CCNA Describe the capabilities of Microsoft compliance solutions Questions

This policy type in Microsoft Purview is specifically designed to automatically apply sensitivity labels to content at scale, both at rest and in transit. It leverages conditions based on sensitive information types, keywords, or trainable classifiers to identify specific content patterns, ensuring consistent classification and protection without manual intervention. This directly fulfills the requirement for automatic data management.

A retention label configured for regulatory records locks content so it cannot be deleted or modified, even by administrators, and records the declaration in the audit log, satisfying the requirement that high-value records remain undeletable.

Placing relevant sites on litigation hold, also known as an eDiscovery hold, is the precise and legally recognized mechanism within Microsoft Purview to preserve electronically stored information (ESI) indefinitely for legal or investigative purposes. This action overrides all existing retention policies and user deletion actions, ensuring that all content, including documents, emails, and versions, remains immutable and discoverable for the entire duration of the legal matter, regardless of any other retention settings.

Records Management applies retention labels declaring documents as records for the ten-year period after case closure, preventing alteration or premature deletion. Data Lifecycle Management handles the separate 30-day draft deletion, so combining both satisfies the distinct retention requirements.

Auto-apply retention label policies can automatically apply a retention label to content that matches specific conditions, such as containing a sensitive information type like SWIFT Code. This allows the organization to retain documents for seven years and then delete them without manual intervention. This feature is designed exactly for this scenario, making it the correct choice.

Microsoft 365 Communication Compliance is specifically designed to proactively detect, investigate, and remediate policy violations within an organization's communications, including Microsoft Teams chats. It leverages machine learning to identify sensitive information, regulatory compliance issues, or inappropriate conduct based on customizable policies. This tool enables organizations to monitor ongoing conversations for potential risks and take corrective actions before they escalate.

Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content based on predefined conditions, such as the presence of specific sensitive information types, keywords, or patterns. These policies can be configured to apply labels to files at rest in SharePoint and OneDrive, or to emails and documents in Exchange, ensuring consistent classification without manual intervention. This direct application of labels fulfills the requirement for automatically classifying highly confidential information.

Microsoft Purview Audit (Premium) is the correct solution because it provides advanced auditing capabilities specifically designed to capture and retain detailed user and admin activities across Microsoft 365 services. It offers extended retention of audit logs for up to one year (or 10 years with an add-on license) and access to crucial audit events like file and folder activities, enabling organizations to perform forensic investigations, respond to regulatory requests, and proactively monitor changes to sensitive files with high fidelity.

Retention policies in Microsoft Purview apply retention settings across Exchange mailboxes, satisfying the seven-year regulatory requirement without user intervention. Unlike retention labels, which target specific items, policies operate at workload or location level, automatically retaining all customer email communications for the defined period, then deleting them if configured.

Microsoft Purview Data Loss Prevention (DLP) is specifically engineered to identify, monitor, and protect sensitive information across Microsoft 365, including email communications. It leverages sensitive information types, keywords, and trainable classifiers to detect specific content patterns. Upon detection, DLP policies can automatically enforce a range of protective actions, such as blocking email delivery, encrypting messages, applying specific retention labels, or providing policy tips to users, directly addressing the need for automatic detection and enforcement.

Litigation hold is specifically designed to preserve all electronically stored information (ESI) within a user's mailbox, including active items, deleted items, and even items modified after the hold is placed. It places an indefinite hold on content, preventing users from permanently deleting items and ensuring data immutability for legal discovery or investigation purposes. This mechanism is crucial for meeting eDiscovery requirements by ensuring no relevant data is lost.

Microsoft Purview Communication Compliance is specifically designed to help organizations detect, investigate, and remediate policy violations in communications. It leverages machine learning and customizable dictionaries to identify problematic content, such as potential insider trading code words, across various communication channels. This solution provides a structured workflow for supervisory review, allowing designated personnel to examine flagged messages, assign them for further investigation, and take appropriate action, directly addressing the need for content flagging and review.

