or co-author, to specific individuals or groups at the point of content creation or modification. This provides flexible and context-aware data protection.

Why this answer

The exhibit shows a sensitivity label configured with 'Let users assign permissions' under 'User-defined permissions' in Azure Information Protection. This setting allows end users to define custom permissions (e.g., who can read, edit, or forward) when applying the label, rather than using a fixed template or automatic encryption.

Exam trap

The trap here is that candidates often confuse 'user-defined permissions' with 'no encryption' or 'automatic encryption with a template,' failing to recognize that the exhibit's configuration explicitly enables user-controlled encryption rather than disabling it or using a fixed template.

How to eliminate wrong answers

Option B is wrong because the label does not disable encryption; it enables user-defined encryption, meaning encryption is applied but the user controls the permissions. Option C is wrong because the label does not automatically encrypt with a predefined template; it relies on user-defined permissions, not a fixed template. Option D is wrong because the label does apply protection (encryption) via user-defined permissions, not just visual markings like headers and footers.

Practice this question →

107

MCQhard

A company is involved in a lawsuit. The legal team needs to preserve all emails, documents, and Teams messages from five key employees (custodians) that are related to a specific project. The data must be collected securely and provided for legal review without modifying the original data. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.eDiscovery (Premium)

C.Records Management

D.Communication Compliance

AnswerB

eDiscovery (Premium) is the correct solution as it provides a comprehensive, end-to-end workflow specifically designed for legal discovery requirements within Microsoft 365. It enables legal teams to identify, preserve, collect, process, review, and export data from various sources like Exchange mailboxes, SharePoint sites, and Teams, all while maintaining the integrity of the original data and managing legal holds efficiently for specific custodians.

Why this answer

eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing organizations to identify, preserve, collect, and export relevant data (emails, documents, Teams messages) from custodians without altering the original data. It supports legal hold, advanced search, and secure export for legal review, meeting the lawsuit requirements.

Exam trap

The trap here is that candidates confuse Data Lifecycle Management or Records Management with eDiscovery, but those solutions manage retention and deletion policies rather than providing the custodial hold, search, and export capabilities required for legal preservation and review.

How to eliminate wrong answers

Option A (Data Lifecycle Management) is wrong because it focuses on automating retention and deletion policies for compliance and governance, not on preserving data for legal hold or collecting it for litigation. Option C (Records Management) is wrong because it is used to classify and manage records for regulatory compliance, often with immutable retention, but it does not provide the custodial search, hold, and export capabilities needed for eDiscovery. Option D (Communication Compliance) is wrong because it is designed to detect and mitigate policy violations (e.g., insider trading, harassment) in communications, not to preserve and collect data for legal proceedings.

Practice this question →

108

MCQmedium

A compliance administrator configures the above retention policy. A document created on January 1, 2025, in SharePoint Online will be retained until when?

A.Indefinitely

B.January 1, 2026

C.December 31, 2025

D.January 1, 2025

AnswerC

This option is correct because the retention policy specifies a 365-day period starting from the content creation date. If a document is created on January 1, 2025, counting 365 full days forward means the retention period concludes at the end of December 31, 2025. This ensures the item is preserved for the entire calendar year from its creation, making December 31, 2025, the precise end date for its active retention.

Why this answer

The retention policy uses the 'When created' trigger, so a document created on January 1, 2025 is retained for 365 days from that date, expiring on December 31, 2025. Option A is incorrect because the retention period is finite. Option B is incorrect because the retention duration is 365 days from creation, not from the end of the year.

Option D is incorrect because the retention period does not end on the creation date itself.

Practice this question →

109

MCQhard

A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?

A.Create new assessments for each regulation

B.Configure improvement actions with owners

C.Set up connectors to import external risk data

D.Use the Microsoft 365 admin center to delegate tasks

AnswerB

Configuring improvement actions with owners in Microsoft Purview Compliance Manager is the direct mechanism for operationalizing compliance requirements. These actions represent specific tasks derived from controls and regulations, such as implementing a data encryption policy or updating a privacy notice. Assigning an owner ensures accountability, facilitates the delegation of remediation efforts, and enables tracking of progress and evidence submission, directly addressing the need to comply with regulations like GDPR.

Why this answer

To automatically assign each control to the appropriate team member for remediation in Microsoft Purview Compliance Manager, you must configure improvement actions with owners. Each improvement action can be assigned to a specific user who is responsible for implementing the remediation steps, and this assignment triggers automatic notifications and tracking within the compliance score.

Exam trap

The trap here is that candidates often confuse creating assessments (which organize controls) with the actual assignment of remediation tasks, leading them to choose Option A instead of understanding that improvement actions with owners are the mechanism for automatic assignment.

Why the other options are wrong

Creating new assessments for each regulation helps evaluate compliance but does not automatically assign controls to team members for remediation. The question specifically asks for automatic assignment, which requires configuring improvement actions with owners.

Setting up connectors to import external risk data helps bring in risk signals from outside sources, but it does not automatically assign controls to team members for remediation. The question specifically asks about assigning controls to appropriate team members, which is achieved by configuring improvement actions with owners.

The Microsoft 365 admin center is used for general administrative tasks like user management and service configuration, not for assigning compliance controls to team members. Compliance Manager's improvement actions with owners is the correct feature for this purpose.

Practice this question →

110

MCQmedium

Your organization has a Microsoft Purview Data Lifecycle Management policy that deletes emails after 3 years. A legal hold is placed on a user's mailbox. What happens to the emails?

A.Only emails created before the hold are deleted

B.Emails are preserved and not deleted despite the retention policy

C.Emails are deleted immediately to avoid conflicting policies

D.Emails are deleted after 3 years as per the retention policy

AnswerB

A legal hold, also known as an eDiscovery hold, establishes an absolute preservation requirement that takes precedence over any conflicting retention policies. Its primary function is to ensure that all relevant data, such as emails, remains immutable and discoverable for legal or investigative purposes. This means emails will be preserved and not deleted, even if a retention policy would otherwise dictate their removal, until the hold is explicitly released.

Why this answer

When a legal hold is placed on a user's mailbox in Microsoft Purview, it takes precedence over any deletion actions from Data Lifecycle Management policies. The hold preserves all mailbox content, including emails that would otherwise be deleted after 3 years, ensuring data is retained for legal or compliance purposes. This is because legal holds are designed to prevent permanent deletion of data subject to litigation or investigation.

Exam trap

The trap here is that candidates often assume retention policies always execute deletion regardless of other configurations, but Microsoft Purview explicitly prioritizes holds over deletion actions, making the hold a superseding rule.

How to eliminate wrong answers

Option A is wrong because legal holds preserve all existing emails regardless of creation date, not just those created before the hold; the hold applies to all current content and prevents deletion. Option C is wrong because conflicting policies do not cause immediate deletion; instead, Microsoft Purview resolves conflicts by prioritizing holds over retention deletion actions. Option D is wrong because the legal hold overrides the retention policy's deletion timeline, so emails are not deleted after 3 years while the hold is active.

Practice this question →

111

Matchingmedium

Match each compliance framework to its primary focus.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Data protection and privacy for EU citizens

Information security management system standard

Cybersecurity risk management framework

Healthcare data privacy and security in the US

Service organization controls for data security

Why these pairings

Correct matches: GDPR = data privacy, ISO 27001 = information security management, SOC 2 = trust service criteria. Common confusions include mixing GDPR with financial controls (SOX) or privacy with broader security.

Practice this question →

112

Multi-Selectmedium

Which THREE are benefits of using Microsoft Purview Compliance Manager?

Select 3 answers

A.Create Data Loss Prevention policies.

B.View a compliance score that indicates your overall compliance posture.

C.Assign compliance tasks to other users in your organization.

D.Receive recommendations for improvement actions to achieve compliance.

E.Automatically apply sensitivity labels to documents.

AnswersB, C, D

A core benefit of Microsoft Purview Compliance Manager is its ability to provide a quantifiable compliance score, which serves as a real-time indicator of an organization's overall compliance posture against various regulations and standards. This score is dynamically calculated based on the implementation status of recommended actions and controls, allowing organizations to quickly assess their progress and identify areas needing improvement. It provides a clear, measurable metric for tracking compliance efforts over time.

Why this answer

Option B is correct because Microsoft Purview Compliance Manager provides a compliance score that quantifies your organization's overall compliance posture against regulatory standards and Microsoft 365 baseline controls, updating as you complete improvement actions. Option C is correct because Compliance Manager lets you assign improvement actions and compliance tasks to other users in the organization, tracking who is responsible and the status of each task. Option D is correct because Compliance Manager surfaces recommended improvement actions, prioritized by impact on your compliance score, that guide you toward meeting specific regulations and standards.

