CCNA Ms Compliance Capabilities Questions — Page 2 of 5

MCQmedium

Your organization uses Microsoft Purview to manage insider risk. You need to create a policy that detects users who exfiltrate sensitive data by copying it to personal cloud storage services like Dropbox. Which solution should you use?

A.eDiscovery (Premium)

B.Audit (Premium)

C.Insider Risk Management

D.Communication Compliance

AnswerC

Insider Risk Management in Microsoft Purview is specifically designed to identify, analyze, and act on potential insider risks, including data exfiltration to unauthorized locations like personal cloud services. It leverages machine learning and customizable policies to detect risky activities based on behavioral indicators, enabling organizations to proactively address potential data loss before it escalates into a major incident.

Why this answer

Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on risky user activities, including the exfiltration of sensitive data to personal cloud storage services like Dropbox. It uses predefined or custom policies with indicators such as copying files to unauthorized cloud apps, which aligns directly with the requirement to detect data exfiltration to personal cloud storage.

Exam trap

The trap here is that candidates often confuse Audit (Premium) with proactive detection, but Audit only provides logging after the fact, whereas Insider Risk Management offers real-time detection and alerting for risky behaviors like data exfiltration.

How to eliminate wrong answers

Option A is wrong because eDiscovery (Premium) is used for legal discovery and preservation of content, not for real-time detection of data exfiltration activities. Option B is wrong because Audit (Premium) provides logging and forensic investigation of past events but does not proactively detect or alert on risky data exfiltration patterns. Option D is wrong because Communication Compliance focuses on monitoring communications (e.g., email, Teams) for policy violations like harassment or insider trading, not on detecting data copying to external cloud storage services.

Practice this question →

MCQeasy

Your organization needs to classify documents containing personally identifiable information (PII) like social security numbers. Which Microsoft Purview solution should you configure?

A.Information Protection

B.Records Management

C.Auditing

D.Communication Compliance

AnswerA

Information Protection is the correct solution because it specifically provides capabilities to classify and label sensitive data within documents, whether manually by users or automatically based on content inspection. This service, often delivered through Microsoft Purview Information Protection (MPIP), enables organizations to apply sensitivity labels that not only categorize data but also enforce protective actions like encryption, access restrictions, and visual markings, directly addressing the need to classify documents containing specific information.

Why this answer

Microsoft Purview Information Protection (A) is the correct solution because it provides classification and labeling capabilities specifically designed to identify, label, and protect sensitive data such as PII (e.g., social security numbers). It uses trainable classifiers and exact data match (EDM) to automatically detect sensitive content and apply appropriate protection actions like encryption or access restrictions.

Exam trap

The trap here is that candidates often confuse Records Management (which deals with retention and deletion) with Information Protection (which deals with classification and labeling), leading them to select B when the question explicitly asks about classifying documents containing PII.

How to eliminate wrong answers

Option B (Records Management) is wrong because it focuses on managing the lifecycle of records (retention, deletion, and disposition) rather than classifying or protecting sensitive content like PII. Option C (Auditing) is wrong because it logs user and admin activities for compliance review but does not perform classification or protection of documents. Option D (Communication Compliance) is wrong because it monitors communications (e.g., emails, Teams messages) for policy violations like harassment or insider trading, not for classifying documents containing PII.

Practice this question →

MCQmedium

A financial services company is required by regulation to prevent sensitive customer financial information from being shared externally via email. The compliance team wants to automatically scan all outgoing emails for patterns that match credit card numbers or account numbers. If a match is found, the email should be blocked and the sender should receive a policy tip. Which Microsoft Purview solution should be configured?

A.Microsoft Purview Audit

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview eDiscovery

AnswerC

Microsoft Purview Data Loss Prevention (DLP) proactively identifies, monitors, and protects sensitive information across Microsoft 365 services like Exchange Online, SharePoint Online, and OneDrive for Business. It uses policies to detect specific sensitive information types, such as credit card numbers or financial account details, within content. Upon detection, DLP can automatically block sharing, encrypt files, notify administrators, or provide policy tips to users, thereby preventing unauthorized data exfiltration and ensuring regulatory compliance.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive information—such as credit card numbers and account numbers—in outgoing emails. DLP policies can scan email content and attachments for predefined sensitive information types, and when a match is found, the email can be blocked and a policy tip sent to the sender, meeting the compliance requirement.

Exam trap

The trap here is that candidates may confuse DLP with eDiscovery or Audit because all three involve compliance, but only DLP provides proactive, real-time blocking and notification for outbound sensitive data.

Why the other options are wrong

Microsoft Purview Audit logs user and admin activities but does not scan or block outgoing emails for sensitive content like credit card numbers.

Microsoft Purview Data Lifecycle Management manages retention and deletion of data, not real-time scanning and blocking of outbound emails for sensitive content like credit card numbers.

Microsoft Purview eDiscovery is used for searching and exporting content from Exchange, SharePoint, and Teams for legal investigations, not for real-time scanning and blocking of outgoing emails containing sensitive data.

Practice this question →

MCQhard

A financial services organization must comply with a regulation that requires all communications related to trades (including emails and Teams messages) to be retained for a period of 7 years. During retention, no user may edit or delete these records. After the 7 years, the records must be disposed of with an irreversible deletion that is verified by a compliance officer. Which Microsoft Purview solution should the organization use to enforce both retention and regulatory disposition?

A.Microsoft Purview Records Management (regulatory retention label)

B.Microsoft Purview Data Lifecycle Management (standard retention label)

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Insider Risk Management

AnswerA

Records Management with a retention label marked as a regulatory record permanently locks the content, preventing any modification or deletion during the retention period. It also supports disposition workflows to require approval before permanent deletion.

Why this answer

Microsoft Purview Records Management with a regulatory retention label is the correct solution because it enforces immutable retention (no user edits or deletions) and mandates a disposition review by a compliance officer before irreversible deletion. Regulatory labels lock the retention policy at the highest level, preventing any user or administrator from shortening the retention period or bypassing the disposition workflow, which aligns with the 7-year retention and verified disposal requirement.

Exam trap

The trap here is that candidates confuse 'standard retention labels' (which allow edits and deletions by authorized users) with 'regulatory retention labels' (which enforce immutable retention and require disposition review), leading them to select Data Lifecycle Management instead of Records Management.

Why the other options are wrong

Standard retention labels in Data Lifecycle Management do not support regulatory disposition with irreversible deletion verified by a compliance officer; they lack the 'regulatory' record type and disposition verification workflow required by the regulation.

Communication Compliance is designed to detect and review communications that violate organizational policies (e.g., insider trading, harassment), not to enforce immutable retention or regulatory disposition. It does not provide the required 7-year retention with irreversible deletion and compliance officer verification.

Insider Risk Management is designed to detect, investigate, and act on risky user activities (e.g., data leaks, policy violations), not to enforce retention or regulatory disposition of records. It lacks the ability to apply retention labels or trigger irreversible deletion after a fixed period.

Practice this question →

MCQeasy

Refer to the exhibit. The JSON snippet shows a sensitivity label configuration. What is the purpose of the 'SensitiveInfoTypes' property in this label?

A.It sets the retention period for content with this label.

B.It defines the user groups that can apply this label manually.

C.It specifies the sensitive information types that trigger automatic labeling.

D.It configures the encryption settings for the label.

AnswerC

This property precisely specifies the sensitive information types (SITs) that, when detected in content, will trigger the automatic application of this sensitivity label. These SITs act as conditions, allowing the system to identify and classify documents or emails containing specific patterns, such as credit card numbers or national identification numbers, without requiring manual user intervention, thereby enforcing data protection policies automatically.

Why this answer

The 'SensitiveInfoTypes' property in a sensitivity label configuration specifies which built-in or custom sensitive information types (e.g., credit card numbers, passport numbers) should be detected in content. When these types are matched, the label can be applied automatically through auto-labeling policies, ensuring consistent protection without requiring manual user action.

Exam trap

The trap here is that candidates often confuse the 'SensitiveInfoTypes' property with encryption or retention settings, because all three are configurable within a sensitivity label's wizard, but each serves a distinct purpose and is located in separate sections of the label configuration.

How to eliminate wrong answers

Option A is wrong because retention periods are configured via retention labels and policies, not through the 'SensitiveInfoTypes' property of a sensitivity label. Option B is wrong because user groups that can apply a label manually are defined in the label's scope and permissions settings, not by referencing sensitive information types. Option D is wrong because encryption settings (e.g., 'protect with encryption') are configured separately within the label's 'Encryption' section, not by the 'SensitiveInfoTypes' property.

Practice this question →

MCQhard

A financial institution uses Microsoft 365 and must ensure that Microsoft support engineers cannot access the institution's content (e.g., Exchange Online mailboxes, SharePoint sites) without explicit approval from the institution's compliance officer. The compliance officer needs to review and approve or reject each access request. Which Microsoft Purview feature should be configured?

A.Customer Lockbox

B.Communication Compliance

C.Insider Risk Management

D.Data Lifecycle Management

AnswerA

Customer Lockbox for Microsoft 365 provides an explicit, auditable workflow for customer approval when a Microsoft engineer needs to access customer content to resolve a support issue. This feature ensures that no Microsoft support personnel can gain access to customer data without the customer's designated approver, such as a compliance officer, granting explicit permission for each specific access request. It directly addresses the requirement for a financial institution to control and approve any potential access to their sensitive data by external parties, including Microsoft support.

Why this answer

Customer Lockbox is the correct feature because it provides a controlled access approval process for Microsoft support engineers to access customer content. When a support case requires access to Exchange Online mailboxes or SharePoint sites, Customer Lockbox ensures the request is sent to the institution's compliance officer for explicit approval or rejection before access is granted, meeting the requirement for explicit approval.

Exam trap

The trap here is that candidates often confuse Customer Lockbox with Insider Risk Management, mistakenly thinking that controlling internal user access is the same as controlling Microsoft support access, but Customer Lockbox is specifically designed for external support engineer access approval workflows.

Why the other options are wrong

Communication Compliance is designed to detect and review internal/external communications for policy violations (e.g., offensive language, insider trading), not to control Microsoft support engineers' access to customer content.

Insider Risk Management is designed to detect and investigate risky user activities (e.g., data leaks, policy violations) but does not control or require approval for Microsoft support engineers' access to customer content.

Data Lifecycle Management governs retention and deletion of data based on policies, not controlling Microsoft support engineers' access to content. It does not provide approval workflows for access requests.

Practice this question →

MCQmedium

Your organization uses Microsoft Purview eDiscovery to manage a legal case. You need to place a hold on emails for specific users, but you want to allow the system to apply the hold automatically. Which eDiscovery solution should you use?

A.Microsoft Purview eDiscovery (Standard)

B.Microsoft Purview Audit (Premium)

C.Microsoft Purview Communication Compliance

D.Microsoft Purview eDiscovery (Premium)

AnswerD

Microsoft Purview eDiscovery (Premium) is the advanced solution specifically engineered to manage complex eDiscovery workflows, including the crucial capability of automatic legal holds. It enables organizations to identify custodians, automatically place legal holds on their associated data sources (e.g., Exchange mailboxes, SharePoint sites, OneDrive accounts, Teams chats), and manage these holds centrally. This automation ensures that relevant data is preserved efficiently and consistently across the organization, significantly reducing manual effort and the risk of data spoliation during litigation or investigations.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct choice because it provides advanced legal hold capabilities, including the ability to apply holds automatically based on specified criteria such as user mailboxes or SharePoint sites. Unlike the Standard version, Premium supports policy-based holds that can be set to trigger automatically without manual intervention, which is essential for managing legal cases efficiently.