Sensitivity labels allow organizations to classify and protect sensitive content by applying persistent encryption, visual markings, and access restrictions directly to documents and emails. This ensures the financial reports are encrypted regardless of where they are stored or shared. Data Loss Prevention (DLP) policies then complement this by detecting sensitive information and actively preventing its unauthorized forwarding or sharing based on predefined rules, thus providing comprehensive protection.

Auto-labeling applies sensitivity label; retention label retains personal data for 5 years; DLP blocks cross-border sharing; manual label provides encryption and watermark; audit logging tracks access.

Communication Compliance is the correct solution as it proactively identifies and addresses potential policy violations within an organization's communications, such as Microsoft Teams chats, Exchange emails, and Yammer posts. It leverages machine learning and predefined or custom policies to detect issues like harassment, threats, or the sharing of sensitive information. When a policy is triggered, it generates alerts for designated reviewers, enabling them to investigate, remediate, and escalate findings through a structured workflow.

DLP policies inspect content for sensitive information types such as PII, then block sharing with external recipients and surface user notifications or policy tips. This directly satisfies both the prevention and notification requirements, unlike labels or retention, which govern classification and lifecycle rather than real-time sharing control.

Sensitivity labels in Microsoft Purview allow organizations to classify and protect their sensitive data throughout its lifecycle, regardless of where it's stored or shared. When configured with encryption, these labels apply persistent, rights-management protection directly to the document content. This ensures that only authorized users, as defined by the label's policy, can open, view, or modify the document, even if it leaves the organization's controlled environment, thereby enforcing access controls.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations within Microsoft 365, including Exchange Online, SharePoint Online, OneDrive, and Teams. It leverages sensitive information types, trainable classifiers, and exact data match to detect HIPAA-regulated data, such as Protected Health Information (PHI). Upon detection, DLP can enforce actions like blocking sharing, notifying users and administrators, or automatically applying sensitivity labels to prevent unauthorized disclosure, directly addressing detection and prevention requirements.

Microsoft Purview Insider Risk Management is the correct solution as it proactively identifies and mitigates potential data exfiltration risks from within the organization. It leverages machine learning to detect anomalous user behaviors, such as unusual download volumes, email forwarding, or cloud uploads, especially when correlated with HR signals like an employee's impending departure. The service provides configurable policies, alerts security teams to suspicious activities, and offers case management tools for investigation and remediation, directly addressing the scenario of a departing data analyst.

Auto-classification via a Data Loss Prevention (DLP) policy is the correct mechanism for this scenario. Microsoft Purview DLP policies can be configured to detect specific sensitive information types (SITs) or trainable classifiers within content, such as emails, documents, or Teams messages. Upon detection, the DLP policy can automatically apply a pre-defined sensitivity label to the item, ensuring consistent protection based on the content's sensitivity without requiring any manual user action.

Data Lifecycle Management (DLM), specifically through Microsoft 365 retention policies, allows organizations to define how long content is retained or deleted. For financial records requiring mandatory retention, a retention policy can be configured to preserve content for a specified period. Applying a preservation lock to this policy makes it immutable, preventing anyone, including administrators, from turning off the policy, deleting it, or making it less restrictive, thus ensuring compliance with stringent regulatory requirements for long-term record retention.

This combination correctly addresses all implied compliance requirements. Data Loss Prevention (DLP) is essential for blocking the sharing of sensitive information like credit card numbers. Data Lifecycle Management (DLM) provides the necessary capabilities for defining and enforcing retention and disposition policies, ensuring data is kept for the required duration and then appropriately deleted. eDiscovery enables the organization to efficiently search, preserve, and produce electronic information for legal or investigative purposes, while sensitivity labels allow for data classification and protection, applying encryption or access restrictions based on content.

Auto-labeling applies label automatically; retention policy retains; DLP blocks sharing; audit logging tracks access.

Microsoft Purview Insider Risk Management is specifically engineered to identify, analyze, and act on potential insider risks by correlating diverse signals from Microsoft 365 and other sources. It leverages machine learning and advanced analytics to detect subtle, cumulative patterns of user activity, such as unusual data exfiltration, unauthorized access attempts, or policy violations, that collectively indicate malicious or inadvertent insider threats over time. This capability directly addresses the need to identify evolving patterns of risky behavior.