Option A is not correct because Data Loss Prevention policies are created and managed in the Microsoft Purview Data Loss Prevention solution, not as a benefit of Compliance Manager. Option E is not correct because automatic sensitivity label application is performed by Microsoft Purview Information Protection features such as auto-labeling policies, not by Compliance Manager.

Exam trap

The trap is confusing Compliance Manager with other Purview solutions like Data Loss Prevention or Information Protection; candidates might think Compliance Manager can create DLP policies or apply labels, but it only assesses and recommends.

Practice this question →

113

MCQmedium

A legal team needs to preserve all electronic documents related to an ongoing lawsuit. These documents reside in Exchange Online mailboxes, SharePoint Online sites, and OneDrive for Business accounts. The team also needs the ability to search across these locations for specific keywords and export the results for review. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Audit

AnswerA

eDiscovery (Premium) provides end-to-end workflow for legal investigations, including identifying and holding relevant data, searching for specific content using keywords and conditions, reviewing results with advanced analytics, and exporting data for external review. It is the appropriate solution for litigation holds and search.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for preserving, searching, and exporting content from Exchange Online mailboxes, SharePoint Online sites, and OneDrive for Business accounts. It supports legal hold to preserve data, keyword search across these sources, and export of results for review, meeting all requirements of the legal team.

Exam trap

The trap here is that candidates confuse eDiscovery with Audit, thinking Audit can search and export content, but Audit only provides activity logs, not the ability to preserve or export the actual documents.

Why the other options are wrong

Microsoft Purview Data Lifecycle Management focuses on retaining or deleting content based on policies, not on preserving data for legal hold or performing search and export across mailboxes, SharePoint, and OneDrive for litigation purposes.

Data Loss Prevention (DLP) policies prevent accidental sharing of sensitive data but do not provide legal hold, search, or export capabilities across mailboxes, SharePoint, and OneDrive for litigation purposes.

Microsoft Purview Audit provides logging of user and admin activities but does not support preservation, search, or export of content across mailboxes, sites, and accounts for legal hold purposes.

Practice this question →

114

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Purview Information Protection?

Select 2 answers

A.Searching for content in eDiscovery

B.Preventing data loss via policies

C.Setting retention periods for content

D.Applying sensitivity labels to documents and emails

E.Encrypting content with Azure Rights Management

AnswersD, E

Applying sensitivity labels to documents and emails is a fundamental capability of Microsoft Purview Information Protection. These labels allow organizations to classify data based on its sensitivity level, such as 'Confidential' or 'Public,' and then automatically enforce corresponding protection actions. This includes visual markings, encryption, and access restrictions, ensuring consistent data governance and protection across various platforms and applications.

Why this answer

Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Applying sensitivity labels to documents and emails (Option D) is a core MIP capability, as labels enforce protection actions like encryption or visual markings. Encrypting content with Azure Rights Management (Option E) is the underlying technology that MIP uses to apply persistent protection, making it a direct capability of the solution.

Exam trap

The trap here is that candidates confuse the broad 'Microsoft Purview' umbrella with its specific sub-solutions, mistakenly attributing eDiscovery, DLP, or retention capabilities to Information Protection when each is a distinct workload with separate functions.

Practice this question →

115

MCQhard

A company wants to monitor Microsoft Teams messages and corporate emails for policy violations related to potential harassment and inappropriate behavior. They need a solution that allows them to define policies with conditions (e.g., keywords, patterns), automatically flag suspicious conversations, and optionally send notifications to the sender or escalate to a reviewer. Additionally, they need the ability to train employees when a minor violation is detected. Which Microsoft Purview solution should they use?

A.Data Loss Prevention (DLP)

B.Communication Compliance

C.Information Protection

D.Audit

AnswerB

Communication Compliance is the correct solution, specifically designed to help organizations detect, investigate, and act on inappropriate messages within Microsoft Teams, Exchange Online, Yammer, and other communication platforms. It leverages intelligent classifiers and customizable policies to identify potential regulatory compliance issues, code-of-conduct violations, or instances of harassment. This service provides a robust framework for reviewing flagged communications, taking remediation actions such as notifying users, and fostering a compliant and respectful workplace environment.

Why this answer

Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and corporate emails by scanning for keywords, patterns, and other conditions. It can automatically flag suspicious conversations, send notifications to the sender, escalate to a reviewer, and even train employees on minor violations through its built-in remediation workflows.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention (DLP) because both involve policy-based scanning of communications, but DLP lacks the behavioral monitoring, notification, and training capabilities required for harassment and inappropriate behavior scenarios.

Why the other options are wrong

Information Protection focuses on classifying and protecting sensitive data (e.g., labels, encryption) but does not include monitoring communications for policy violations like harassment or sending training notifications.

Audit logs user and admin activity but does not define policies to monitor content for harassment or policy violations, nor does it provide training or notification features.

Practice this question →

116

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Purview Communication Compliance? (Select TWO.)

Select 2 answers

A.Enforce company policies on communication channels

B.Detect offensive language in emails and Teams messages

C.Automatically apply sensitivity labels to documents

D.Prevent sharing of credit card numbers via email

E.Place legal holds on user mailboxes

AnswersA, B

Communication Compliance evaluates messages across Teams, Exchange, and Viva Engage against defined policies, letting reviewers detect and act on regulatory or code-of-conduct breaches. This directly satisfies the requirement to enforce company policies on communication channels rather than merely classify data at rest.

Why this answer

Option A is correct because Communication Compliance is designed to help organizations enforce their internal policies and codes of conduct across communication channels such as Microsoft Teams, Exchange Online, and Viva Engage by detecting policy violations. Option B is correct because Communication Compliance uses built-in and custom classifiers to detect offensive, harassing, or inappropriate language in emails and Teams messages, including profanity, threats, and targeted harassment. Option C is not correct because automatic sensitivity label application is a capability of Microsoft Purview Information Protection (auto-labeling policies), not Communication Compliance.

Option D is not correct because preventing the sharing of credit card numbers via email is handled by Data Loss Prevention (DLP) policies in Microsoft Purview, not Communication Compliance. Option E is not correct because placing legal holds on user mailboxes is a capability of Microsoft Purview eDiscovery (or Exchange litigation hold), not Communication Compliance.

Exam trap

The trap here is that candidates confuse Communication Compliance with Data Loss Prevention (DLP) or Information Protection, since all three involve content scanning—but Communication Compliance is specifically for monitoring and reviewing communications for policy violations, not for automatic labeling or blocking sensitive data.

Practice this question →

117

MCQmedium

A multinational company uses Microsoft 365 and has a retention policy that automatically applies a 7-year retention label to any document containing a credit card number. The retention label must be automatically applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator use to configure this automatic labeling rule?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Retention Policy

C.Microsoft Purview Sensitivity Labels

D.Microsoft Purview eDiscovery

AnswerA

Microsoft Purview Data Lifecycle Management is the correct service for managing data retention and deletion across an organization, offering retention labels that can be manually applied or, crucially, automatically applied via auto-labeling policies. These policies leverage conditions like sensitive information types, keywords, or trainable classifiers to ensure content-specific retention actions are taken without manual intervention. This directly addresses the need for content-based automatic retention.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the correct solution because it provides the ability to create and apply retention labels automatically based on sensitive information types, such as credit card numbers, using auto-labeling policies. This ensures that the retention label is applied at the time of document creation or modification, meeting the requirement for automatic application without user intervention.

Exam trap

The trap here is that candidates confuse 'Retention Policy' (which applies at the container level) with 'Retention Labels' (which can be auto-applied at the item level), leading them to select Option B, but the question specifically requires automatic labeling based on content, which only Data Lifecycle Management supports.

How to eliminate wrong answers

Option B is wrong because a Microsoft Purview Retention Policy applies retention settings at the container level (e.g., entire site or mailbox) and cannot be configured to automatically apply a specific retention label based on content containing a credit card number; it lacks the granularity for content-based auto-labeling. Option C is wrong because Sensitivity Labels are designed for classification and protection (e.g., encryption, access restrictions) based on sensitivity, not for retention duration; while they can be auto-applied, they do not enforce a 7-year retention period by default. Option D is wrong because Microsoft Purview eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for configuring automatic retention label application based on content detection.