Exam trap

The trap here is that candidates often confuse eDiscovery (Standard) with eDiscovery (Premium), assuming both can handle automatic holds, but only Premium supports policy-driven, automated hold placement.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview eDiscovery (Standard) only supports manual holds that require an administrator to place and manage each hold individually, lacking the automatic hold functionality described in the question. Option B is wrong because Microsoft Purview Audit (Premium) is focused on logging and investigating user activity, not on placing holds on content for legal cases. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect and manage policy violations in communications (e.g., inappropriate language or sensitive information), not to place legal holds on emails.

Practice this question →

MCQeasy

A company wants to automatically apply a 'Confidential' sensitivity label to all documents containing credit card numbers. Which Microsoft Purview feature should be used to create the auto-labeling policy?

A.Microsoft Purview Data Loss Prevention

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Auto-labeling policies

AnswerD

Microsoft Purview Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content at rest or in transit across Microsoft 365 services. These policies leverage conditions such as sensitive information types, keywords, or trainable classifiers to identify specific content patterns. Upon a match, the designated sensitivity label, like 'confidential,' is automatically applied, ensuring consistent data classification without manual user intervention.

Why this answer

Microsoft Purview Auto-labeling policies are specifically designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This feature uses exact data match or pattern-based detection to label content at rest or in transit, fulfilling the requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Data Loss Prevention (DLP) with auto-labeling because both deal with sensitive data, but DLP enforces actions like blocking or alerting, not applying sensitivity labels automatically.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Loss Prevention (DLP) is focused on preventing unauthorized sharing or leakage of sensitive data by enforcing policies on endpoints, apps, and networks, not on automatically applying sensitivity labels. Option B is wrong because Microsoft Purview Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) by analyzing messages, not to auto-label documents based on content patterns. Option C is wrong because Microsoft Purview Data Lifecycle Management (formerly Records Management) handles retention, deletion, and disposition of data, not the automatic application of sensitivity labels based on content inspection.

Practice this question →

MCQmedium

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

A.Run the Information Barriers policy in test mode

B.Define user segments in the Microsoft Purview compliance portal

C.Enable audit logging and then run the policy application

D.Use the Compliance Manager assessment for Information Barriers

AnswerA

Running an Information Barriers policy in test mode is the correct approach because it simulates the policy's enforcement without actually blocking any communications. This mode generates a detailed report outlining which users and communications would be affected by the policy, allowing administrators to review potential impacts, identify unintended restrictions, and refine the policy configuration before full activation. It provides a safe, non-disruptive method to validate the policy's effectiveness and accuracy against the organization's requirements.

Why this answer

Microsoft Purview Information Barriers include a dedicated test mode that allows administrators to validate policy behavior against user segments before enforcement. Running the policy in test mode evaluates whether communications between specified segments are correctly blocked or allowed, without actually preventing messages, enabling safe validation of the configuration.

Exam trap

The trap here is that candidates may confuse prerequisite configuration steps (like defining segments or enabling audit logging) with the actual testing mechanism, or assume that Compliance Manager can validate Information Barrier policies when it is designed for broader compliance posture assessment.

How to eliminate wrong answers

Option B is wrong because defining user segments is a prerequisite step for creating Information Barrier policies, not a method to test the configuration before enforcement. Option C is wrong because enabling audit logging captures events for compliance review but does not simulate or test the blocking behavior of Information Barrier policies. Option D is wrong because Compliance Manager is a risk assessment tool for regulatory compliance, not a feature for testing Information Barrier policy enforcement.

Practice this question →

MCQeasy

Your organization wants to automatically retain all customer emails for 7 years and then delete them. Which Microsoft Purview feature should you configure?

A.Data Lifecycle Management retention policy

B.Information Protection sensitivity labels

C.Audit log retention

D.eDiscovery hold

AnswerA

A Data Lifecycle Management retention policy is the correct solution because it allows an organization to define how long content should be retained and, optionally, when it should be deleted across various Microsoft 365 services. These policies can be applied broadly to entire locations, such as all Exchange mailboxes or SharePoint sites, ensuring automatic and consistent retention of all customer data according to organizational or regulatory requirements.

Why this answer

Data Lifecycle Management includes retention and deletion policies for Exchange Online. Option B is wrong because Information Protection is about classification. Option C is wrong because Audit is for logging.

Option D is wrong because eDiscovery is for search and hold.

Practice this question →

MCQmedium

A security team needs to investigate a potential data leak where an employee may have emailed sensitive customer information to a competitor. They want to search the unified audit log for specific email activities, such as 'Send' or 'Forward', and generate a detailed report. Which Microsoft Purview solution should they use?

A.Microsoft Purview Compliance Manager

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview Audit (Standard or Premium)

D.Microsoft Purview eDiscovery (Premium)

AnswerC

Microsoft Purview Audit (Standard or Premium) is the essential service for investigating user and administrator activities across Microsoft 365 services, including potential data leaks. It provides access to the unified audit log, which records a vast array of events such as file access, sharing, deletions, and email activities. Investigators can use the Audit log search tool to pinpoint specific actions, users, and timeframes related to a suspected leak, with Premium offering extended retention and advanced capabilities for in-depth forensic analysis.

Why this answer

Microsoft Purview Audit (Standard or Premium) is the correct solution because it captures and logs specific email activities such as 'Send' and 'Forward' from Exchange Online. The security team can search the unified audit log for these operations and export a detailed report for investigation. Compliance Manager, DLP, and eDiscovery do not provide this direct audit log search capability for individual email actions.

Exam trap

The trap here is that candidates confuse Data Loss Prevention (DLP) with audit logging, assuming DLP can retrospectively search for past email actions, when in fact DLP only applies proactive policies and alerts, not historical audit log queries.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Compliance Manager is a risk-assessment and compliance-score tool, not an audit log search tool; it cannot retrieve specific email activities like 'Send' or 'Forward'. Option B is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data leaks by applying policies to block or alert on sensitive content, but it does not provide a searchable audit log of past email actions for forensic investigation. Option D is wrong because Microsoft Purview eDiscovery (Premium) is used for legal hold, collection, and review of content for litigation, not for searching the unified audit log for email send/forward events.

Practice this question →

MCQmedium

A company uses Microsoft 365 and must comply with a regulation that requires all business records, including emails and documents, to be retained for exactly 5 years. They need to automatically apply a retention label to any item that contains the keyword 'Contract' when the item is created or modified. Which Microsoft Purview solution should they use to configure this automatic labeling?

A.Data Lifecycle Management

B.Data Loss Prevention (DLP)

C.Audit

D.Compliance Manager

AnswerA

Microsoft Purview Data Lifecycle Management (formerly Information Governance) enables organizations to manage content throughout its lifecycle. It allows the creation of retention labels that can be automatically applied to content in Microsoft 365 locations like Exchange, SharePoint, and OneDrive based on specific conditions, such as keywords, sensitive information types, or trainable classifiers. This capability directly supports compliance regulations by ensuring data is retained or deleted according to policy, without manual intervention, thus meeting the requirement for automatic labeling based on content.

Why this answer

Data Lifecycle Management (DLM) in Microsoft Purview enables automatic retention labeling based on sensitive content, such as keywords like 'Contract'. It uses auto-labeling policies to apply retention labels at the time of creation or modification, ensuring compliance with the 5-year retention requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Data Loss Prevention (DLP), assuming DLP can apply retention labels, but DLP only enforces actions like blocking or warning, not retention labeling.

How to eliminate wrong answers

Option B is wrong because Data Loss Prevention (DLP) policies are designed to prevent unauthorized sharing or leakage of sensitive data, not to apply retention labels for lifecycle management. Option C is wrong because Audit in Microsoft Purview records user and admin activities for forensic analysis, but it cannot automatically label items based on content. Option D is wrong because Compliance Manager provides risk assessments and recommendations for regulatory compliance, but it does not apply retention labels or enforce retention policies.

Practice this question →

MCQmedium

A legal team is handling a lawsuit and needs to gather all electronically stored information (ESI) related to a specific case from across Microsoft 365, including emails, Teams messages, and SharePoint documents. They need to place a hold on the custodians' data to prevent deletion or modification, and then collect, review, and export the data. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview eDiscovery (Standard)

C.Microsoft Purview Audit (Premium)

D.Microsoft Purview Data Lifecycle Management

AnswerA

Microsoft Purview eDiscovery (Premium) is the comprehensive solution specifically engineered for managing the entire electronic discovery workflow required for complex legal cases. It enables legal teams to identify specific custodians, place defensible legal holds on their data across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams, and then perform advanced collection, processing, review, and analysis of electronically stored information (ESI) using features like analytics and predictive coding. This robust capability ensures all relevant data is preserved and efficiently prepared for litigation.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for legal cases, including the ability to place legal holds on custodians' data across Exchange, Teams, SharePoint, and OneDrive to preserve ESI, and then collect, review, and export that data. The Premium tier adds advanced features like custodian management, review sets, and predictive coding, which are essential for complex litigation scenarios.

Exam trap

The trap here is that candidates confuse eDiscovery (Standard) with eDiscovery (Premium), assuming the Standard tier can handle custodian holds and advanced review, but only Premium provides the full legal hold and collection workflow required for complex litigation.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview eDiscovery (Standard) lacks custodian-based holds, advanced review sets, and predictive coding; it is designed for basic search and export, not for managing complex legal holds and multi-source collection. Option C is wrong because Microsoft Purview Audit (Premium) focuses on logging and investigating user and admin activities, not on placing holds or collecting and exporting ESI for litigation. Option D is wrong because Microsoft Purview Data Lifecycle Management is used for retention and deletion policies (e.g., managing data expiration), not for legal hold, collection, or review of ESI in active litigation.

Practice this question →

MCQhard

A legal team is preparing for a lawsuit and needs to perform a detailed investigation of user activities across Microsoft 365 services. They need to view the 'before' and 'after' values whenever a critical item in SharePoint or Exchange is updated or deleted. The investigation requires high-volume export performance and the ability to search by specific activities like 'MailboxFolderAccess' and 'Send'. Which Microsoft Purview solution should be enabled and configured to meet these advanced auditing requirements?

A.Microsoft Purview Audit (Premium)

B.Microsoft Purview Audit (Standard)

C.Microsoft Purview eDiscovery (Standard)

D.Microsoft Purview Data Lifecycle Management

AnswerA

Microsoft Purview Audit (Premium) is the correct choice because it provides the advanced auditing capabilities essential for a comprehensive legal investigation. It offers extended retention of audit logs, high-volume export functionality, and crucially, detailed logging of 'before' and 'after' values for specific activities. This granular detail allows legal teams to perform deep forensic analysis of user actions and content changes, providing irrefutable evidence for a lawsuit.

Why this answer

Microsoft Purview Audit (Premium) is required because it captures detailed 'before' and 'after' values for critical updates and deletions in SharePoint and Exchange, supports high-volume export performance, and allows searching for specific activities like 'MailboxFolderAccess' and 'Send'. These capabilities go beyond the Standard audit log, which only records basic event metadata without the old/new values and lacks the advanced search and export throughput needed for litigation.

Exam trap

The trap here is that candidates confuse Audit (Standard) with Audit (Premium), assuming Standard logs all details, but Standard only records basic metadata without before/after values or high-volume export, which are exclusive to Premium.