Information Barriers, a feature within Microsoft Purview, are designed to prevent specific groups of users from communicating or collaborating with each other. This is crucial for organizations like financial services firms to establish 'ethical walls' between departments, such as analysts and bankers, ensuring regulatory compliance and preventing conflicts of interest. These policies restrict communication channels like Microsoft Teams chats, calls, and SharePoint site access, directly addressing the need to prevent communication.

Microsoft Purview Insider Risk Management is specifically engineered to identify and mitigate risks related to the unauthorized disclosure or exfiltration of sensitive organizational data, whether intentional or accidental. Policies configured within this solution directly target behaviors indicative of data leaving the organization, such as emailing sensitive files to personal accounts, uploading to unsanctioned cloud storage, or copying to removable media, making "data leaks" the most accurate description of its core function.

The query correctly filters `SecurityAlert` records generated within the last 7 days for MFA failure anomalies. It then groups these anomalies by user and calculates the total count for each user. The subsequent `where AlertCount > 5` clause precisely isolates and presents only those users whose aggregated count of MFA failure anomalies exceeds five, directly matching the objective described in this option.

Sensitivity labels apply encryption at classification, satisfying the 'Privileged' tagging requirement. DLP blocks unauthorised email sharing, Communication Compliance monitors Teams chats, Data Lifecycle Management enforces the seven-year retention then deletion, and eDiscovery supports legal hold searches. Together these Microsoft Purview solutions cover every stated constraint.

Creating the sensitivity label in the Microsoft Purview compliance portal is the foundational and indispensable first step for implementing data classification. This action involves defining the label's name, description, visual markings, and associated protection settings like encryption or access restrictions. Without this initial creation, no label exists to be published or applied, making it the absolute prerequisite for any data classification initiative using Microsoft Purview Information Protection.

Retention labels in Microsoft Purview are specifically designed to manage the lifecycle of data, including its eventual deletion. By creating a retention label with a 3-year retention period and a disposition action set to deletion, the organization ensures that content is preserved for the required duration and then automatically removed from its location. This mechanism is central to compliant data lifecycle management, enforcing policy across various Microsoft 365 services to meet regulatory and internal governance requirements.

Microsoft Purview Compliance Manager is specifically designed to help organizations manage their compliance posture against various regulatory frameworks. It provides pre-built assessment templates for numerous regulations (e.g., GDPR, HIPAA, ISO 27001), a quantifiable compliance score, and actionable improvement recommendations. This centralized dashboard allows for continuous monitoring, tracking progress on improvement actions, and generating reports to demonstrate adherence to complex global and industry-specific compliance requirements.

Microsoft Purview Data Lifecycle Management (DLM), formerly known as Microsoft 365 Records Management, is the primary service within Microsoft Purview for managing the entire lifecycle of an organization's data. It enables the creation and application of retention labels and policies to define how long content should be kept, whether for regulatory compliance, legal hold, or business requirements, and when it should be permanently deleted. This ensures that data is retained for the necessary period and then defensibly disposed of according to established policies, directly addressing compliance department requirements for data retention and deletion.

Microsoft Purview Audit (Premium) is the appropriate solution for retaining audit logs for two years, as it offers a default retention of one year, which can be extended to up to 10 years for specific activities. This service provides advanced auditing capabilities, including higher-fidelity logging, faster access to audit data, and increased API bandwidth, making it suitable for meeting stringent regulatory compliance requirements for long-term audit log retention.

Microsoft Purview Information Protection (MIP) is the correct solution because it enables organizations to discover, classify, label, and protect sensitive data, including Protected Health Information (PHI) relevant to HIPAA. Sensitivity labels can be applied manually or automatically based on content inspection (e.g., detecting medical record numbers or other sensitive info types), enforcing encryption, visual markings, and access restrictions. This ensures that data is protected at rest and in transit, aligning directly with HIPAA's security rule requirements for safeguarding electronic PHI.

Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and automatically protect sensitive information across various locations, including endpoints, cloud apps, and services like Exchange, SharePoint, and OneDrive. By detecting specific sensitive information types or content, DLP can actively block sharing, encrypt data, or notify users and administrators in real-time. This direct enforcement capability is crucial for preventing unauthorized data exfiltration or sharing.