Practice this question →

118

MCQhard

A multinational corporation must comply with the EU General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) by searching for personal data across Exchange Online, SharePoint Online, and OneDrive for Business. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.Audit (Premium)

C.eDiscovery (Premium)

D.Data Loss Prevention (DLP)

AnswerC

eDiscovery (Premium) supports custodian-based search across Exchange Online, SharePoint Online and OneDrive for Business, with review sets and export for DSAR responses. It satisfies the cross-workload search requirement that core eDiscovery handles less comprehensively for GDPR requests.

Why this answer

Microsoft Purview eDiscovery (Premium) provides the Content Search, case management, custodian, and review-set capabilities needed to locate and export personal data across Exchange Online, SharePoint Online, OneDrive for Business, and Teams for a DSAR response. It is the only Purview workload designed specifically for identifying and collecting responsive content across Microsoft 365 workloads at scale.

Exam trap

The trap is confusing preventive controls (DLP) or retention controls (Data Lifecycle Management) with the investigative search-and-collect capability that only eDiscovery (Premium) provides for DSAR responses.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management handles retention labels and policies for keeping or deleting content, not searching for and exporting personal data in response to a DSAR. Option B is wrong because Audit (Premium) provides long-term audit log retention and intelligent insights into user activity, but it does not search mailbox or site content for personal data. Option D is wrong because Data Loss Prevention detects and blocks sensitive information in motion, but it is a preventive control, not an investigative search-and-collect tool for DSAR responses.

Practice this question →

119

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Purview classification rule. The rule is enabled and set to apply a sensitivity label. However, you notice that documents containing EU personal data are not being labeled automatically. What is the most likely cause?

A.The label ID is invalid

B.The rule does not include a condition to detect sensitive data

C.The rule status is Disabled

D.The rule is not scoped to SharePoint Online

AnswerB

For an auto-labeling policy or rule to effectively identify and apply a sensitivity label to content, it must incorporate specific conditions that define what constitutes sensitive data. These conditions typically involve detecting specific sensitive information types (SITs), keywords, or patterns within documents or emails. Without any defined conditions, the rule lacks the necessary criteria to evaluate content, rendering it incapable of matching or labeling any data, regardless of other policy settings.

Why this answer

The rule is enabled and applies a sensitivity label, but documents containing EU personal data are not being labeled automatically. For automatic labeling to occur, the classification rule must include a condition that detects sensitive data types (e.g., EU passport numbers or GDPR-defined personal data). Without such a condition, the rule has no trigger to identify the content and apply the label, even if the rule is active and scoped correctly.

Exam trap

Microsoft often tests the misconception that enabling a rule and setting a label is sufficient for automatic labeling, when in fact a sensitive data detection condition is mandatory for the rule to trigger.

How to eliminate wrong answers

Option A is wrong because an invalid label ID would cause a configuration error or prevent the label from being applied at all, but the question states the rule is enabled and set to apply a sensitivity label, implying the label ID is valid. Option C is wrong because the rule status is explicitly stated as enabled, not disabled. Option D is wrong because the rule not being scoped to SharePoint Online would prevent labeling in that workload, but the issue is that documents are not being labeled at all, regardless of location, and the core problem is the lack of a detection condition.

Practice this question →

120

MCQhard

A company uses Microsoft Purview. A compliance officer applies a retention label to a set of legal documents and configures the label to mark the items as records. After the label is applied, a user attempts to delete one of these documents from SharePoint Online. What will be the outcome?

A.The user is allowed to delete the document, but a copy is retained in a preservation hold.

B.The user receives an access denied error and cannot delete the document.

C.The document is deleted and immediately purged from the recycle bin.

D.The delete action is allowed but an audit event is generated and the document is still retained for the specified period.

AnswerB

When a compliance officer applies a record label to a document in Microsoft Purview, the item becomes an immutable record. This action prevents any user, including the creator or an administrator, from deleting or modifying the document during its retention period. Consequently, any attempt to delete the document will result in an "access denied" error, ensuring the integrity and immutability required for regulatory compliance and legal obligations.

Why this answer

When a retention label is configured to mark items as records, the items become immutable and locked. In SharePoint Online, records cannot be deleted by users; any attempt to delete a record results in an 'access denied' error because the retention policy overrides standard user permissions to enforce compliance.

Exam trap

The trap here is that candidates often confuse 'records' with 'regulatory records' or assume that retention labels only trigger audit events without blocking actions, but marking as a record strictly prohibits deletion and editing.

Why the other options are wrong

When a retention label marks items as records, they become immutable and cannot be deleted by users. The label prevents deletion entirely, not just with a copy retained.

When a retention label marks items as records, they become immutable and cannot be deleted by users; deletion is blocked entirely, not allowed with immediate purge.

When a retention label marks items as records, they become immutable and cannot be deleted by users. Option D describes behavior for items under a retention policy without record marking, not for records.

Practice this question →

121

MCQhard

A privacy officer at Woodgrove Bank needs to automatically detect and classify documents containing personally identifiable information (PII) across SharePoint Online, OneDrive, and Exchange Online. They want to apply a sensitivity label to these documents and ensure the label is applied even if users do not manually label them. The label should also encrypt the content. Which Microsoft Purview feature should they use?

A.Data Loss Prevention (DLP) policies with a sensitivity label condition

B.Information barriers policies

C.Retention policies with a sensitive information type condition

D.Auto-labeling policies for sensitivity labels

AnswerD

Auto-labeling policies can automatically apply sensitivity labels to content that matches conditions, such as containing sensitive information types for PII. They work across Exchange, SharePoint, and OneDrive, and the label can include encryption. This meets the requirement for automatic classification and protection without user intervention.

Why this answer

Auto-labeling policies for sensitivity labels are designed to automatically apply labels to content that matches specified conditions, such as containing PII. The labels can be configured with encryption. This feature works across Exchange, SharePoint, and OneDrive, and it does not require users to manually apply labels, satisfying the automatic classification and protection requirement.

Exam trap

The trap here is assuming DLP can apply sensitivity labels automatically; DLP can detect and act on labeled content, but it does not assign labels itself.

Practice this question →

122

MCQeasy

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

A.Microsoft Purview Communication Compliance

B.Microsoft Purview Message Encryption

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview Data Lifecycle Management

AnswerC

Data Loss Prevention inspects email content for sensitive information types such as credit card numbers, blocks external sends, shows policy tips, permits business-justification overrides, and logs incidents for reporting. This satisfies all four requirements within Microsoft Purview without additional configuration.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A (Communication Compliance) is for communication monitoring, not data protection.

Option B (Message Encryption) is for email encryption, not blocking. Option D (Data Lifecycle Management) is for retention, not real-time blocking.

Practice this question →

123

MCQhard

A legal department is preparing for litigation. They need to preserve all potentially relevant content in Exchange Online, SharePoint Online, and Teams to prevent deletion or modification. Additionally, they must search across these locations for specific keywords and export the results for external review. Which Microsoft Purview solution should they use?

A.eDiscovery (Standard)

B.Audit (Standard)

C.Data Lifecycle Management

D.Communication Compliance

AnswerA

eDiscovery (Standard) preserves Exchange Online, SharePoint Online and Teams content via holds, supports keyword searches across those locations, and exports results for external review. It satisfies both the litigation-hold and cross-workload search requirements without the premium capabilities of eDiscovery (Premium).

Why this answer

eDiscovery (Standard) is the correct solution because it provides the capabilities to place Exchange Online, SharePoint Online, and Teams content on legal hold to preserve it from deletion or modification, and it includes built-in search and export functions for litigation. This solution directly addresses the requirements for preservation, keyword search across multiple workloads, and export for external review.

Exam trap

The trap here is that candidates often confuse Audit (Standard) with eDiscovery because both are in the Purview compliance portal, but Audit only records events while eDiscovery provides the legal hold, search, and export actions required for litigation.

Why the other options are wrong

Audit (Standard) logs user and admin activities but does not provide capabilities to preserve content via legal hold or search/export content across Exchange, SharePoint, and Teams for litigation.

Data Lifecycle Management focuses on retaining or deleting content based on policies (e.g., retention tags), not on preserving content for litigation (legal hold) or searching/exporting for eDiscovery purposes.

Communication Compliance is designed to detect and mitigate communication risks (e.g., harassment, insider trading) by analyzing messages, not to preserve, search, and export content for litigation hold and eDiscovery purposes.

Practice this question →

124

Multi-Selecthard

Which THREE actions can be performed using Microsoft Purview compliance portal?