Why the other options are wrong

Microsoft Purview Audit (Standard) does not provide the 'before' and 'after' values for updates or deletions, nor does it support high-volume export or search by specific activities like 'MailboxFolderAccess' and 'Send'. These advanced capabilities require Audit (Premium).

Microsoft Purview eDiscovery (Standard) is designed for content search and export for legal cases, not for detailed activity auditing with 'before' and 'after' values or high-volume export of audit logs. The question specifically requires auditing capabilities (viewing changes, searching specific activities), which are provided by Audit (Premium), not eDiscovery.

Data Lifecycle Management focuses on retaining or deleting data based on policies, not on detailed auditing of user activities or viewing before/after values for updates/deletions. It does not provide the high-volume export or specific activity search capabilities required for the legal investigation.

Practice this question →

MCQhard

A company operates in multiple countries and must comply with GDPR (EU) and CCPA (California). The compliance officer needs a single tool to assess the company's compliance posture against both regulations, get a consolidated compliance score, and receive prioritized improvement actions that can be assigned to responsible teams. The tool should also track progress over time. Which Microsoft Purview solution should the compliance officer use?

A.Microsoft Purview Compliance Manager

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview eDiscovery (Standard)

D.Microsoft Purview Insider Risk Management

AnswerA

Microsoft Purview Compliance Manager is specifically designed to help organizations manage their compliance posture against a wide array of international, national, and industry-specific regulations, such as GDPR and CCPA. It provides a comprehensive solution for assessing, monitoring, and improving compliance by offering a compliance score, actionable improvement recommendations, and the ability to assign tasks to meet specific control requirements. This tool is essential for companies operating globally, needing to track their adherence to multiple, evolving regulatory frameworks.

Why this answer

Microsoft Purview Compliance Manager is the correct solution because it provides a unified dashboard to assess compliance posture against multiple regulations like GDPR and CCPA. It offers a consolidated compliance score, prioritized improvement actions that can be assigned to responsible teams, and tracks progress over time through continuous assessments and automated control mapping.

Exam trap

The trap here is that candidates may confuse Compliance Manager's scoring and action assignment features with DLP's data protection policies, but DLP lacks the regulatory assessment and progress tracking capabilities required for this scenario.

Why the other options are wrong

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent unauthorized sharing of sensitive data, not to assess compliance posture against regulations like GDPR and CCPA or provide a consolidated compliance score and prioritized improvement actions.

Microsoft Purview eDiscovery (Standard) is designed for legal discovery and preservation of electronic content, not for assessing compliance posture against regulations like GDPR and CCPA or providing a consolidated compliance score and improvement actions.

Practice this question →

MCQhard

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. An HR manager wants to ensure that employee records are kept for at least 1 year after last modification. The policy is applied to Exchange, SharePoint, and OneDrive. What is the outcome?

A.The policy will not retain content; it will delete matching content after 365 days, which may not be intended

B.Employee records in Exchange are retained for 365 days after last modification, then deleted

C.Employee records in SharePoint are deleted after 365 days from last modification if they have Department=HR

D.The policy retains content for 365 days and then automatically moves to archive

AnswerA

This policy is configured with a "delete" action after 365 days, meaning it will permanently remove content that matches its criteria once the retention period expires. It does not include a "retain" action to preserve content for a specified duration, only to dispose of it. If the intent was to ensure content availability or prevent early deletion, this configuration is counterproductive, as it solely focuses on content disposition.

Why this answer

The policy is configured as 'Delete only' with a retention period of 365 days. This means that after 365 days from the last modification, the content will be permanently deleted. It does not retain content for any minimum period; it simply deletes it after the specified duration.

The HR manager wants to keep records for at least 1 year, but this policy will delete them exactly at the 1-year mark, which may not be intended if the manager expects retention beyond that point or if the policy should also preserve content until deletion.

Exam trap

The trap here is that candidates often confuse 'retention' with 'retain and delete' and assume a retention policy automatically preserves content indefinitely, when in fact a 'Delete only' policy will delete content after the specified period without any retention grace period.

How to eliminate wrong answers

Option B is wrong because it incorrectly implies that Exchange items are retained for 365 days and then deleted, but the policy is applied to all workloads (Exchange, SharePoint, OneDrive) and the outcome is the same: deletion after 365 days, not retention. Option C is wrong because the policy does not include any adaptive scope or filter for Department=HR; it applies to all content in the specified locations, not just HR records. Option D is wrong because the policy is configured as 'Delete only' with no archive action; retention policies in Microsoft Purview do not automatically move content to archive unless a separate archive policy is configured.

Practice this question →

MCQmedium

A company is subject to a legal hold for an ongoing investigation. The IT administrator must prevent the deletion of any documents related to this case across SharePoint Online and OneDrive, overriding any existing deletion policies. Which Microsoft Purview capability should the administrator use?

A.Data Lifecycle Management

B.eDiscovery (Premium)

C.Audit (Premium)

D.Communication Compliance

AnswerB

eDiscovery (Premium) is the correct service for placing content on legal hold. It enables organizations to identify, preserve, collect, process, and review electronically stored information (ESI) for legal or investigative purposes. A key feature is the ability to apply eDiscovery holds to specific content locations, such as mailboxes and SharePoint sites, which prevents the permanent deletion of data, even if existing retention policies would otherwise dictate its removal. This ensures data integrity for ongoing investigations.

Why this answer

eDiscovery (Premium) is the correct choice because it provides legal hold capabilities that can preserve content in SharePoint Online and OneDrive for Business, overriding any deletion policies. When a legal hold is applied via eDiscovery, the system places a hold on the specified locations, preventing permanent deletion or modification of documents until the hold is released. This directly addresses the requirement to prevent deletion of case-related documents during an ongoing investigation.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (which manages retention and deletion policies) with the legal hold capability, not realizing that only eDiscovery (Premium) can override existing policies to preserve content for an investigation.

Why the other options are wrong

Data Lifecycle Management (DLM) governs retention and deletion policies but does not provide the ability to place a legal hold that overrides existing deletion policies. For legal holds, eDiscovery (Premium) is required.

Communication Compliance is designed to detect and manage inappropriate communications (e.g., offensive language, conflicts of interest) but does not provide the ability to place a legal hold to prevent deletion of documents across SharePoint and OneDrive.

Practice this question →

MCQmedium

A company is involved in litigation. The legal team needs to preserve all relevant electronic documents that reside in Exchange Online, SharePoint Online, and OneDrive for Business. They must prevent users from deleting or modifying these documents while the lawsuit is active. Additionally, they need to search across these locations for specific keywords and export the results for review. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Standard or Premium)

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management (retention policies/labels)

D.Microsoft Purview Data Loss Prevention (DLP)

AnswerA

Microsoft Purview eDiscovery (Standard or Premium) is the correct solution because it is specifically designed to identify, preserve, collect, and produce electronically stored information (ESI) for legal and investigative purposes. It enables organizations to place immutable legal holds on content across Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams, ensuring data integrity. Furthermore, it provides robust search capabilities to pinpoint relevant information and allows for secure export of collected content in a defensible format for legal review.

Why this answer

Microsoft Purview eDiscovery (Standard or Premium) is the correct solution because it provides end-to-end workflow for legal holds (preservation), content search across Exchange Online, SharePoint Online, and OneDrive for Business, and export of results. The legal hold feature prevents deletion or modification by locking the original content, while the search and export capabilities meet the keyword search and review requirements.

Exam trap

The trap here is that candidates often confuse retention policies (Data Lifecycle Management) with legal holds, but retention policies are for scheduled lifecycle management, not for ad-hoc litigation holds that require immediate preservation and search across multiple workloads.

Why the other options are wrong

Data Lifecycle Management focuses on retaining or deleting data based on policies, not on preserving data for legal hold with search and export capabilities. It does not provide the ability to place a hold on content to prevent modification or deletion during litigation.

Data Loss Prevention (DLP) policies are designed to prevent accidental sharing of sensitive data, not to preserve content for litigation or enable search and export across locations.

Practice this question →

MCQhard

Refer to the exhibit. You run the PowerShell command shown to investigate a potential data exfiltration incident. The output is empty. Which is the most likely reason?

A.The user does not have a mailbox

B.The command syntax is incorrect

C.The user did not download or access any files in the past 7 days

D.Audit logging is not enabled for the tenant

AnswerD

For Search-UnifiedAuditLog to return any audit records, unified audit logging must first be explicitly enabled for the entire Microsoft 365 tenant. If this foundational setting is disabled, no user or administrator activities, including file downloads or access, are recorded in the audit log, regardless of user actions or command syntax. Consequently, any attempt to search the audit log will yield no results, indicating a lack of recorded data rather than a lack of activity or a syntax error.

Why this answer

The Search-UnifiedAuditLog cmdlet retrieves entries from the unified audit log. If the output is empty, the most likely cause is that unified audit logging is not enabled for the tenant. In Microsoft 365, unified audit logging must be turned on in the compliance portal or via PowerShell (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true).

Without this, no audit records are generated, so the cmdlet returns no results regardless of user activity.

Exam trap

Common mistake: Candidates often assume that an empty output from Search-UnifiedAuditLog means no activity occurred. However, the most frequent reason is that unified audit logging is not enabled, which prevents any audit records from being captured.

How to eliminate wrong answers

Option A is wrong because even if the user does not have a mailbox, the cmdlet would return an error (e.g., 'The user does not have a mailbox'), not an empty output. Option B is wrong because the command syntax shown is correct for the Search-MailboxAuditLog cmdlet, as it uses valid parameters (-Identity, -LogonTypes, -StartDate, -EndDate). Option C is wrong because if the user had downloaded or accessed files, the cmdlet would return results only if audit logging were enabled; an empty output does not prove no activity occurred, as the lack of audit logging suppresses all entries.

Practice this question →

MCQhard

As a compliance administrator for Contoso Ltd., you are responsible for implementing Microsoft Purview solutions to meet regulatory requirements. The organization operates in the healthcare sector and handles Protected Health Information (PHI). Your key objectives are: (1) Automatically detect PHI in documents stored in SharePoint Online and OneDrive for Business using built-in sensitive information types. (2) Apply a 'Highly Confidential - PHI' sensitivity label that encrypts the content and adds a custom header. (3) Ensure that the label is automatically applied when PHI is detected, with a policy that allows users to override the label with justification. (4) Audit all label application activities for compliance reporting. (5) Retain documents containing PHI for a minimum of 7 years. You have access to Microsoft Purview compliance portal. Which action should you take FIRST to achieve these objectives?

A.Create an auto-labeling policy in Microsoft Purview that applies the sensitivity label to documents containing PHI.

B.Enable auditing in Microsoft Purview by turning on Audit logging.

C.Create a sensitivity label named 'Highly Confidential - PHI' with encryption and header, and publish it to users and groups.

D.Create a retention label and policy to retain documents containing PHI for 7 years.

AnswerC

The creation of a sensitivity label, such as 'Highly Confidential - PHI' with specific protection settings like encryption and header, is the fundamental first step. This label defines the classification and the associated protective actions for the data. Subsequently, publishing the label makes it available for users to apply manually and for auto-labeling policies to utilize, establishing the core data protection framework.

Why this answer

The first step is to create the sensitivity label with the required encryption and header settings and publish it so that it can be used in auto-labeling policies. Auto-labeling policies can then be configured to apply the label based on sensitive info types, with user override. Retention labels and policies are separate and can be configured later.

Audit is enabled by default but should be verified. Therefore, option C is the correct first action.