The action "blockOnlyExternal" specifically prevents external users from accessing content that contains sensitive information, but it does not prevent internal users from initially sharing or sending that content to external recipients. While external access to the shared content might be blocked, the internal user successfully initiated the sharing action. This distinction is crucial because the policy allows the internal user to perform the outbound sharing, even if the external recipient cannot ultimately view the sensitive data within the shared item.

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including cloud services, endpoints, and on-premises. DLP can detect specific sensitive data types, such as credit card numbers or personally identifiable information (PII), and enforce rules to prevent sharing, copying, or transferring this data outside defined organizational boundaries. It directly fulfills the requirement to automatically block sharing actions based on content.

Compliance Manager provides framework-specific assessments against GDPR and ISO 27001, with a compliance score, prioritised improvement actions, and tracking of implementation progress. It satisfies the requirement for a single centralised tool covering posture assessment and ongoing action tracking.

Microsoft Purview Compliance Manager is the correct solution as it provides a comprehensive dashboard to assess and manage an organization's compliance posture against various regulatory standards and industry benchmarks. It offers a real-time compliance score, recommended improvement actions, and the ability to assign and track tasks to address identified gaps. This tool is specifically designed to help multinational corporations navigate complex regulatory landscapes by simplifying compliance management and demonstrating adherence.

Microsoft Purview Information Protection enables organizations to discover, classify, and protect sensitive data like Protected Health Information (PHI) through sensitivity labels, which can automatically apply encryption or visual markings. Concurrently, Microsoft Purview Data Loss Prevention (DLP) policies leverage these classifications to detect and prevent unauthorized sharing or transfer of PHI across various locations, including email, SharePoint, and Teams. This combined approach ensures data is appropriately handled, retained, and safeguarded against exfiltration, directly addressing HIPAA's privacy and security requirements.

This policy action, often referred to as 'Block with override' in Microsoft Purview Data Loss Prevention (DLP) configurations, is designed to prevent sensitive data from being shared inappropriately. However, it provides a crucial flexibility: users are prompted to provide a business justification if they believe their action is legitimate, allowing them to bypass the block. This approach balances stringent data protection with operational continuity, empowering users to make informed decisions when necessary.

A retention policy in Microsoft Purview allows administrators to set a retention period (e.g., 5 years) and an action (such as automatic deletion) for content in SharePoint sites. Users cannot permanently delete the content until the retention period expires.

Data Loss Prevention in Microsoft Purview inspects email content and can detect the phrase 'Confidential-Financial' in the subject or body, then block or restrict the message regardless of recipient domain. This satisfies the requirement to stop external sharing automatically.

Data Loss Prevention (DLP) in Microsoft 365 is specifically designed to identify, monitor, and protect sensitive information across various locations, including email, SharePoint, and OneDrive. It uses sensitive information types (SITs) to detect data like credit card numbers or PII, allowing organizations to define policies that block sharing, encrypt content, or notify users and administrators. This capability directly addresses the need to prevent accidental or malicious sharing of sensitive data, often providing user override options for legitimate business cases.

Data Lifecycle Management (DLM), specifically through Microsoft 365 retention policies, is designed to automatically manage content throughout its lifecycle. These policies can be configured to retain emails for a specified duration, such as seven years, to meet regulatory compliance requirements. After the retention period expires, DLM policies can then automatically initiate the deletion of that content, ensuring compliance with both retention and disposal obligations without manual intervention. This directly addresses the need for automatic retention and subsequent deletion of customer emails.

Microsoft Purview Records Management is specifically designed for regulatory, legal, and business-critical recordkeeping, ensuring content immutability. It utilizes retention labels to classify items as records, which prevents their modification or deletion for a specified period, such as 10 years for vendor contracts. This capability is crucial for meeting strict retention requirements and supporting automated disposition reviews, ensuring compliance with organizational and legal obligations.

Insider Risk Management applies machine-learning analytics to signals such as mass file downloads, USB copy events and personal-email exfiltration, correlating them with HR data like resignation dates. It generates alerts and investigation cases, matching the compliance team's detection and investigation requirements.