Select 3 answers

A.Manage user licenses

B.Conduct eDiscovery searches

C.Create retention policies

D.Configure conditional access policies

E.Manage sensitivity labels

AnswersB, C, E

Microsoft Purview offers advanced eDiscovery capabilities, enabling organizations to efficiently identify, preserve, collect, process, review, and export electronically stored information (ESI). This functionality is crucial for legal investigations, regulatory requests, and internal inquiries, allowing compliance officers to search across various data sources like Exchange mailboxes, SharePoint sites, and Microsoft Teams for relevant content.

Why this answer

The Microsoft Purview compliance portal is the administrative surface for data governance, risk, and compliance workloads, so option B (Conduct eDiscovery searches) is correct because eDiscovery cases, holds, searches, and exports are managed there under the eDiscovery solution. Option C (Create retention policies) is correct because retention policies and retention labels are configured in Purview's Data Lifecycle Management to retain or delete content across Exchange, SharePoint, OneDrive, and Teams. Option E (Manage sensitivity labels) is correct because Information Protection sensitivity labels, their encryption and content-marking settings, and label policies are published from the Purview portal.

Option A (Manage user licenses) is not part of Purview; license assignment is done in the Microsoft 365 admin center or via Microsoft Entra ID/Graph. Option D (Configure conditional access policies) is not part of Purview either; conditional access is configured in Microsoft Entra ID (Entra admin center).

Exam trap

The trap here is that candidates often confuse the Microsoft Purview compliance portal with the broader Microsoft 365 admin center or Entra admin center, leading them to select actions like license management or conditional access that belong to different administrative portals.

Practice this question →

125

MCQmedium

A company uses Microsoft Teams and wants to ensure that messages containing offensive language are flagged for review. Which Microsoft Purview solution should be used?

A.Microsoft Purview Information Barriers

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Communication Compliance uses machine-learning classifiers to detect offensive language in Microsoft Teams messages, then routes flagged items to reviewers for triage and remediation. This directly satisfies the requirement to flag offensive content for review, unlike retention or eDiscovery solutions, which preserve or search content without policy-based offensive-language detection.

Why this answer

Microsoft Purview Communication Compliance is designed to detect and flag messages containing offensive language, harassment, or other policy violations in Microsoft Teams, Exchange Online, and Yammer. It uses customizable policies and machine learning classifiers to automatically review communications and route flagged items for human review, making it the correct solution for this requirement.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention, mistakenly thinking DLP handles offensive content when it actually only protects sensitive data, not language policy violations.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Barriers restrict communication and collaboration between specific groups (e.g., to prevent conflicts of interest), but they do not analyze message content for offensive language. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) focuses on preventing the accidental sharing of sensitive data (e.g., credit card numbers, PII) and does not detect offensive language. Option D is wrong because Microsoft Purview Audit logs user and admin activities for compliance and forensic investigation, but it does not proactively scan or flag message content for offensive language.

Practice this question →

126

Multi-Selectmedium

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams?

Select 2 answers

A.Information barriers

B.Communication compliance

C.Data Loss Prevention (DLP)

D.Sensitivity labels

E.eDiscovery

AnswersC, D

DLP policies evaluate Teams chat and channel messages for sensitive information types, blocking or warning on sharing. This protects sensitive data in Teams because policy tips and enforcement act at the point of message transmission, satisfying the requirement to safeguard content within that workload.

Why this answer

Data Loss Prevention (DLP) is correct because Microsoft Purview DLP policies can be scoped to Microsoft Teams chat and channel messages, detecting sensitive information types (for example, credit card or Social Security numbers) and taking protective actions such as blocking the message or generating alerts. Sensitivity labels are correct because they can be applied to Teams sites, channels, and files shared in Teams, and they enforce protection such as encryption and access restrictions that travel with the content. Information barriers are not the best fit here because they restrict communication between groups rather than protect sensitive data content itself.

Communication compliance is designed to detect and remediate inappropriate or risky communications for compliance review, not to apply data protection controls. eDiscovery is used for identifying, preserving, and collecting content for legal or investigative purposes, not for preventing sensitive data exposure.

Exam trap

The trap here is that candidates often confuse Information barriers (which control who can communicate) with DLP (which controls what data can be shared), or they mistakenly think Communication compliance is a protective measure when it is actually a detective and review tool.

Practice this question →

127

MCQhard

A company is implementing Microsoft Purview Communication Compliance to detect inappropriate messages. They need to monitor Microsoft Teams channel messages and chat messages for potential policy violations. Which configuration is required?

A.Enable Microsoft Purview Data Loss Prevention (DLP) policies for Teams.

B.Set up an Exchange Online retention policy to retain Teams messages.

C.Deploy a third-party archiving solution for Teams messages.

D.Configure a Communication Compliance policy that includes Teams messages as the supervised communication channel.

AnswerD

Communication Compliance policies define supervised communication channels, and Microsoft Teams chat and channel messages must be selected as a supervised channel for those messages to be scanned. Without adding Teams, the policy only covers Exchange email and other configured sources.

Why this answer

Communication Compliance in Microsoft Purview is configured by creating a policy that specifies the supervised communication channels, and Microsoft Teams chats and channel messages are selectable channels within that policy. Enabling Teams as a supervised channel is the required configuration to detect inappropriate messages in Teams. DLP, retention, and third-party archiving address different compliance goals.

Exam trap

SC-900 often tests whether candidates confuse DLP (protect sensitive data) with Communication Compliance (detect inappropriate communications); picking DLP for a harassment-detection scenario is the classic wrong answer.

How to eliminate wrong answers

Option A is wrong because DLP policies for Teams focus on preventing sharing of sensitive information (for example, credit card numbers) rather than detecting inappropriate or harassing language, which is the domain of Communication Compliance. Option B is wrong because an Exchange Online retention policy governs how long Teams messages are kept, not whether their content is analyzed for policy violations. Option C is wrong because a third-party archiving solution captures and stores messages for eDiscovery but does not natively perform the machine-learning-based classification that Communication Compliance provides.

Practice this question →

128

MCQmedium

A company uses Microsoft Purview Compliance Manager to improve their compliance posture. They are preparing for a SOC 2 audit and need to score compliance with SOC 2 controls, track improvement actions, and assign tasks to responsible teams. Which component of Compliance Manager should they use to assign and track specific actions to improve their compliance score?

A.Assessment

B.Control

C.Improvement action

D.Template

AnswerC

Improvement actions are the discrete tasks Compliance Manager generates against assessed controls; each can be assigned to an owner, given a due date and tracked to completion, which directly raises the compliance score for the SOC 2 assessment.

Why this answer

Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.

Exam trap

The trap here is that candidates confuse 'Control' (the requirement) with 'Improvement action' (the task to meet the requirement), leading them to select B, even though controls are not directly assignable or trackable as individual tasks.

How to eliminate wrong answers

Option A is wrong because an Assessment is a container that groups controls from a specific regulation (like SOC 2) and tracks your overall compliance score, but it does not provide the granular, assignable tasks needed to drive improvement. Option B is wrong because a Control is a specific requirement from the regulation (e.g., 'Access must be logged'), but it is not the actionable item you assign to a team; the control is satisfied by completing one or more improvement actions. Option D is wrong because a Template is a reusable blueprint that defines the controls and improvement actions for a regulation (e.g., SOC 2 template), but it is not the mechanism for assigning and tracking individual tasks.

Practice this question →

129

Multi-Selecteasy

Which TWO of the following are capabilities of Microsoft Purview Data Loss Prevention?

Select 2 answers

A.Define retention periods for documents.

B.Search for content in Exchange Online mailboxes.

C.Block sharing of sensitive data via email.

D.Automatically apply sensitivity labels to content.

E.Provide policy tips to users when they attempt to share sensitive data.

AnswersC, E

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify and prevent the unauthorized sharing of sensitive information, including via email. These policies can detect specific sensitive information types, such as credit card numbers or national ID numbers, within email content or attachments. Upon detection, a configured DLP policy can automatically block the email from being sent, thereby preventing the exfiltration of critical data.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is designed to detect and prevent the accidental or intentional sharing of sensitive information. Option C is correct because DLP policies can block the sharing of sensitive data via email by inspecting content in transit and applying actions such as blocking the message. Option E is correct because DLP can display policy tips to users in real time, warning them before they share sensitive data and allowing them to override the block with justification.

Exam trap

The trap here is that candidates confuse DLP with other Microsoft Purview solutions: they may think DLP defines retention periods (Records Management), searches content (eDiscovery), or applies sensitivity labels (Information Protection), when in fact DLP focuses on preventing data loss through monitoring and blocking actions, not on lifecycle management or labeling.