Practice this question →

MCQeasy

Your organization is implementing a data loss prevention (DLP) policy to prevent sensitive data from being shared via email. Users in the finance department need to send financial reports to external auditors. What should you configure?

A.Add the auditors' domains to a DLP allow list

B.Configure a DLP policy with an override option allowing users to justify the sharing

C.Assign a sensitivity label that automatically encrypts the email

D.Configure a DLP policy with a block action for all external sharing

AnswerB

Configuring a DLP policy with an override option that allows users to justify sharing is the most appropriate solution for balancing security with legitimate business needs. This feature enables organizations to enforce strong data protection while providing a controlled mechanism for users to temporarily bypass a policy when a valid business reason exists, such as sharing specific audit-related documents externally. The justification provided by the user is logged, creating an essential audit trail for compliance and review, ensuring accountability without completely blocking necessary collaboration.

Why this answer

Configuring a DLP policy with an override option allows finance users to share financial reports with external auditors while still providing a justification, ensuring legitimate business needs are met without blocking all external sharing. Option A is incorrect because DLP policies use allow lists for exceptions, but an override with justification is more appropriate for this scenario. Option C is incorrect because sensitivity labels can encrypt emails, but they do not replace the need for a DLP policy with override for specific external sharing.

Option D is incorrect because a block action would prevent all external sharing, which is not suitable for legitimate business needs.

Exam trap

Candidates often confuse sensitivity labels with DLP actions. While labels can enforce encryption, DLP policies directly control data sharing with overrides.

Practice this question →

MCQhard

Refer to the exhibit. An administrator runs this KQL query in Microsoft Purview Audit. What is the purpose of this query?

A.To find the total number of file uploads by all users in the last 30 days

B.To find files larger than a certain size uploaded by a specific user

C.To list all files deleted by a specific user in the last 30 days

D.To identify file types that a specific user uploaded more than 10 times in the last 30 days

AnswerD

This option accurately describes the KQL query's purpose. The query filters events for a *specific user* within the *last 30 days*, focusing exclusively on *file upload* activities. It then *groups these uploads by file type* and subsequently filters the results to display only those *file types that the user uploaded more than 10 times*, effectively identifying frequently uploaded file types by that individual.

Why this answer

The KQL query uses `| summarize Count = count() by FileType` to group audit log entries by file type, then `| where Count > 10` filters for file types that appear more than 10 times. The `where UserId == 'user@domain.com'` restricts the results to a specific user, and `| where TimeGenerated > ago(30d)` limits the time range to the last 30 days. This directly identifies file types uploaded more than 10 times by that user, matching option D.

Exam trap

The trap here is that candidates may misread the query as counting total uploads (option A) or listing files (option C), but the `summarize by FileType` and `where Count > 10` clearly indicate aggregation by file type with a frequency threshold, not a simple list or total count.

How to eliminate wrong answers

Option A is wrong because the query filters by a specific user (`UserId == 'user@domain.com'`), not all users, and it groups by file type rather than counting total uploads. Option B is wrong because the query does not reference file size at all; there is no `FileSize` field or size comparison operator. Option C is wrong because the query looks for upload operations (implicitly via `Operation == 'FileUploaded'` or similar), not deletions, and it groups by file type rather than listing individual files.

Practice this question →

MCQhard

A financial services organization must prevent employees in the Research department from communicating via email or Microsoft Teams with employees in the Investment Banking department to avoid conflicts of interest. Additionally, they need to prevent any credit card numbers from being shared in emails sent to external recipients. Which combination of Microsoft Purview solutions should they implement?

A.Information Barriers and Data Loss Prevention

B.Communication Compliance and Insider Risk Management

C.Information Barriers and Communication Compliance

D.Data Lifecycle Management and Data Loss Prevention

AnswerA

Information Barriers are essential for preventing unauthorized communication and collaboration between specific user groups, fulfilling the "Chinese Wall" requirement in financial services. Complementing this, Data Loss Prevention (DLP) policies actively detect and prevent the sharing of sensitive information, such as credit card numbers, both internally and externally. Together, these solutions provide robust controls for communication segmentation and sensitive data protection, directly addressing both critical organizational needs.

Why this answer

Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest (e.g., research vs. investment banking). Data Loss Prevention (DLP) policies detect and protect sensitive information such as credit card numbers from being shared externally. Communication Compliance focuses on monitoring communications for regulatory compliance but does not block communications, and Insider Risk Management analyzes risky user activities but does not enforce segmentation.

Why the other options are wrong

Communication Compliance monitors for policy violations but does not enforce real-time communication blocks between departments, and Insider Risk Management focuses on detecting risky user activities, not preventing credit card data leakage in emails.

Communication Compliance monitors communications for policy violations but does not enforce restrictions on communication between specific groups; Information Barriers alone cannot prevent data loss of credit card numbers in emails to external recipients.

Data Lifecycle Management (DLM) governs data retention and deletion, not real-time communication restrictions or content scanning for credit card numbers. The question requires both blocking communications between departments (Information Barriers) and preventing credit card data in emails (Data Loss Prevention), which DLM does not address.

Practice this question →

MCQeasy

A compliance officer needs to create a policy that prevents users from sharing files containing medical record numbers (MRN) via email. Which Microsoft Purview solution should they use?

A.Sensitivity labels

B.Data Loss Prevention (DLP)

C.eDiscovery

D.Insider risk management

AnswerB

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations within an organization. A compliance officer can configure DLP policies to detect specific sensitive information types, such as Medical Record Numbers (MRNs), and then enforce actions like blocking emails or other sharing attempts containing that data, thereby directly preventing unauthorized disclosure.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as medical record numbers (MRN), via email. DLP policies can inspect email content and attachments for patterns (e.g., regex for MRNs) and automatically enforce actions like blocking the message or notifying the user, preventing data exfiltration.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which classify and protect data at rest) with DLP (which monitors and controls data in motion), leading them to choose A, even though labels alone cannot block email transmission of sensitive content.

How to eliminate wrong answers

Option A is wrong because sensitivity labels classify and protect data through encryption and visual markings, but they do not actively monitor or block data in transit like email; they are a classification tool, not a real-time enforcement mechanism for sharing. Option C is wrong because eDiscovery is used for searching and exporting content for legal or investigative purposes, not for preventing data loss or blocking file sharing in real time. Option D is wrong because insider risk management focuses on identifying risky user behavior (e.g., unusual file downloads) through analytics and alerts, but it does not directly block file sharing via email; it is a detection and investigation tool, not a prevention control.

Practice this question →

100

MCQmedium

Refer to the exhibit. You are reviewing a Communication Compliance policy. What does this policy do when a user sends an email containing EU GDPR PII to privacy@contoso.com?

A.It blocks the email from being sent.

B.It notifies the policy owner and generates a case for investigation.

C.It automatically deletes the email after 30 days.

D.It applies a sensitivity label to the email.

AnswerB

This option accurately describes the primary actions configured within a Communication Compliance policy when a violation is detected. The system is engineered to notify designated policy owners or reviewers and automatically generate a case within the Microsoft Purview compliance portal. This workflow facilitates a structured investigation and remediation process for identified policy breaches.

Why this answer

Communication Compliance policies in Microsoft 365 are designed to detect and investigate policy violations, not to enforce real-time blocking or automated deletion. When a user sends an email containing EU GDPR PII to a specified recipient like privacy@contoso.com, the policy triggers an alert, notifies the policy owner, and generates a case for investigation in the Compliance Center. This allows organizations to review and remediate potential data privacy violations without disrupting email flow.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention (DLP), assuming that any policy detecting sensitive data will automatically block the email, but Communication Compliance is purely detective and investigative, not preventative.

How to eliminate wrong answers

Option A is wrong because Communication Compliance does not have the capability to block emails from being sent; that function is handled by Data Loss Prevention (DLP) policies, which can enforce real-time blocking actions. Option C is wrong because Communication Compliance does not automatically delete emails after a set period; retention and deletion are managed by retention policies or eDiscovery holds, not by compliance detection policies. Option D is wrong because Communication Compliance does not automatically apply sensitivity labels to emails; label application is performed by auto-labeling policies or manual user action, not by communication compliance rules.

Practice this question →

101

MCQmedium

Your organization wants to automatically retain customer emails for 5 years after they are received, and then delete them. You need to configure the appropriate Microsoft Purview solution. What should you use?

A.eDiscovery case

B.Data loss prevention (DLP) policy

C.Sensitivity label

D.Retention label published automatically

AnswerD

Retention labels published automatically can apply retention and deletion actions based on conditions, making them the correct choice.

Why this answer

Retention labels in Microsoft Purview can be published automatically to apply to emails based on conditions (such as being received from customers), and they can specify both a retention period (e.g., 5 years) and a disposal action (deletion). Option A is incorrect because eDiscovery cases are used for legal hold and content search, not automated retention. Option B is incorrect because DLP policies focus on preventing data loss through sharing control, not retention.

Option C is incorrect because sensitivity labels are primarily for classification and protection, though they can include retention settings; however, the question specifically asks for a retention label published automatically, which is the correct solution.

Practice this question →

102

MCQmedium

A consulting firm is involved in a legal investigation. They need to preserve all emails and documents from two specific employees (custodians) related to a contract dispute. The data must be collected and stored in a secure location for legal review without modifying the original data. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.eDiscovery (Premium)

C.Audit (Premium)

D.Communication Compliance

AnswerB

eDiscovery (Premium) is the correct solution as it provides comprehensive capabilities specifically designed for legal investigations. This service allows organizations to identify and preserve relevant custodians, place immutable legal holds on data across various Microsoft 365 services, collect data from diverse sources, and process it into a secure review set for legal analysis without altering the original content, ensuring defensibility in litigation.

Why this answer

eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing you to identify, preserve, collect, and analyze data from custodians (e.g., employees) without altering the original data. It places a legal hold on mailboxes and sites, ensuring that emails and documents related to the contract dispute are stored in a secure review location for legal review, meeting the requirement of non-modification.

Exam trap

The trap here is that candidates often confuse eDiscovery (Premium) with Audit (Premium) because both involve investigation, but Audit only logs events and does not preserve or collect the actual data for legal review.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management (DLM) focuses on automating retention and deletion policies based on data governance rules, not on preserving data for legal hold or custodian-based collection. Option C is wrong because Audit (Premium) provides detailed logging and investigation of user and admin activities, but it does not preserve or collect data for legal review; it only records events. Option D is wrong because Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) using policies, not to preserve or collect data for a legal investigation involving specific custodians.

Practice this question →

103

MCQhard

Your organization has a Microsoft Purview compliance portal. You need to audit who deleted a specific file from SharePoint Online last week. What should you do?

A.Use Content Search in eDiscovery

B.Search the unified audit log in Microsoft Purview

C.Configure a retention policy for SharePoint

D.Review the data classification dashboard

AnswerB

Searching the unified audit log in Microsoft Purview is the correct approach because it provides a comprehensive record of user and administrator activities across a wide range of Microsoft 365 services, including Exchange Online, SharePoint Online, Teams, and Azure Active Directory. This log captures detailed information about specific actions performed, such as file access, permission changes, mailbox operations, and administrative configurations, along with timestamps, user identities, and IP addresses. It is the definitive source for investigating 'who did what, when, and where' within the organization's Microsoft 365 environment.

Why this answer

The unified audit log in Microsoft Purview records all user and admin activities, including file deletions in SharePoint Online. By searching this log, you can find the specific event that shows who deleted the file, when it happened, and from which location. This is the correct tool for auditing past actions like file deletions.