When a user manually applies a parent sensitivity label, the document inherits all the protection settings directly configured on that specific parent label. This includes the specified encryption (e.g., ViewOnly) and any content markings like a header. Since the parent label itself does not have a watermark configured, and sublabels are not automatically applied, the document will not receive a watermark, even if a sublabel has one.

Microsoft Purview Information Protection is the correct service for creating and managing sensitivity labels, which classify and protect sensitive data. These labels can be configured to apply encryption, visual markings like headers or footers, and granular access restrictions to content, regardless of where it is stored or shared. This comprehensive approach ensures that sensitive information remains protected throughout its lifecycle, aligning with data governance policies.

Data Lifecycle Management (DLM) in Microsoft 365 utilizes retention labels and policies to govern the entire lifecycle of data, from creation to deletion. It enables organizations to define specific retention periods, such as 10 years for customer contracts, ensuring compliance with legal or regulatory obligations. After the retention period expires, DLM policies can automatically dispose of the data, streamlining information governance and reducing risk.

This option accurately describes the conditions for a match. The custom sensitive information type (SIT) rule is configured with a logical AND operator, requiring both the detection of a pattern matching the Social Security Number (SSN) regular expression and the presence of associated keywords. Specifically, the `minMatches=1` setting for the keyword component means that at least one keyword must be found in proximity to the SSN pattern to trigger a successful detection.

Sensitivity labels are designed to classify and protect data directly at the point of creation or modification. By configuring a sensitivity label with encryption, it applies Azure Rights Management (Azure RMS) protection to the content. This protection can include specific usage rights, such as "Do Not Forward," which prevents recipients from forwarding, printing, or copying the protected email or document, ensuring the data remains within its intended scope. This method directly embeds the protection into the content, making it persistent wherever the data travels.

Microsoft Purview Insider Risk Management is the correct solution as it specifically leverages built-in risk indicators, machine learning, and behavioral analytics to identify and investigate potential insider risks, including data theft. It correlates various user activities across Microsoft 365 services to detect unusual patterns, enabling security teams to proactively identify, analyze, and respond to incidents.

Applying a retention policy without a preservation lock allows users to delete items from their primary view within applications like Outlook or SharePoint. However, the retention policy ensures that a copy of the deleted item is moved to a secure, hidden location (e.g., the Recoverable Items folder for Exchange, or the Preservation Hold library for SharePoint/OneDrive) and retained for the policy's duration. This mechanism precisely meets the requirement of allowing user deletion while guaranteeing the item remains discoverable and recoverable by administrators.

The Microsoft Purview retention policy is configured with a 'Keep and then delete' action, specifically set for a duration of 365 days. This means that emails covered by this policy will be preserved and immutable for the entire 365-day period from their creation or last modification date. Upon the expiration of this retention period, the policy will automatically trigger the permanent deletion of these emails from their respective locations.

This is a fundamental retention action within Microsoft Purview, designed to prevent the permanent deletion of content for a specified duration. It ensures that data, such as emails, documents, or Teams messages, remains discoverable and accessible, even if users attempt to delete it from their applications. This action is crucial for meeting regulatory compliance, legal discovery requirements, or internal organizational policies by placing an immutable hold on the data.

eDiscovery (Premium) supports custodian identification, placing holds on Exchange Online mailboxes and SharePoint sites, and collecting preserved content into review sets. Standard eDiscovery lacks custodian management and advanced review, so Premium satisfies both the hold and collection requirements.

Improvement actions with assigned owners are a core feature within Microsoft Purview Compliance Manager, representing specific tasks recommended to enhance an organization's compliance posture against various regulations and standards. These actions can be assigned to individual users or teams, ensuring clear accountability and enabling systematic tracking of progress as an organization works towards implementing necessary controls and demonstrating adherence to compliance requirements.

eDiscovery (Premium) is the appropriate solution for a compliance officer who needs to search for specific email content across an organization's data. This service in Microsoft Purview enables robust content searches, legal holds, and the collection of electronically stored information (ESI) from various sources like Exchange mailboxes, SharePoint sites, and OneDrive accounts. It is specifically designed for investigative purposes, allowing for advanced querying, review, and export of relevant content.