Practice this question →

130

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Purview sensitivity label configuration. A user reports that a document containing a sensitive info type with confidence 80 was not automatically labeled. What is the most likely cause?

A.The user has overridden the label application.

B.The encryption is disabled.

C.The encryption template ID is missing.

D.The auto-labeling policy is not configured to apply this label.

AnswerD

While a sensitivity label defines the specific protection settings, such as encryption and access controls, its mere existence does not automatically apply it to content. For automatic application, a distinct auto-labeling policy must be created and configured within Microsoft Purview to identify sensitive information based on specific conditions and then apply this particular label. The label definition itself is separate from its deployment via an auto-labeling policy.

Why this answer

Auto-labeling in Microsoft Purview requires a specific auto-labeling policy to be configured and published to the user or location. Even if a sensitivity label exists and a sensitive info type (SIT) is detected with high confidence, the label will not be applied automatically unless an auto-labeling policy is explicitly set to apply that label to documents matching the SIT. The user's report indicates the label was not applied, which points to the policy not being configured, not a user override or encryption issue.

Exam trap

The trap here is that candidates often confuse the existence of a sensitivity label with the configuration of an auto-labeling policy, assuming that if a label is published, it will automatically apply to matching content, but in reality, auto-labeling requires a separate policy to be explicitly configured.

How to eliminate wrong answers

Option A is wrong because the user overriding the label would require the label to have been applied first, and the user would have to manually change it; the scenario states the label was not applied at all. Option B is wrong because encryption being disabled does not prevent auto-labeling; encryption is a label action, not a prerequisite for label application. Option C is wrong because a missing encryption template ID would cause an error when applying encryption, but it would not prevent the label from being applied; the label could still be applied without encryption.

Practice this question →

131

MCQmedium

A company uses Microsoft 365 and needs to classify and protect sensitive documents by applying encryption and visual markings (headers/footers) based on the content's sensitivity. They also want to automatically revoke access to documents that leave the organization. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Information Protection

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Information Protection applies sensitivity labels that enforce encryption and visual markings, and its protection persists with the file so access can be revoked when documents leave the organisation. This directly satisfies the classification, marking and revocation requirements in the stem.

Why this answer

Microsoft Purview Information Protection (B) is the correct solution because it provides the capabilities to classify and protect sensitive documents using sensitivity labels. These labels can enforce encryption and apply visual markings like headers and footers based on content sensitivity. Additionally, Information Protection supports automatic revocation of access to documents that leave the organization through features like rights management and conditional access policies.

Exam trap

The trap here is that candidates may confuse Data Lifecycle Management (retention/deletion) with Information Protection (classification/encryption), or mistakenly think Communication Compliance or Audit can enforce document-level protection and revocation.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management focuses on retaining and deleting data based on policies, not on classifying, encrypting, or applying visual markings to documents. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, insider trading) within emails and messages, not to classify or protect document content with encryption or markings. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, not the ability to classify, encrypt, or revoke access to documents.

Practice this question →

132

MCQmedium

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to create a policy that prevents users from sharing credit card numbers via email to external recipients. The policy should only apply to users in the Finance department. Which action should you take?

A.Create a retention label and apply auto-labeling for Finance

B.Create a sensitivity label and publish it to Finance users

C.Copy the default DLP template for financial data and modify it

D.Create a DLP policy, select the Finance user location, and add the credit card number condition

AnswerD

Creating a new Data Loss Prevention (DLP) policy is the direct and most effective method for preventing the unauthorized sharing of sensitive data. By selecting the Finance user location, the policy is precisely scoped to the relevant individuals, and adding the credit card number condition ensures that the policy specifically targets and enforces actions against this critical sensitive information type, directly addressing the company's objective.

Why this answer

To apply a DLP policy to specific users, you select their group (e.g., Finance) as a location when creating the policy. This ensures only Finance users are affected. Option A is wrong because auto-labeling with retention labels does not enforce DLP rules.

Option B is wrong because sensitivity labels classify data but do not block sharing. Option C is wrong because copying a default template may not allow precise scoping to Finance users; creating a new policy from scratch with location selection is more accurate.

Practice this question →

133

MCQhard

You are a compliance administrator for Contoso, a multinational company that uses Microsoft 365. The company has the following requirements: 1. Automatically retain all documents containing personally identifiable information (PII) for 7 years. 2. Prevent users from sharing PII via email with external recipients unless they provide a business justification. 3. Monitor and alert when users access sensitive data outside of business hours. 4. Generate a compliance score for GDPR and ISO 27001. You need to configure the appropriate Microsoft Purview solutions. For each requirement, match the correct solution. Which combination of solutions should you use?

A.Information Protection for retention; DLP for sharing; Data Lifecycle Management for monitoring; Compliance Manager for scoring

B.Data Lifecycle Management for retention; Communication Compliance for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

C.Data Lifecycle Management for retention; DLP for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

D.Information Protection for retention; eDiscovery for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

AnswerC

Each component maps to one requirement: Data Lifecycle Management applies retention labels for the 7-year PII hold; DLP blocks external email sharing with justification override; Insider Risk Management detects out-of-hours access; Compliance Manager scores GDPR and ISO 27001 posture.

Why this answer

Requirement 1 (retain PII for 7 years) is met by a retention label or policy from Data Lifecycle Management (not Information Protection, which is for classification). Requirement 2 (prevent sharing without justification) is met by a Data Loss Prevention (DLP) policy that can block sharing and require user override with business justification. Requirement 3 (monitor access outside business hours) is met by Insider Risk Management, which can detect anomalous access patterns.

Requirement 4 (compliance score) is met by Compliance Manager. Option A is wrong because Information Protection labels are for classification, not retention; also monitoring access outside hours needs Insider Risk Management, not DLP. Option B is wrong because Communication Compliance is for monitoring communications, not for preventing sharing via email; DLP is needed for that.

Option D is wrong because eDiscovery is for legal discovery, not for access monitoring.

Practice this question →

134

MCQmedium

Your organization uses Microsoft Purview Records Management to manage high-value contracts. You need to ensure that once a contract is declared as a record, it cannot be modified or deleted by any user, including administrators. Which type of record should you use?

A.Disposition review

B.Event-based retention policy

C.Retention label with default settings

D.Regulatory record

AnswerD

A regulatory record in Microsoft Purview is specifically designed to meet stringent regulatory compliance requirements for absolute immutability. Once an item is declared a regulatory record, it becomes permanently locked, preventing any modification or deletion by any user, including global administrators. This level of unalterable preservation ensures the content's integrity and authenticity throughout its lifecycle, making it suitable for the most demanding legal and regulatory obligations.

Why this answer

Regulatory records provide the highest level of protection and cannot be modified or deleted by any user, including administrators. Option A is wrong because disposition review is a process for reviewing content before deletion, not a record type that locks content. Option B is wrong because event-based retention policies apply retention based on a trigger event, but they do not prevent modification or deletion once declared a record.

Option C is wrong because a retention label with default settings does not lock the record; it only applies retention settings without regulatory protections.

Practice this question →

135

MCQmedium

A financial services company uses Microsoft 365 and must comply with PCI DSS. They want to automatically prevent users from sending emails that contain credit card numbers to external recipients. If a user tries to send such an email, the system should block the message and notify the user with a policy tip. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP)

B.Communication Compliance

C.Information Protection

D.Insider Risk Management

AnswerA

Data Loss Prevention in Microsoft Purview inspects email content for sensitive information types such as credit card numbers, blocks messages to external recipients, and shows policy tips to the sender. This matches the PCI DSS requirement to prevent outbound card data automatically.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive data, such as credit card numbers, in transit (e.g., email). DLP policies can be configured with conditions to match credit card number patterns (using a built-in sensitive info type) and set actions to block the message and display a policy tip to the sender, meeting the PCI DSS compliance requirement.

Exam trap

The trap here is that candidates often confuse Information Protection (labels/encryption) with DLP, but Information Protection does not provide real-time blocking of outbound data; it only applies protection after classification, whereas DLP actively monitors and blocks data in motion.

How to eliminate wrong answers

Option B is wrong because Communication Compliance is designed to detect and remediate inappropriate or policy-violating communications (e.g., harassment, insider trading), not to block sensitive data like credit card numbers in email. Option C is wrong because Information Protection (e.g., sensitivity labels and encryption) focuses on classifying and protecting data at rest or in transit via encryption, but it does not automatically block outbound emails containing credit card numbers or provide policy tips. Option D is wrong because Insider Risk Management is used to detect, investigate, and act on risky user activities (e.g., data theft, leaks) based on analytics, not to enforce real-time blocking of specific data patterns in email.