Exam trap

The trap here is that candidates confuse eDiscovery Content Search (which finds content) with the unified audit log (which finds actions), leading them to choose Option A instead of B.

How to eliminate wrong answers

Option A is wrong because Content Search in eDiscovery is designed to find and export content (e.g., emails, documents) based on search queries, not to audit who performed a specific action like deletion. Option C is wrong because a retention policy preserves data for compliance or legal hold purposes but does not log or reveal who deleted a file. Option D is wrong because the data classification dashboard shows sensitivity labels and data types, not a historical log of user actions such as deletions.

Practice this question →

104

MCQeasy

Your organization is implementing Microsoft 365 and needs to prevent sensitive data from being copied to USB drives. Which Microsoft Purview solution should you configure?

A.Audit logs

B.Communication Compliance

C.Sensitivity labels

D.Endpoint data loss prevention (Endpoint DLP)

AnswerD

Endpoint Data Loss Prevention (Endpoint DLP) extends DLP capabilities directly to Windows and macOS devices, enabling organizations to monitor and control sensitive information as it is used, shared, and transferred. It can detect when users attempt to copy sensitive data to removable media (like USB drives), network shares, cloud services, or print it, and then enforce policies to block, audit, or warn the user. This direct control over endpoint actions makes it the ideal solution for preventing data exfiltration via USB drives.

Why this answer

Endpoint DLP (Data Loss Prevention) monitors and controls actions users take on devices, such as copying sensitive data to USB drives. It enforces policies directly on Windows, macOS, and other endpoints to block unauthorized transfers, making it the correct solution for preventing data exfiltration via removable media.

Exam trap

The trap here is that candidates confuse Sensitivity labels with DLP, not realizing labels only classify and encrypt data but lack the endpoint-level enforcement to block physical device transfers.

How to eliminate wrong answers

Option A is wrong because Audit logs only record user activities for forensic review; they do not actively block data transfers. Option B is wrong because Communication Compliance detects and manages inappropriate communications (e.g., harassment, insider trading) but does not control data movement to USB drives. Option C is wrong because Sensitivity labels classify and protect data through encryption and visual markings, but they do not enforce device-level restrictions like blocking USB copies; they rely on other solutions like DLP for such actions.

Practice this question →

105

MCQhard

An organization uses Microsoft Purview Compliance Manager to track compliance with regulations. The compliance officer needs to create a custom assessment for a new internal policy. What should they do?

A.Use the Microsoft 365 admin center to create a compliance assessment.

B.Create a new custom assessment in Compliance Manager and add custom controls.

C.Use the built-in 'Custom' template in Compliance Manager and modify it.

D.Import a new assessment template from the Microsoft Service Trust Portal.

AnswerB

Organizations frequently have unique internal policies or industry-specific regulations not covered by the extensive library of built-in templates. Microsoft Purview Compliance Manager provides the capability to create entirely new custom assessments from scratch. This allows administrators to define specific controls, assign implementation actions, track progress, and manage risks tailored precisely to their unique organizational compliance requirements, ensuring comprehensive coverage.

Why this answer

In Microsoft Purview Compliance Manager, assessments are built on templates that contain controls. To create a custom assessment for a new internal policy, the compliance officer must create a new custom assessment and then add custom controls, because Compliance Manager does not provide a built-in template for arbitrary internal policies. Option B correctly describes this workflow: creating a new custom assessment and adding custom controls.

Exam trap

The trap here is that candidates confuse the ability to modify a built-in template (which does not exist for custom policies) with the correct process of creating a new custom assessment from scratch, leading them to select Option C.

How to eliminate wrong answers

Option A is wrong because the Microsoft 365 admin center does not have the capability to create compliance assessments; that functionality is exclusive to Microsoft Purview Compliance Manager. Option C is wrong because there is no built-in 'Custom' template in Compliance Manager; you must create a new custom assessment from scratch or from a custom template you have created. Option D is wrong because importing a template from the Microsoft Service Trust Portal only provides pre-built regulatory templates, not a way to create a custom assessment for an internal policy.

Practice this question →

106

Multi-Selecteasy

Which TWO of the following are Microsoft Purview compliance solutions?

Select 2 answers

A.Microsoft Entra ID

B.Data Loss Prevention (DLP)

C.eDiscovery

D.Microsoft Intune

E.Microsoft Defender for Cloud

AnswersB, C

Data Loss Prevention (DLP) is a core component of Microsoft Purview compliance solutions, designed to identify, monitor, and automatically protect sensitive information. DLP policies are applied across Microsoft 365 services, endpoints, and on-premises repositories to prevent the unauthorized sharing, transfer, or use of sensitive data. This capability is crucial for maintaining regulatory compliance and safeguarding organizational data.

Why this answer

Data Loss Prevention (DLP) is a Microsoft Purview compliance solution that helps organizations detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers or personally identifiable information (PII), across email, SharePoint, OneDrive, and endpoints. eDiscovery is another Purview compliance solution that allows legal and compliance teams to search, hold, and export content from Microsoft 365 services for litigation or investigation purposes. Both are core capabilities within the Microsoft Purview compliance portal, distinct from identity, device management, or cloud security tools.

Exam trap

The trap here is that candidates often confuse Microsoft Entra ID (identity) or Microsoft Intune (device management) as compliance solutions because they are part of the broader Microsoft security ecosystem, but the SC-900 exam specifically tests that Purview compliance solutions are limited to tools like DLP, eDiscovery, Information Protection, and Audit.

Practice this question →

107

MCQhard

Refer to the exhibit. A sensitivity label is configured as shown. Which statement about the label's behavior is accurate?

A.When applied, users can choose who can access the document and what permissions they have.

B.The label disables encryption and only adds a header and footer.

C.The label automatically encrypts the document with a predefined template.

D.The label does not apply any protection; it only adds visual markings.

AnswerA

This option is correct because a sensitivity label configured with 'UserDefined' protection empowers the user applying the label to specify who can access the document and precisely what permissions they possess. Instead of a fixed set of rights, the user can dynamically assign granular access controls, such as view-only, edit, or co-author, to specific individuals or groups at the point of content creation or modification. This provides flexible and context-aware data protection.

Why this answer

The exhibit shows a sensitivity label configured with 'Let users assign permissions' under 'User-defined permissions' in Azure Information Protection. This setting allows end users to define custom permissions (e.g., who can read, edit, or forward) when applying the label, rather than using a fixed template or automatic encryption.

Exam trap

The trap here is that candidates often confuse 'user-defined permissions' with 'no encryption' or 'automatic encryption with a template,' failing to recognize that the exhibit's configuration explicitly enables user-controlled encryption rather than disabling it or using a fixed template.

How to eliminate wrong answers

Option B is wrong because the label does not disable encryption; it enables user-defined encryption, meaning encryption is applied but the user controls the permissions. Option C is wrong because the label does not automatically encrypt with a predefined template; it relies on user-defined permissions, not a fixed template. Option D is wrong because the label does apply protection (encryption) via user-defined permissions, not just visual markings like headers and footers.

Practice this question →

108

MCQhard

A company is involved in a lawsuit. The legal team needs to preserve all emails, documents, and Teams messages from five key employees (custodians) that are related to a specific project. The data must be collected securely and provided for legal review without modifying the original data. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.eDiscovery (Premium)

C.Records Management

D.Communication Compliance

AnswerB

eDiscovery (Premium) is the correct solution as it provides a comprehensive, end-to-end workflow specifically designed for legal discovery requirements within Microsoft 365. It enables legal teams to identify, preserve, collect, process, review, and export data from various sources like Exchange mailboxes, SharePoint sites, and Teams, all while maintaining the integrity of the original data and managing legal holds efficiently for specific custodians.

Why this answer

eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing organizations to identify, preserve, collect, and export relevant data (emails, documents, Teams messages) from custodians without altering the original data. It supports legal hold, advanced search, and secure export for legal review, meeting the lawsuit requirements.

Exam trap

The trap here is that candidates confuse Data Lifecycle Management or Records Management with eDiscovery, but those solutions manage retention and deletion policies rather than providing the custodial hold, search, and export capabilities required for legal preservation and review.

How to eliminate wrong answers

Option A (Data Lifecycle Management) is wrong because it focuses on automating retention and deletion policies for compliance and governance, not on preserving data for legal hold or collecting it for litigation. Option C (Records Management) is wrong because it is used to classify and manage records for regulatory compliance, often with immutable retention, but it does not provide the custodial search, hold, and export capabilities needed for eDiscovery. Option D (Communication Compliance) is wrong because it is designed to detect and mitigate policy violations (e.g., insider trading, harassment) in communications, not to preserve and collect data for legal proceedings.

Practice this question →

109

MCQmedium

A compliance administrator configures the above retention policy. A document created on January 1, 2025, in SharePoint Online will be retained until when?

A.Indefinitely

B.January 1, 2026

C.December 31, 2025

D.January 1, 2025

AnswerC

This option is correct because the retention policy specifies a 365-day period starting from the content creation date. If a document is created on January 1, 2025, counting 365 full days forward means the retention period concludes at the end of December 31, 2025. This ensures the item is preserved for the entire calendar year from its creation, making December 31, 2025, the precise end date for its active retention.

Why this answer

The retention policy uses the 'When created' trigger, so a document created on January 1, 2025 is retained for 365 days from that date, expiring on December 31, 2025. Option A is incorrect because the retention period is finite. Option B is incorrect because the retention duration is 365 days from creation, not from the end of the year.

Option D is incorrect because the retention period does not end on the creation date itself.

Practice this question →

110

MCQhard

A security team needs to investigate a potential data breach in Microsoft 365. They require detailed forensic logs showing every instance of mailbox access, mailbox search performed by administrators, and changes to email forwarding rules in Exchange Online. The logs must be retained for 1 year. Which Microsoft Purview solution should they use?

A.Audit (Standard)

B.Audit (Premium)

C.eDiscovery (Standard)

D.eDiscovery (Premium)

AnswerB

Audit (Premium) logs high-value events like mailbox access and forwarding rule changes, and supports up to 1-year retention, making it the correct choice.

Why this answer

Audit (Premium) is required because the question specifies detailed forensic logs for mailbox access, administrator mailbox searches, and changes to email forwarding rules—all of which are high-value, user-specific events that are only captured by Audit (Premium). Audit (Standard) logs basic events but lacks the granularity for these specific operations, and it retains logs for only 90 days by default, whereas Audit (Premium) supports up to 1 year of retention. eDiscovery solutions are for searching and exporting content, not for continuous logging of administrative actions.

Exam trap

The trap here is that candidates confuse eDiscovery (which is for searching and exporting content) with auditing (which is for logging events), and they underestimate the specific event types that require Audit (Premium) over Audit (Standard).

How to eliminate wrong answers

Option A is wrong because Audit (Standard) does not log detailed mailbox access events, administrator mailbox searches, or changes to email forwarding rules; it only captures basic CRUD operations and has a default retention of 90 days, not 1 year. Option C is wrong because eDiscovery (Standard) is a content search and export tool, not a logging or auditing solution; it cannot provide forensic logs of mailbox access or rule changes. Option D is wrong because eDiscovery (Premium) is an advanced content search, review, and analytics tool for legal cases, not a continuous audit log solution; it does not generate or retain logs of administrative actions.

Practice this question →

111

MCQhard

A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?