Microsoft Purview Data Loss Prevention (DLP) policies are designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and non-Microsoft cloud apps. DLP utilizes sensitive information types, keywords, and content matching to detect sensitive data, such as credit card numbers or national ID numbers, both at rest and in transit. Upon detection, DLP can block sharing, notify users, or encrypt the content, effectively identifying and protecting the data.

DLP evaluates Teams chat and channel messages against sensitivity labels and sensitive information types, then blocks or warns on policy matches. This provides automatic detection and prevention of accidental sensitive-data sharing in Teams, which is the exact control the scenario requires.

Compliance Manager continuously calculates a compliance score from your implemented controls against GDPR and ISO 27001 assessments, then supplies recommended improvement actions and tracks remediation progress over time, directly satisfying the continuous-assessment and scoring requirements in the stem.

Microsoft Purview Communication Compliance is purpose-built to help organizations detect, investigate, and act on inappropriate messages within their Microsoft 365 environment. It leverages machine learning and customizable policies to identify potential policy violations, such as harassment, threats, or regulatory non-compliance, across various communication channels. This solution provides a structured workflow for reviewers to examine flagged communications and take appropriate remedial action.

Auto-labelling applies sensitivity labels automatically to content matching sensitive information types, satisfying the requirement to classify data at scale without manual intervention. Microsoft Purview Information Protection uses this client-side and service-side mechanism to detect and label items across Exchange, SharePoint, OneDrive and Office apps.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and on-premises repositories. These policies leverage sensitive information types, trainable classifiers, and exact data match to detect content containing, for example, credit card numbers or health records. Upon detection, DLP can enforce actions such as blocking sharing, encrypting files, or notifying administrators to prevent unauthorized disclosure or exfiltration.

For automatic sensitivity labeling of content in Exchange Online (emails), the `behavior` parameter in the auto-labeling policy must be set to `applyWithOverride`. The `apply` behavior is typically used for SharePoint and OneDrive content, where it applies the label without allowing users to change it. However, Exchange requires `applyWithOverride` to ensure the label is applied while still permitting users to manually modify or remove it if necessary, aligning with email workflow flexibility.

Correct. Records Management uses retention labels that can be configured to mark items as records. When an item is a record, it cannot be deleted, edited, or modified by users during the retention period. This satisfies the requirement to prevent permanent deletion.

eDiscovery in Microsoft Purview is specifically designed to identify, preserve, collect, process, review, and export electronically stored information (ESI). This functionality is crucial for responding to legal requests, regulatory investigations, and data subject access requests (DSARs) by allowing organizations to efficiently locate and retrieve relevant data across various Microsoft 365 services. It centralizes the search and collection process for compliance needs.

Creating a case is the mandatory first step in Microsoft Purview eDiscovery (Premium); holds on custodians' mailboxes and SharePoint sites cannot be applied until a case exists to contain them. The case defines the legal boundary, permissions and custodian scope, so every subsequent hold, search and review set is scoped within it.

A Communication Compliance policy with offensive-language conditions automates detection across Exchange Online and Teams, while user reporting and a five-year retention policy on source locations meet the review, reporting and retention requirements. Role-based access restricts data to designated reviewers, satisfying all five constraints.

Microsoft Purview Information Barriers enable organizations to segment users into distinct groups and define policies that prevent or allow communication between them. This is crucial for managing conflicts of interest or adhering to regulatory requirements within specific departments like finance or legal. It effectively restricts collaboration in Microsoft Teams, SharePoint, and Exchange Online, ensuring sensitive information remains within designated boundaries and preventing unwanted interactions.

Microsoft Purview Compliance Manager is specifically engineered to help organizations manage their compliance posture against various regulatory standards and industry certifications. It provides a dashboard to assess current compliance status, offers actionable recommendations to improve the compliance score, and tracks progress over time. This tool simplifies the complex task of understanding and implementing necessary controls to meet regulatory obligations, such as those relevant to healthcare.