Practice this question →

136

MCQhard

A company receives a subject rights request (SRR) from a customer under GDPR, asking for the deletion of all personal data held about them. The compliance team needs a tool to orchestrate the discovery of this data across Microsoft 365 and other systems, and to track the response and fulfillment of the request. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management (retention labels)

D.Microsoft Priva (Privacy Management)

AnswerD

Microsoft Priva (Privacy Management) is purpose-built to streamline the complex process of responding to Subject Rights Requests (SRRs). It offers automated data discovery across Microsoft 365, Azure, and other connected data sources, identifying personal data relevant to a specific data subject. Priva provides a comprehensive workflow for review, redaction, collaboration, and secure fulfillment, ensuring compliance with global privacy regulations like GDPR and and CCPA.

Why this answer

Microsoft Priva (Privacy Management) is the correct solution because it is specifically designed to help organizations manage subject rights requests (SRRs) under regulations like GDPR. It automates the discovery of personal data across Microsoft 365 and connected systems, provides a workflow to track the request lifecycle, and facilitates the fulfillment of actions such as deletion. This directly addresses the compliance team's need to orchestrate discovery and track response for an SRR.

Exam trap

The trap here is that candidates often confuse eDiscovery (which handles legal holds and litigation) with privacy management (which handles subject rights requests), but eDiscovery lacks the automated SRR workflow and privacy-specific orchestration that Priva provides.

Why the other options are wrong

eDiscovery is designed for legal discovery of content in litigation or investigations, not for orchestrating and tracking subject rights requests under GDPR. It lacks the workflow automation and privacy-specific features needed to manage SRR fulfillment across multiple systems.

Microsoft Purview Audit is designed for logging and investigating user and admin activity, not for orchestrating discovery or tracking fulfillment of subject rights requests under GDPR.

Data Lifecycle Management (retention labels) is used to classify and manage data retention and deletion policies, not to orchestrate discovery of personal data across systems or track subject rights request fulfillment.

Practice this question →

137

MCQmedium

A compliance officer needs to investigate a potential data exfiltration incident. They must search the unified audit log for all activities where users accessed a specific sensitive SharePoint site in the last 7 days. Additionally, they need to create a custom alert that triggers when more than 10 file downloads occur from that site within an hour. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit (Standard)

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview eDiscovery

D.Microsoft Purview Communications Compliance

AnswerA

Microsoft Purview Audit (Standard) provides access to the unified audit log, enabling organizations to search for user and administrator activities across various Microsoft 365 services, including SharePoint Online. This service allows compliance officers to investigate past events, such as unusual file downloads, and to create custom alert policies based on specific activity patterns or thresholds. Its capability to search historical audit data and configure alerts for suspicious behaviors directly addresses the need for both investigation and proactive monitoring.

Why this answer

Microsoft Purview Audit (Standard) logs all user activities, including file accesses and downloads from SharePoint sites, for 90 days. The compliance officer can search the unified audit log for the specific site's activities over the last 7 days and create custom alert policies (e.g., threshold-based alerts for >10 downloads per hour) using the Microsoft 365 Defender portal. This makes Audit (Standard) the correct solution for both investigation and alerting.

Exam trap

The trap here is that candidates confuse the investigative and alerting capabilities of Audit (Standard) with the preventive controls of DLP, assuming DLP can retroactively search logs or create threshold-based alerts, when in fact DLP only applies real-time policies to content in transit or at rest.

Why the other options are wrong

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data exfiltration by enforcing policies on sensitive data, not to investigate past incidents or create alerts based on activity thresholds from the unified audit log.

Microsoft Purview eDiscovery is designed for legal investigations and content searches across data sources, not for real-time monitoring of user activities or creating custom alerts based on download thresholds from the unified audit log.

Microsoft Purview Communications Compliance is designed to monitor and manage internal and external communications for regulatory compliance, not to investigate data exfiltration via audit logs or create alerts based on file download thresholds from SharePoint.

Practice this question →

138

MCQeasy

Your company uses Microsoft Purview to manage records. You need to ensure that financial records are retained for 7 years and then permanently deleted. Which type of policy should you create?

A.A retention policy with a retention period of 7 years and then delete

B.A sensitivity label set to 'Financial' with auto-labeling

C.A retention label that triggers a disposition review after 7 years

D.A DLP policy that blocks sharing of financial records

AnswerA

A retention policy with a retention period of 7 years and then delete is the correct solution because retention policies are designed to automatically apply retention and deletion actions across entire locations, such as SharePoint sites or Exchange mailboxes. This policy ensures that content is retained for the specified 7 years and then permanently deleted without requiring any manual intervention, directly fulfilling the requirement for automatic disposition.

Why this answer

A retention policy with a retention period of 7 years and then delete is correct because it applies a time-based retention rule to financial records at the container or folder level, ensuring they are kept for exactly 7 years and then permanently removed without human intervention. This meets the requirement for automatic deletion after the retention period, as opposed to a disposition review which requires manual approval.

Exam trap

The trap here is that candidates confuse a retention label with a retention policy, thinking a label is required for deletion, but a retention policy can enforce deletion at the container level without needing a label or human review.

How to eliminate wrong answers

Option B is wrong because a sensitivity label set to 'Financial' with auto-labeling classifies data based on sensitivity but does not enforce a retention or deletion schedule; it only applies protection actions like encryption or headers. Option C is wrong because a retention label that triggers a disposition review after 7 years requires a human to approve deletion, which contradicts the requirement for permanent deletion without manual steps. Option D is wrong because a DLP policy blocks sharing of financial records to prevent data loss but does not manage retention or deletion timelines.

Practice this question →

139

MCQeasy

A company wants to automatically detect and remediate compliance issues such as sharing sensitive data externally. Which Microsoft Purview solution should they use?

A.Microsoft Purview Records Management

B.Microsoft Purview Data Loss Prevention

C.Microsoft Purview eDiscovery

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Data Loss Prevention (DLP) is precisely designed to identify, monitor, and protect sensitive information across various locations, including cloud services, endpoints, and on-premises. DLP policies use sophisticated rules to detect sensitive data and automatically apply remediation actions, such as blocking sharing, encrypting content, or notifying administrators, effectively preventing unauthorized disclosure and ensuring compliance.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, alert, and automatically remediate when sensitive data (e.g., credit card numbers, personally identifiable information) is shared externally via email, Teams, or cloud apps. DLP policies can enforce actions like blocking the transmission or applying encryption, directly addressing the requirement to prevent unauthorized external sharing of sensitive data.

Exam trap

The trap here is that candidates often confuse the proactive, blocking capability of DLP with the reactive, investigative tools like eDiscovery or Audit, mistakenly thinking that logging or searching for past incidents fulfills the requirement to 'automatically detect and remediate' in real time.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Records Management focuses on managing the lifecycle of records (retention, deletion, and disposition) for compliance with regulatory requirements, not on detecting or preventing real-time data sharing violations. Option C is wrong because Microsoft Purview eDiscovery is used for searching, preserving, and exporting content for legal investigations or litigation, not for proactive detection and remediation of data sharing compliance issues. Option D is wrong because Microsoft Purview Audit provides logging and forensic visibility into user and admin activities (e.g., who accessed what and when), but it does not have the capability to automatically detect and block sensitive data sharing in transit.

Practice this question →

140

MCQhard

A multinational corporation stores highly sensitive intellectual property in SharePoint Online. To meet regulatory requirements, they need an additional layer of encryption beyond Microsoft's baseline encryption. The company wants to manage their own encryption keys using Azure Key Vault, so that if they remove the key from the service, the data becomes unreadable. Which Microsoft Purview solution should they implement?

A.Double Key Encryption

B.Customer Key

C.Information Rights Management

D.Customer Lockbox

AnswerB

Correct. Microsoft Purview Customer Key allows customers to provide and manage their own encryption keys using Azure Key Vault, providing an additional layer of encryption on top of the baseline. Data is encrypted using these keys, and the customer can control key access.

Why this answer

Customer Key (Option B) is the correct solution because it provides the ability to control and manage the encryption keys used to encrypt data at rest in Microsoft 365, including SharePoint Online. By using Azure Key Vault to store the keys, the organization can revoke access at any time, rendering the data unreadable—a key requirement for meeting regulatory obligations. This goes beyond Microsoft's baseline encryption by adding a customer-controlled layer of encryption.