A.Create new assessments for each regulation

B.Configure improvement actions with owners

C.Set up connectors to import external risk data

D.Use the Microsoft 365 admin center to delegate tasks

AnswerB

Configuring improvement actions with owners in Microsoft Purview Compliance Manager is the direct mechanism for operationalizing compliance requirements. These actions represent specific tasks derived from controls and regulations, such as implementing a data encryption policy or updating a privacy notice. Assigning an owner ensures accountability, facilitates the delegation of remediation efforts, and enables tracking of progress and evidence submission, directly addressing the need to comply with regulations like GDPR.

Why this answer

To automatically assign each control to the appropriate team member for remediation in Microsoft Purview Compliance Manager, you must configure improvement actions with owners. Each improvement action can be assigned to a specific user who is responsible for implementing the remediation steps, and this assignment triggers automatic notifications and tracking within the compliance score.

Exam trap

The trap here is that candidates often confuse creating assessments (which organize controls) with the actual assignment of remediation tasks, leading them to choose Option A instead of understanding that improvement actions with owners are the mechanism for automatic assignment.

Why the other options are wrong

Creating new assessments for each regulation helps evaluate compliance but does not automatically assign controls to team members for remediation. The question specifically asks for automatic assignment, which requires configuring improvement actions with owners.

Setting up connectors to import external risk data helps bring in risk signals from outside sources, but it does not automatically assign controls to team members for remediation. The question specifically asks about assigning controls to appropriate team members, which is achieved by configuring improvement actions with owners.

The Microsoft 365 admin center is used for general administrative tasks like user management and service configuration, not for assigning compliance controls to team members. Compliance Manager's improvement actions with owners is the correct feature for this purpose.

Practice this question →

112

MCQmedium

Your organization has a Microsoft Purview Data Lifecycle Management policy that deletes emails after 3 years. A legal hold is placed on a user's mailbox. What happens to the emails?

A.Only emails created before the hold are deleted

B.Emails are preserved and not deleted despite the retention policy

C.Emails are deleted immediately to avoid conflicting policies

D.Emails are deleted after 3 years as per the retention policy

AnswerB

A legal hold, also known as an eDiscovery hold, establishes an absolute preservation requirement that takes precedence over any conflicting retention policies. Its primary function is to ensure that all relevant data, such as emails, remains immutable and discoverable for legal or investigative purposes. This means emails will be preserved and not deleted, even if a retention policy would otherwise dictate their removal, until the hold is explicitly released.

Why this answer

When a legal hold is placed on a user's mailbox in Microsoft Purview, it takes precedence over any deletion actions from Data Lifecycle Management policies. The hold preserves all mailbox content, including emails that would otherwise be deleted after 3 years, ensuring data is retained for legal or compliance purposes. This is because legal holds are designed to prevent permanent deletion of data subject to litigation or investigation.

Exam trap

The trap here is that candidates often assume retention policies always execute deletion regardless of other configurations, but Microsoft Purview explicitly prioritizes holds over deletion actions, making the hold a superseding rule.

How to eliminate wrong answers

Option A is wrong because legal holds preserve all existing emails regardless of creation date, not just those created before the hold; the hold applies to all current content and prevents deletion. Option C is wrong because conflicting policies do not cause immediate deletion; instead, Microsoft Purview resolves conflicts by prioritizing holds over retention deletion actions. Option D is wrong because the legal hold overrides the retention policy's deletion timeline, so emails are not deleted after 3 years while the hold is active.

Practice this question →

113

Matchingmedium

Match each compliance framework to its primary focus.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Data protection and privacy for EU citizens

Information security management system standard

Cybersecurity risk management framework

Healthcare data privacy and security in the US

Service organization controls for data security

Why these pairings

Correct matches: GDPR = data privacy, ISO 27001 = information security management, SOC 2 = trust service criteria. Common confusions include mixing GDPR with financial controls (SOX) or privacy with broader security.

Practice this question →

114

Multi-Selectmedium

Which THREE are benefits of using Microsoft Purview Compliance Manager?

Select 3 answers

A.Create Data Loss Prevention policies.

B.View a compliance score that indicates your overall compliance posture.

C.Assign compliance tasks to other users in your organization.

D.Receive recommendations for improvement actions to achieve compliance.

E.Automatically apply sensitivity labels to documents.

AnswersB, C, D

A core benefit of Microsoft Purview Compliance Manager is its ability to provide a quantifiable compliance score, which serves as a real-time indicator of an organization's overall compliance posture against various regulations and standards. This score is dynamically calculated based on the implementation status of recommended actions and controls, allowing organizations to quickly assess their progress and identify areas needing improvement. It provides a clear, measurable metric for tracking compliance efforts over time.

Why this answer

Compliance Manager provides a compliance score to indicate your overall compliance posture (B), suggests improvement actions to achieve compliance (D), and allows you to assign compliance tasks to other users (C). Option A is incorrect because Data Loss Prevention policies are created in the Microsoft Purview compliance portal, not directly in Compliance Manager. Option E is incorrect because automatically applying sensitivity labels is done through auto-labeling policies, not Compliance Manager.

Practice this question →

115

MCQmedium

A legal team needs to preserve all electronic documents related to an ongoing lawsuit. These documents reside in Exchange Online mailboxes, SharePoint Online sites, and OneDrive for Business accounts. The team also needs the ability to search across these locations for specific keywords and export the results for review. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Audit

AnswerA

eDiscovery (Premium) provides end-to-end workflow for legal investigations, including identifying and holding relevant data, searching for specific content using keywords and conditions, reviewing results with advanced analytics, and exporting data for external review. It is the appropriate solution for litigation holds and search.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for preserving, searching, and exporting content from Exchange Online mailboxes, SharePoint Online sites, and OneDrive for Business accounts. It supports legal hold to preserve data, keyword search across these sources, and export of results for review, meeting all requirements of the legal team.

Exam trap

The trap here is that candidates confuse eDiscovery with Audit, thinking Audit can search and export content, but Audit only provides activity logs, not the ability to preserve or export the actual documents.

Why the other options are wrong

Microsoft Purview Data Lifecycle Management focuses on retaining or deleting content based on policies, not on preserving data for legal hold or performing search and export across mailboxes, SharePoint, and OneDrive for litigation purposes.

Data Loss Prevention (DLP) policies prevent accidental sharing of sensitive data but do not provide legal hold, search, or export capabilities across mailboxes, SharePoint, and OneDrive for litigation purposes.

Microsoft Purview Audit provides logging of user and admin activities but does not support preservation, search, or export of content across mailboxes, sites, and accounts for legal hold purposes.

Practice this question →

116

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Purview Information Protection?

Select 2 answers

A.Searching for content in eDiscovery

B.Preventing data loss via policies

C.Setting retention periods for content

D.Applying sensitivity labels to documents and emails

E.Encrypting content with Azure Rights Management

AnswersD, E

Applying sensitivity labels to documents and emails is a fundamental capability of Microsoft Purview Information Protection. These labels allow organizations to classify data based on its sensitivity level, such as 'Confidential' or 'Public,' and then automatically enforce corresponding protection actions. This includes visual markings, encryption, and access restrictions, ensuring consistent data governance and protection across various platforms and applications.

Why this answer

Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Applying sensitivity labels to documents and emails (Option D) is a core MIP capability, as labels enforce protection actions like encryption or visual markings. Encrypting content with Azure Rights Management (Option E) is the underlying technology that MIP uses to apply persistent protection, making it a direct capability of the solution.

Exam trap

The trap here is that candidates confuse the broad 'Microsoft Purview' umbrella with its specific sub-solutions, mistakenly attributing eDiscovery, DLP, or retention capabilities to Information Protection when each is a distinct workload with separate functions.

Practice this question →

117

MCQhard

A company wants to monitor Microsoft Teams messages and corporate emails for policy violations related to potential harassment and inappropriate behavior. They need a solution that allows them to define policies with conditions (e.g., keywords, patterns), automatically flag suspicious conversations, and optionally send notifications to the sender or escalate to a reviewer. Additionally, they need the ability to train employees when a minor violation is detected. Which Microsoft Purview solution should they use?

A.Data Loss Prevention (DLP)

B.Communication Compliance

C.Information Protection

D.Audit

AnswerB

Communication Compliance is the correct solution, specifically designed to help organizations detect, investigate, and act on inappropriate messages within Microsoft Teams, Exchange Online, Yammer, and other communication platforms. It leverages intelligent classifiers and customizable policies to identify potential regulatory compliance issues, code-of-conduct violations, or instances of harassment. This service provides a robust framework for reviewing flagged communications, taking remediation actions such as notifying users, and fostering a compliant and respectful workplace environment.

Why this answer

Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and corporate emails by scanning for keywords, patterns, and other conditions. It can automatically flag suspicious conversations, send notifications to the sender, escalate to a reviewer, and even train employees on minor violations through its built-in remediation workflows.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention (DLP) because both involve policy-based scanning of communications, but DLP lacks the behavioral monitoring, notification, and training capabilities required for harassment and inappropriate behavior scenarios.

Why the other options are wrong

Information Protection focuses on classifying and protecting sensitive data (e.g., labels, encryption) but does not include monitoring communications for policy violations like harassment or sending training notifications.

Audit logs user and admin activity but does not define policies to monitor content for harassment or policy violations, nor does it provide training or notification features.

Practice this question →

118

MCQmedium

A healthcare organization must comply with HIPAA. They need to automatically detect protected health information (PHI) such as medical record numbers in outgoing email, prevent users from sharing these emails with unauthorized external recipients, and apply a retention label that retains PHI emails for six years. Which Microsoft Purview solution should they use?

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Information Protection (sensitivity labels)

C.Microsoft Purview Data Lifecycle Management (retention policies)

D.Microsoft Purview Audit

AnswerA

DLP policies can be configured to scan Exchange Online emails for PHI, automatically block unauthorized sharing, and apply a retention label via an associated policy action. This meets all the stated requirements.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically detect sensitive data like PHI (e.g., medical record numbers) in outgoing emails using built-in or custom sensitive info types, block unauthorized external sharing, and trigger a retention label action via auto-labeling policies to retain the emails for six years. DLP policies integrate with Exchange Online to inspect email content in transit, apply access restrictions, and enforce retention labels through Power Automate or auto-labeling rules.

Exam trap

The trap here is that candidates confuse the detection and blocking capability of DLP with the classification-only capability of Information Protection (sensitivity labels), or they incorrectly think Data Lifecycle Management alone can enforce access controls, when in fact DLP is the only solution that combines content inspection, real-time blocking, and label application in a single policy.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Information Protection (sensitivity labels) can classify and protect data with encryption or markings, but it cannot automatically detect PHI in outgoing email and block sharing with unauthorized external recipients—that requires DLP policy actions. Option C is wrong because Microsoft Purview Data Lifecycle Management (retention policies) can retain emails for six years, but it cannot detect PHI or prevent sharing; it only manages retention and deletion. Option D is wrong because Microsoft Purview Audit logs user and admin activities for forensic investigation, but it cannot detect PHI in real-time, block email sharing, or apply retention labels.

Practice this question →

119

Multi-Selectmedium

Which TWO of the following are capabilities of Microsoft Purview Communication Compliance? (Select TWO.)

Select 2 answers

A.Enforce company policies on communication channels

B.Detect offensive language in emails and Teams messages

C.Automatically apply sensitivity labels to documents

D.Prevent sharing of credit card numbers via email

E.Place legal holds on user mailboxes

AnswersA, B

Microsoft Purview Communication Compliance is specifically designed to help organizations detect, investigate, and remediate policy violations in internal and external communications. This capability allows administrators to define policies that automatically scan communication channels, such as Microsoft Teams, Exchange email, and Yammer, for content that violates company standards, regulatory requirements, or ethical guidelines, thereby enforcing appropriate conduct and preventing risks.