Exam trap

The trap here is that candidates often confuse Customer Key with Double Key Encryption, mistakenly thinking DKE is required for customer-managed keys in Azure Key Vault, when in fact Customer Key is the correct solution for managing encryption keys at rest across Microsoft 365 workloads.

Why the other options are wrong

Double Key Encryption (DKE) requires two keys: one managed by Microsoft and one managed by the customer. The question specifies that the company wants to manage their own encryption keys using Azure Key Vault and that removing the key makes data unreadable, which aligns with Customer Key, not DKE. DKE is designed for scenarios where data must be encrypted with a key held outside Microsoft's control, but it does not use Azure Key Vault for the customer key.

Customer Lockbox provides controlled access for Microsoft engineers to your data during support requests, not an additional layer of encryption where you manage your own keys. It does not make data unreadable if you remove a key.

Practice this question →

141

MCQmedium

A legal team is managing a large litigation case involving over two million documents in SharePoint Online and Exchange Online. They want to reduce the time required for manual review by using a machine learning model that learns from a seed set of relevant and non-relevant documents and then predicts the relevance of the remaining documents. Which Microsoft Purview solution provides this advanced analytical capability?

A.Communication Compliance

B.eDiscovery (Standard)

C.eDiscovery (Premium)

D.Audit (Premium)

AnswerC

eDiscovery (Premium) is specifically designed to manage large-scale, complex litigation and regulatory investigations by offering an end-to-end workflow within Microsoft Purview. It extends beyond Standard capabilities with advanced features like custodian management, legal hold orchestration, and collection from non-Microsoft 365 sources. Crucially, it incorporates machine learning-driven analytics, including predictive coding (TAR), near-duplicate detection, and email threading, which significantly streamline the review process, reduce data volumes, and lower legal costs for extensive document sets.

Why this answer

eDiscovery (Premium) in Microsoft Purview provides advanced analytics capabilities, including predictive coding, which uses machine learning models trained on a seed set of relevant and non-relevant documents to automatically predict the relevance of the remaining content. This directly addresses the legal team's need to reduce manual review time for over two million documents in SharePoint Online and Exchange Online.

Exam trap

The trap here is that candidates often confuse eDiscovery (Standard) with eDiscovery (Premium) because both involve searching and holding content, but only Premium includes the advanced analytics and machine learning capabilities described in the scenario.

Why the other options are wrong

Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, insider trading), not to perform machine learning-based relevance prediction on documents for eDiscovery review.

Audit (Premium) provides advanced auditing capabilities such as long-term retention and high-bandwidth access to audit logs, but it does not include machine learning models for predictive relevance scoring of documents in eDiscovery.

Practice this question →

142

MCQhard

Your organization uses Microsoft Purview Communication Compliance to detect harassing messages. You receive an alert for a message that appears to be a joke between colleagues. What should you do to prevent similar false positives?

A.Train users not to joke about sensitive topics

B.Delete the alert and ignore future similar messages

C.Refine the policy conditions to exclude certain keywords or users

D.Turn off the policy and use a different solution

AnswerC

Refining the policy conditions within Microsoft Purview Communication Compliance is the most effective and technically sound solution to reduce false positives while preserving the policy's intended protective scope. This involves precisely adjusting keywords, phrases, dictionaries, or even excluding specific users or groups known to generate benign matches, thereby ensuring the policy accurately targets genuine compliance risks without generating unnecessary alerts and administrative overhead.

Why this answer

Microsoft Purview Communication Compliance policies are configurable to reduce false positives. You can refine the policy by adding conditions to exclude specific keywords (e.g., 'joke' or 'just kidding') or specific users (e.g., known colleagues) from triggering alerts, without disabling the policy or relying on user behavior changes.

Exam trap

The trap here is that candidates may choose Option A (training users) because it seems proactive, but the question specifically asks how to prevent false positives in the detection system, which requires policy refinement, not user behavior change.

How to eliminate wrong answers

Option A is wrong because training users does not prevent false positives in the detection system; it only addresses human behavior, not the policy's configuration. Option B is wrong because deleting alerts and ignoring future similar messages bypasses compliance monitoring and violates audit requirements; alerts must be investigated or the policy adjusted. Option D is wrong because turning off the policy removes the compliance control entirely, which is unnecessary when the policy can be refined to exclude benign content.

Practice this question →

143

Multi-Selecteasy

Which TWO features are part of Microsoft Purview Information Protection?

Select 2 answers

A.Communication monitoring

B.Retention policies

C.Automatic classification based on sensitive content

D.Sensitivity labels

E.Audit log investigation

AnswersC, D

Automatic classification based on sensitive content is a cornerstone feature of Microsoft Purview Information Protection. This capability leverages sensitive information types, trainable classifiers, and exact data match to automatically identify and categorize sensitive data across various locations, including documents, emails, and cloud services. By proactively classifying content, Information Protection can then apply appropriate sensitivity labels and protection actions, significantly reducing the manual effort required to secure vast amounts of organizational data.

Why this answer

Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Automatic classification based on sensitive content (Option C) is a core capability of MIP, using built-in or custom sensitive information types to detect and label data automatically. Sensitivity labels (Option D) are the primary mechanism in MIP to apply protection actions such as encryption, access restrictions, and visual markings to documents and emails.

Exam trap

The trap here is that candidates confuse the broad scope of Microsoft Purview (which includes many compliance solutions) with the specific boundaries of Information Protection, often mistaking retention or audit features as part of MIP because they all appear under the Purview umbrella.

Practice this question →

144

Multi-Selectmedium

Which TWO actions can be performed using Microsoft Purview Data Lifecycle Management?

Select 2 answers

A.Create a retention policy to keep financial records for 7 years

B.Monitor internal emails for policy violations

C.Create a deletion policy to remove old drafts after 30 days

D.Block sharing of sensitive files with external users

E.Automatically classify documents containing PII

AnswersA, C

Microsoft Purview Data Lifecycle Management (DLM) is specifically designed to help organizations manage their data throughout its entire lifecycle, including long-term preservation. Creating a retention policy to keep financial records for a specified duration, such as seven years, is a fundamental capability within DLM. These policies ensure compliance with legal, regulatory, and business requirements by preventing premature deletion and ensuring data availability.

Why this answer

Microsoft Purview Data Lifecycle Management allows administrators to create retention policies that specify how long data must be kept to meet regulatory or business requirements, such as retaining financial records for 7 years. Option C is correct because the same solution enables deletion policies that automatically remove outdated content, like drafts older than 30 days, ensuring data is not kept longer than necessary.

Exam trap

The trap here is that candidates confuse the capabilities of Microsoft Purview Data Lifecycle Management with those of Information Protection or Communication Compliance, leading them to select options related to monitoring, blocking, or classifying data, which belong to other compliance solutions.

Practice this question →

145

MCQmedium

A healthcare organization must demonstrate compliance with HIPAA by assessing their current posture against regulatory controls, tracking improvement actions, and generating reports for auditors. Which Microsoft Purview solution should they use?

A.Microsoft Purview Information Protection

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Compliance Manager

D.Microsoft Purview Insider Risk Management

AnswerC

Microsoft Purview Compliance Manager is the dedicated solution for simplifying compliance and reducing risk by providing pre-built assessments for common industry regulations, such as HIPAA. It allows organizations to track progress on improvement actions, assign responsibilities, and generate detailed compliance reports, offering a measurable compliance score. This service directly addresses the need to demonstrate and manage an organization's adherence to regulatory requirements through a structured workflow.

Why this answer

Microsoft Purview Compliance Manager is the correct solution because it provides a built-in assessment template for HIPAA, enabling the organization to assess its current compliance posture against regulatory controls, track improvement actions, and generate auditor-ready reports. It offers a compliance score, automated control mapping, and evidence collection workflows specifically designed for regulatory frameworks like HIPAA.

Exam trap

The trap here is that candidates confuse Compliance Manager (which assesses and tracks compliance posture) with Information Protection (which protects data) or Insider Risk Management (which detects risky behavior), because all three are Purview solutions but serve fundamentally different compliance lifecycle stages.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying, labeling, and protecting sensitive data (e.g., encryption, rights management), not on assessing compliance posture or tracking improvement actions against regulatory controls. Option B is wrong because Microsoft Purview Data Lifecycle Management handles data retention, deletion, and archiving policies (e.g., retention labels, records management), not compliance assessment or audit reporting for HIPAA. Option D is wrong because Microsoft Purview Insider Risk Management detects and investigates risky user activities (e.g., data exfiltration, policy violations), not compliance posture assessment or improvement tracking against regulatory frameworks.

Practice this question →

146

MCQhard

Your organization is implementing Microsoft Purview Communication Compliance to detect potential regulatory violations. You need to configure a policy that alerts when employees discuss insider trading in emails and Microsoft Teams messages. The solution should minimize false positives. Which action should you take?

A.Include all message types without filtering

B.Use a trainable classifier and train it with sample data

C.Create a global keyword list of insider trading terms

D.Set the policy sensitivity threshold to 90%

AnswerB

Trainable classifiers use machine learning, seeded with sample data, to identify content by its actual characteristics rather than keyword matches. Training on genuine insider-trading examples sharpens precision, directly satisfying the requirement to minimise false positives across Exchange and Microsoft Teams messages.

Why this answer

Trainable classifiers use machine learning to identify content based on patterns learned from sample data, which significantly reduces false positives compared to static keyword lists. By training the classifier with relevant examples of insider trading discussions, the policy can accurately distinguish between genuine regulatory violations and benign uses of similar terms.

Exam trap

The trap here is that candidates often assume a keyword list or sensitivity threshold is sufficient for compliance, overlooking that trainable classifiers are specifically designed to minimize false positives by learning from sample data rather than relying on static rules.

How to eliminate wrong answers

Option A is wrong because including all message types without filtering would generate excessive alerts, including irrelevant communications, leading to high false positives and analyst fatigue. Option C is wrong because a global keyword list of insider trading terms would trigger alerts on any mention of those terms, even in harmless contexts (e.g., 'I read about insider trading in the news'), causing many false positives. Option D is wrong because setting the policy sensitivity threshold to 90% would only reduce alerts based on a generic confidence score, not address the root cause of false positives from ambiguous language; trainable classifiers provide more nuanced detection.

Practice this question →

147

MCQeasy

A compliance officer at Contoso needs to review all user and admin activities across Exchange Online, SharePoint Online, and Microsoft Entra ID for the past 90 days to investigate a potential data leak. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery

B.Microsoft Purview Information Barriers

C.Microsoft Purview Audit

D.Microsoft Purview Data Loss Prevention

AnswerC

Microsoft Purview Audit logs and retains user and administrator activities across Microsoft 365 services, including Exchange Online, SharePoint Online, and Microsoft Entra ID. It provides a unified audit log that compliance officers can search to investigate incidents such as data leaks. Standard audit retention is 90 days, which matches the investigation window, making it the correct tool for reviewing activity history.

Why this answer

Microsoft Purview Audit is the correct solution because it aggregates and retains user and administrator activity logs from Microsoft 365 services, including Exchange Online, SharePoint Online, and Entra ID. Compliance officers can search these logs to trace actions such as file accesses, permission changes, and sign-ins. The other solutions address different needs: DLP prevents sharing, Information Barriers restrict communication, and eDiscovery collects content for legal matters.

Exam trap

The trap here is assuming that eDiscovery or DLP provides the same breadth of activity logging as Microsoft Purview Audit, when only Audit offers a unified, searchable log of user and admin actions across services.

Practice this question →

148

MCQhard

Your organization uses Microsoft Purview Audit (Standard) and needs to investigate a data breach that occurred 120 days ago. You discover that the required audit logs are not available. What is the most likely reason?

A.The user does not have an appropriate license

B.Audit log retention is limited to 90 days for Audit (Standard)

C.The organization has insufficient storage

D.The audit logs were manually deleted by an administrator

AnswerB

Microsoft Purview Audit (Standard) is specifically designed with a fixed retention period of 90 days for all audit logs. This means that any audit records generated will be automatically retained for exactly 90 days from their creation date. After this 90-day window expires, these logs are automatically and permanently purged from the system, making them irretrievable. This inherent limitation is a primary reason why older audit logs might appear to be missing.

Why this answer

Microsoft Purview Audit (Standard) retains audit logs for only 90 days by default. Since the data breach occurred 120 days ago, the logs would have been automatically purged after the retention period expired, making them unavailable for investigation.

Exam trap

The trap here is that candidates may assume licensing or storage issues cause log unavailability, but the SC-900 specifically tests the 90-day retention limit for Audit (Standard) as a key differentiator from Audit (Premium).

How to eliminate wrong answers

Option A is wrong because licensing affects the ability to generate or access audit logs, but the user already has access to Audit (Standard); the issue is retention duration, not licensing. Option C is wrong because insufficient storage does not cause log unavailability in Purview Audit; logs are stored in a managed, scalable backend and are not constrained by organizational storage limits. Option D is wrong because while manual deletion is possible, the most likely reason given the 120-day timeframe is the default 90-day retention policy, not deliberate administrative action.

Practice this question →

149

MCQeasy

A financial services firm is required by regulatory bodies to monitor employee communications (email, Teams chats) for potential insider trading or market manipulation. They need a solution that allows them to define policies to detect messages containing specific keywords or phrases (e.g., 'confidential', 'insider info'), and then assign flagged messages to designated reviewers for investigation. Which Microsoft Purview solution should they use?

A.Microsoft Purview Communication Compliance

B.Microsoft Purview Insider Risk Management

C.Microsoft Purview eDiscovery (Standard or Premium)

D.Microsoft Purview Audit (Standard or Premium)

AnswerA

Microsoft Purview Communication Compliance is specifically designed to help organizations detect and remediate regulatory compliance violations, such as insider trading, harassment, or sensitive data sharing, within their internal and external communications. It uses intelligent templates and customizable policies to proactively scan messages across Microsoft 365 services for specific keywords, sensitive information types, or patterns indicative of policy breaches. Compliance officers can then review, investigate, and take action on identified risky communications through a dedicated workflow.

Why this answer

Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in employee communications, such as email and Teams chats, by scanning for sensitive keywords or phrases like 'confidential' or 'insider info'. It then automatically flags and routes these messages to designated reviewers for investigation, directly meeting the regulatory requirement for monitoring potential insider trading or market manipulation.

Exam trap

The trap here is confusing Insider Risk Management (which focuses on behavioral analytics and user risk scores) with Communication Compliance (which directly scans communication content for specific text patterns), leading candidates to choose the wrong solution for keyword-based message monitoring.

Why the other options are wrong

Insider Risk Management focuses on detecting and investigating risky user activities (e.g., data exfiltration, policy violations) based on behavioral analytics, not on monitoring communications for specific keywords or phrases. The question explicitly requires keyword-based policy detection in messages, which is a core feature of Communication Compliance.

eDiscovery is designed for legal discovery and investigation of existing data, not for real-time policy-based detection and automated assignment of flagged messages to reviewers. The question requires proactive monitoring and policy enforcement, which is the domain of Communication Compliance.

Microsoft Purview Audit (Standard or Premium) provides logging and investigation of user and admin activity, but it does not include policy-based detection of keywords/phrases in communications or assignment to reviewers for investigation. The question specifically requires monitoring communications for keywords and assigning flagged messages to reviewers, which is not an Audit capability.

Practice this question →

150

MCQhard

A financial services company is required by the Payment Card Industry Data Security Standard (PCI-DSS) to retain all documents containing credit card numbers for at least seven years. The compliance team has created a custom sensitive information type (SIT) to detect credit card numbers in Microsoft 365. They want to automatically apply a retention label (e.g., "7-Year Retention") to any document in SharePoint or OneDrive that matches this SIT. Which Microsoft Purview solution should they configure to apply the label automatically based on content?

A.Data Loss Prevention (DLP)

B.Insider Risk Management

C.Communication Compliance

D.Data Lifecycle Management

AnswerD

Data Lifecycle Management provides auto-apply retention label policies that can use sensitive information types (SITs) to classify and retain content automatically. This is the correct solution to apply a retention label based on content detection.

Why this answer

Data Lifecycle Management (DLM) in Microsoft Purview is the solution specifically designed for automatically applying retention labels based on conditions like sensitive information types (SITs). By creating a retention label policy with auto-labeling rules that reference the custom SIT for credit card numbers, DLM can automatically assign the '7-Year Retention' label to documents in SharePoint and OneDrive that contain PCI-DSS data, ensuring compliance with retention requirements.

Exam trap

The trap here is that candidates confuse Data Loss Prevention (DLP) with Data Lifecycle Management because both use sensitive information types, but DLP is for protection (blocking/sharing) while DLM is for governance (retention/deletion).

Why the other options are wrong

Communication Compliance is designed to detect and act on inappropriate or policy-violating communications (e.g., harassment, insider trading), not to apply retention labels based on sensitive content like credit card numbers.

Practice this question →