Why this answer

Microsoft Purview Communication Compliance allows organizations to enforce company policies on communication channels such as email, Microsoft Teams, and third-party platforms. It does this by scanning communications for policy violations (e.g., insider trading, harassment) and enabling designated reviewers to take remediation actions like escalating or archiving messages.

Exam trap

The trap here is that candidates confuse Communication Compliance with Data Loss Prevention (DLP) or Information Protection, since all three involve content scanning—but Communication Compliance is specifically for monitoring and reviewing communications for policy violations, not for automatic labeling or blocking sensitive data.

Practice this question →

120

MCQmedium

A multinational company uses Microsoft 365 and has a retention policy that automatically applies a 7-year retention label to any document containing a credit card number. The retention label must be automatically applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator use to configure this automatic labeling rule?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Retention Policy

C.Microsoft Purview Sensitivity Labels

D.Microsoft Purview eDiscovery

AnswerA

Microsoft Purview Data Lifecycle Management is the correct service for managing data retention and deletion across an organization, offering retention labels that can be manually applied or, crucially, automatically applied via auto-labeling policies. These policies leverage conditions like sensitive information types, keywords, or trainable classifiers to ensure content-specific retention actions are taken without manual intervention. This directly addresses the need for content-based automatic retention.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the correct solution because it provides the ability to create and apply retention labels automatically based on sensitive information types, such as credit card numbers, using auto-labeling policies. This ensures that the retention label is applied at the time of document creation or modification, meeting the requirement for automatic application without user intervention.

Exam trap

The trap here is that candidates confuse 'Retention Policy' (which applies at the container level) with 'Retention Labels' (which can be auto-applied at the item level), leading them to select Option B, but the question specifically requires automatic labeling based on content, which only Data Lifecycle Management supports.

How to eliminate wrong answers

Option B is wrong because a Microsoft Purview Retention Policy applies retention settings at the container level (e.g., entire site or mailbox) and cannot be configured to automatically apply a specific retention label based on content containing a credit card number; it lacks the granularity for content-based auto-labeling. Option C is wrong because Sensitivity Labels are designed for classification and protection (e.g., encryption, access restrictions) based on sensitivity, not for retention duration; while they can be auto-applied, they do not enforce a 7-year retention period by default. Option D is wrong because Microsoft Purview eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for configuring automatic retention label application based on content detection.

Practice this question →

121

MCQhard

A multinational corporation must comply with the EU General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) by searching for personal data across Exchange Online, SharePoint Online, and OneDrive for Business. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management

B.Audit (Premium)

C.eDiscovery (Premium)

D.Data Loss Prevention (DLP)

AnswerC

eDiscovery can search across mailboxes, sites, and OneDrive to find personal data for DSARs.

Why this answer

EDiscovery (Premium) provides powerful search capabilities across Exchange Online, SharePoint Online, and OneDrive for Business, making it suitable for DSARs. Option A is incorrect because Data Lifecycle Management focuses on retention and deletion policies, not content search. Option B is incorrect because Audit (Premium) logs user activities but does not search for specific content.

Option D is incorrect because Data Loss Prevention (DLP) prevents data leakage but does not provide the content search needed for DSARs.

Practice this question →

122

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Purview classification rule. The rule is enabled and set to apply a sensitivity label. However, you notice that documents containing EU personal data are not being labeled automatically. What is the most likely cause?

A.The label ID is invalid

B.The rule does not include a condition to detect sensitive data

C.The rule status is Disabled

D.The rule is not scoped to SharePoint Online

AnswerB

For an auto-labeling policy or rule to effectively identify and apply a sensitivity label to content, it must incorporate specific conditions that define what constitutes sensitive data. These conditions typically involve detecting specific sensitive information types (SITs), keywords, or patterns within documents or emails. Without any defined conditions, the rule lacks the necessary criteria to evaluate content, rendering it incapable of matching or labeling any data, regardless of other policy settings.

Why this answer

The rule is enabled and applies a sensitivity label, but documents containing EU personal data are not being labeled automatically. For automatic labeling to occur, the classification rule must include a condition that detects sensitive data types (e.g., EU passport numbers or GDPR-defined personal data). Without such a condition, the rule has no trigger to identify the content and apply the label, even if the rule is active and scoped correctly.

Exam trap

Microsoft often tests the misconception that enabling a rule and setting a label is sufficient for automatic labeling, when in fact a sensitive data detection condition is mandatory for the rule to trigger.

How to eliminate wrong answers

Option A is wrong because an invalid label ID would cause a configuration error or prevent the label from being applied at all, but the question states the rule is enabled and set to apply a sensitivity label, implying the label ID is valid. Option C is wrong because the rule status is explicitly stated as enabled, not disabled. Option D is wrong because the rule not being scoped to SharePoint Online would prevent labeling in that workload, but the issue is that documents are not being labeled at all, regardless of location, and the core problem is the lack of a detection condition.

Practice this question →

123

MCQhard

A company uses Microsoft Purview. A compliance officer applies a retention label to a set of legal documents and configures the label to mark the items as records. After the label is applied, a user attempts to delete one of these documents from SharePoint Online. What will be the outcome?

A.The user is allowed to delete the document, but a copy is retained in a preservation hold.

B.The user receives an access denied error and cannot delete the document.

C.The document is deleted and immediately purged from the recycle bin.

D.The delete action is allowed but an audit event is generated and the document is still retained for the specified period.

AnswerB

When a compliance officer applies a record label to a document in Microsoft Purview, the item becomes an immutable record. This action prevents any user, including the creator or an administrator, from deleting or modifying the document during its retention period. Consequently, any attempt to delete the document will result in an "access denied" error, ensuring the integrity and immutability required for regulatory compliance and legal obligations.

Why this answer

When a retention label is configured to mark items as records, the items become immutable and locked. In SharePoint Online, records cannot be deleted by users; any attempt to delete a record results in an 'access denied' error because the retention policy overrides standard user permissions to enforce compliance.

Exam trap

The trap here is that candidates often confuse 'records' with 'regulatory records' or assume that retention labels only trigger audit events without blocking actions, but marking as a record strictly prohibits deletion and editing.

Why the other options are wrong

When a retention label marks items as records, they become immutable and cannot be deleted by users. The label prevents deletion entirely, not just with a copy retained.

When a retention label marks items as records, they become immutable and cannot be deleted by users; deletion is blocked entirely, not allowed with immediate purge.

When a retention label marks items as records, they become immutable and cannot be deleted by users. Option D describes behavior for items under a retention policy without record marking, not for records.

Practice this question →

124

MCQeasy

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

A.Microsoft Purview Communication Compliance

B.Microsoft Purview Message Encryption

C.Microsoft Purview Data Loss Prevention (DLP)

D.Microsoft Purview Data Lifecycle Management

AnswerC

Data Loss Prevention (DLP) policies can detect sensitive information such as credit card numbers in emails, block the message with a policy tip, allow override with business justification, and generate reports for compliance review.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A (Communication Compliance) is for communication monitoring, not data protection.

Option B (Message Encryption) is for email encryption, not blocking. Option D (Data Lifecycle Management) is for retention, not real-time blocking.

Practice this question →

125

MCQhard

A legal department is preparing for litigation. They need to preserve all potentially relevant content in Exchange Online, SharePoint Online, and Teams to prevent deletion or modification. Additionally, they must search across these locations for specific keywords and export the results for external review. Which Microsoft Purview solution should they use?

A.eDiscovery (Standard)

B.Audit (Standard)

C.Data Lifecycle Management

D.Communication Compliance

AnswerA

eDiscovery (Standard) allows legal hold, search, and export of content across Exchange, SharePoint, Teams, and more for legal cases.

Why this answer

eDiscovery (Standard) is the correct solution because it provides the capabilities to place Exchange Online, SharePoint Online, and Teams content on legal hold to preserve it from deletion or modification, and it includes built-in search and export functions for litigation. This solution directly addresses the requirements for preservation, keyword search across multiple workloads, and export for external review.

Exam trap

The trap here is that candidates often confuse Audit (Standard) with eDiscovery because both are in the Purview compliance portal, but Audit only records events while eDiscovery provides the legal hold, search, and export actions required for litigation.

Why the other options are wrong

Audit (Standard) logs user and admin activities but does not provide capabilities to preserve content via legal hold or search/export content across Exchange, SharePoint, and Teams for litigation.

Data Lifecycle Management focuses on retaining or deleting content based on policies (e.g., retention tags), not on preserving content for litigation (legal hold) or searching/exporting for eDiscovery purposes.

Communication Compliance is designed to detect and mitigate communication risks (e.g., harassment, insider trading) by analyzing messages, not to preserve, search, and export content for litigation hold and eDiscovery purposes.

Practice this question →

126

MCQmedium

A compliance administrator creates a retention policy as shown in the exhibit. What is the overall effect of this policy on content in SharePoint Online?

A.Content is deleted immediately after 7 years from creation.

B.Content is automatically labeled after 7 years.

C.Content is retained indefinitely after 7 years.

D.Content is retained for 7 years and then automatically deleted.

AnswerD

The policy combines retention with a delete action at the end.

Why this answer

The retention policy in the exhibit is configured to retain content for 7 years and then delete it. This means content in SharePoint Online will be kept for the specified duration and automatically purged at the end of the retention period, which matches option D.

Exam trap

The trap here is confusing 'retention' with 'deletion' timing—candidates often think retention policies only preserve content indefinitely or that deletion happens immediately at the end of the period, but Microsoft's retention policies enforce a 'retain then delete' lifecycle by default.

How to eliminate wrong answers

Option A is wrong because it states content is deleted immediately after 7 years from creation, but the policy explicitly retains content for 7 years before deletion, not immediately upon creation. Option B is wrong because retention policies do not automatically apply labels; labels are applied via sensitivity or retention labels, not retention policies. Option C is wrong because the policy specifies a retention period of 7 years, not indefinite retention; indefinite retention would require a different configuration (e.g., 'retain forever').

Practice this question →

127

MCQmedium

A company uses Microsoft Teams and wants to ensure that messages containing offensive language are flagged for review. Which Microsoft Purview solution should be used?

A.Microsoft Purview Information Barriers

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Audit

AnswerB

Communication Compliance uses classifiers to detect offensive language.

Why this answer

Microsoft Purview Communication Compliance is designed to detect and flag messages containing offensive language, harassment, or other policy violations in Microsoft Teams, Exchange Online, and Yammer. It uses customizable policies and machine learning classifiers to automatically review communications and route flagged items for human review, making it the correct solution for this requirement.

Exam trap

The trap here is that candidates often confuse Communication Compliance with Data Loss Prevention, mistakenly thinking DLP handles offensive content when it actually only protects sensitive data, not language policy violations.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Barriers restrict communication and collaboration between specific groups (e.g., to prevent conflicts of interest), but they do not analyze message content for offensive language. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) focuses on preventing the accidental sharing of sensitive data (e.g., credit card numbers, PII) and does not detect offensive language. Option D is wrong because Microsoft Purview Audit logs user and admin activities for compliance and forensic investigation, but it does not proactively scan or flag message content for offensive language.

Practice this question →

128

Multi-Selectmedium

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams?

Select 2 answers

A.Information barriers

B.Communication compliance

C.Data Loss Prevention (DLP)

D.Sensitivity labels

E.eDiscovery

AnswersC, D

DLP policies can block sharing of sensitive data in Teams.

Why this answer

Data Loss Prevention (DLP) policies in Microsoft Purview can scan Microsoft Teams messages and files for sensitive data types (e.g., credit card numbers, social security numbers) and automatically block or warn users when such data is shared. Sensitivity labels can be applied to Teams files and messages to enforce encryption, access restrictions, or visual markings, thereby protecting sensitive data at rest and in transit.

Exam trap

The trap here is that candidates often confuse Information barriers (which control who can communicate) with DLP (which controls what data can be shared), or they mistakenly think Communication compliance is a protective measure when it is actually a detective and review tool.

Practice this question →

129

MCQmedium

A compliance officer needs to retain customer records for 7 years and then automatically delete them. However, during an ongoing legal case, the legal team must preserve specific documents indefinitely without affecting the retention policy for other documents. Which combination of Microsoft Purview solutions should the company use?

A.Data Lifecycle Management and eDiscovery

B.Records Management and Audit

C.Information Protection and Data Loss Prevention

D.Communication Compliance and Insider Risk Management

AnswerA

Data Lifecycle Management sets the retention and deletion policy. eDiscovery allows legal holds to preserve specific content for litigation without altering the retention policy.

Why this answer

Data Lifecycle Management (DLM) allows you to define retention policies (e.g., 7 years) and then automatically delete data at the end of that period. eDiscovery (specifically, eDiscovery holds) lets you place a legal hold on specific documents, preserving them indefinitely without altering the broader retention policy. Together, they meet both the automatic deletion requirement and the need to preserve documents during litigation.

Exam trap

The trap here is that candidates confuse Records Management (which can also apply retention and deletion) with Data Lifecycle Management, but Records Management lacks the legal hold capability that eDiscovery provides for preserving specific documents during litigation.

How to eliminate wrong answers

Option B (Records Management and Audit) is wrong because Records Management focuses on declaring records and applying retention labels, but it does not provide the ability to place a legal hold on specific documents during litigation; Audit only tracks activities and does not enforce retention or holds. Option C (Information Protection and Data Loss Prevention) is wrong because Information Protection deals with sensitivity labels and encryption, while Data Loss Prevention prevents unauthorized sharing—neither addresses retention, deletion, or legal holds. Option D (Communication Compliance and Insider Risk Management) is wrong because Communication Compliance monitors for policy violations in communications, and Insider Risk Management detects risky user activities; neither solution manages retention policies or legal holds.

Practice this question →

130

MCQhard

A company is implementing Microsoft Purview Communication Compliance to detect inappropriate messages. They need to monitor Microsoft Teams channel messages and chat messages for potential policy violations. Which configuration is required?

A.Enable Microsoft Purview Data Loss Prevention (DLP) policies for Teams.

B.Set up an Exchange Online retention policy to retain Teams messages.

C.Deploy a third-party archiving solution for Teams messages.

D.Configure a Communication Compliance policy that includes Teams messages as the supervised communication channel.

AnswerD

Communication Compliance policies can supervise Teams messages by adding Teams as a channel.

Why this answer

Communication Compliance policies can be configured to monitor Microsoft Teams channel messages and chat messages natively, without requiring additional DLP policies, retention policies, or third-party archiving. The policy must include Teams messages as a supervised communication channel. Option A is incorrect because DLP policies are not required for Communication Compliance monitoring; they serve a different purpose.

Option B is incorrect because Exchange Online retention policies retain data but do not enable monitoring for policy violations. Option C is incorrect because Microsoft provides native integration for Teams monitoring, so a third-party solution is unnecessary.

Exam trap

Candidates may mistakenly believe that enabling DLP or retention policies is a prerequisite for monitoring Teams messages, but Communication Compliance directly supports Teams as a supervised channel without additional configuration.

Practice this question →

131

MCQmedium

A company uses Microsoft Purview Compliance Manager to improve their compliance posture. They are preparing for a SOC 2 audit and need to score compliance with SOC 2 controls, track improvement actions, and assign tasks to responsible teams. Which component of Compliance Manager should they use to assign and track specific actions to improve their compliance score?

A.Assessment

B.Control

C.Improvement action

D.Template

AnswerC

Improvement actions are detailed tasks that can be assigned to groups or individuals, tracked, and documented to demonstrate compliance progress.

Why this answer

Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.

Exam trap

The trap here is that candidates confuse 'Control' (the requirement) with 'Improvement action' (the task to meet the requirement), leading them to select B, even though controls are not directly assignable or trackable as individual tasks.

How to eliminate wrong answers

Option A is wrong because an Assessment is a container that groups controls from a specific regulation (like SOC 2) and tracks your overall compliance score, but it does not provide the granular, assignable tasks needed to drive improvement. Option B is wrong because a Control is a specific requirement from the regulation (e.g., 'Access must be logged'), but it is not the actionable item you assign to a team; the control is satisfied by completing one or more improvement actions. Option D is wrong because a Template is a reusable blueprint that defines the controls and improvement actions for a regulation (e.g., SOC 2 template), but it is not the mechanism for assigning and tracking individual tasks.

Practice this question →

132

Multi-Selecteasy

Which TWO of the following are capabilities of Microsoft Purview Data Loss Prevention?

Select 2 answers

A.Define retention periods for documents.

B.Search for content in Exchange Online mailboxes.

C.Block sharing of sensitive data via email.

D.Automatically apply sensitivity labels to content.

E.Provide policy tips to users when they attempt to share sensitive data.

AnswersC, E

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify and prevent the unauthorized sharing of sensitive information, including via email. These policies can detect specific sensitive information types, such as credit card numbers or national ID numbers, within email content or attachments. Upon detection, a configured DLP policy can automatically block the email from being sent, thereby preventing the exfiltration of critical data.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is designed to detect and prevent the accidental or intentional sharing of sensitive information. Option C is correct because DLP policies can block the sharing of sensitive data via email by inspecting content in transit and applying actions such as blocking the message. Option E is correct because DLP can display policy tips to users in real time, warning them before they share sensitive data and allowing them to override the block with justification.

Exam trap

The trap here is that candidates confuse DLP with other Microsoft Purview solutions: they may think DLP defines retention periods (Records Management), searches content (eDiscovery), or applies sensitivity labels (Information Protection), when in fact DLP focuses on preventing data loss through monitoring and blocking actions, not on lifecycle management or labeling.

Practice this question →

133

MCQhard

Refer to the exhibit. You are reviewing a Microsoft Purview sensitivity label configuration. A user reports that a document containing a sensitive info type with confidence 80 was not automatically labeled. What is the most likely cause?

A.The user has overridden the label application.

B.The encryption is disabled.

C.The encryption template ID is missing.

D.The auto-labeling policy is not configured to apply this label.

AnswerD

While a sensitivity label defines the specific protection settings, such as encryption and access controls, its mere existence does not automatically apply it to content. For automatic application, a distinct auto-labeling policy must be created and configured within Microsoft Purview to identify sensitive information based on specific conditions and then apply this particular label. The label definition itself is separate from its deployment via an auto-labeling policy.

Why this answer

Auto-labeling in Microsoft Purview requires a specific auto-labeling policy to be configured and published to the user or location. Even if a sensitivity label exists and a sensitive info type (SIT) is detected with high confidence, the label will not be applied automatically unless an auto-labeling policy is explicitly set to apply that label to documents matching the SIT. The user's report indicates the label was not applied, which points to the policy not being configured, not a user override or encryption issue.

Exam trap

The trap here is that candidates often confuse the existence of a sensitivity label with the configuration of an auto-labeling policy, assuming that if a label is published, it will automatically apply to matching content, but in reality, auto-labeling requires a separate policy to be explicitly configured.

How to eliminate wrong answers

Option A is wrong because the user overriding the label would require the label to have been applied first, and the user would have to manually change it; the scenario states the label was not applied at all. Option B is wrong because encryption being disabled does not prevent auto-labeling; encryption is a label action, not a prerequisite for label application. Option C is wrong because a missing encryption template ID would cause an error when applying encryption, but it would not prevent the label from being applied; the label could still be applied without encryption.

Practice this question →

134

MCQmedium

A company uses Microsoft 365 and needs to classify and protect sensitive documents by applying encryption and visual markings (headers/footers) based on the content's sensitivity. They also want to automatically revoke access to documents that leave the organization. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Information Protection

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Audit

AnswerB

Information Protection uses sensitivity labels to classify, encrypt, and apply visual markings to documents, and can enforce revocation of access for external users.

Why this answer

Microsoft Purview Information Protection (B) is the correct solution because it provides the capabilities to classify and protect sensitive documents using sensitivity labels. These labels can enforce encryption and apply visual markings like headers and footers based on content sensitivity. Additionally, Information Protection supports automatic revocation of access to documents that leave the organization through features like rights management and conditional access policies.

Exam trap

The trap here is that candidates may confuse Data Lifecycle Management (retention/deletion) with Information Protection (classification/encryption), or mistakenly think Communication Compliance or Audit can enforce document-level protection and revocation.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management focuses on retaining and deleting data based on policies, not on classifying, encrypting, or applying visual markings to documents. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, insider trading) within emails and messages, not to classify or protect document content with encryption or markings. Option D is wrong because Microsoft Purview Audit provides logging and investigation of user and admin activities, not the ability to classify, encrypt, or revoke access to documents.

Practice this question →

135

MCQmedium

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to create a policy that prevents users from sharing credit card numbers via email to external recipients. The policy should only apply to users in the Finance department. Which action should you take?

A.Create a retention label and apply auto-labeling for Finance

B.Create a sensitivity label and publish it to Finance users

C.Copy the default DLP template for financial data and modify it

D.Create a DLP policy, select the Finance user location, and add the credit card number condition

AnswerD

Creating a new Data Loss Prevention (DLP) policy is the direct and most effective method for preventing the unauthorized sharing of sensitive data. By selecting the Finance user location, the policy is precisely scoped to the relevant individuals, and adding the credit card number condition ensures that the policy specifically targets and enforces actions against this critical sensitive information type, directly addressing the company's objective.

Why this answer

To apply a DLP policy to specific users, you select their group (e.g., Finance) as a location when creating the policy. This ensures only Finance users are affected. Option A is wrong because auto-labeling with retention labels does not enforce DLP rules.

Option B is wrong because sensitivity labels classify data but do not block sharing. Option C is wrong because copying a default template may not allow precise scoping to Finance users; creating a new policy from scratch with location selection is more accurate.

Practice this question →

136

MCQhard

You are a compliance administrator for Contoso, a multinational company that uses Microsoft 365. The company has the following requirements: 1. Automatically retain all documents containing personally identifiable information (PII) for 7 years. 2. Prevent users from sharing PII via email with external recipients unless they provide a business justification. 3. Monitor and alert when users access sensitive data outside of business hours. 4. Generate a compliance score for GDPR and ISO 27001. You need to configure the appropriate Microsoft Purview solutions. For each requirement, match the correct solution. Which combination of solutions should you use?

A.Information Protection for retention; DLP for sharing; Data Lifecycle Management for monitoring; Compliance Manager for scoring

B.Data Lifecycle Management for retention; Communication Compliance for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

C.Data Lifecycle Management for retention; DLP for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

D.Information Protection for retention; eDiscovery for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

AnswerC

All requirements are correctly mapped.

Why this answer

Requirement 1 (retain PII for 7 years) is met by a retention label or policy from Data Lifecycle Management (not Information Protection, which is for classification). Requirement 2 (prevent sharing without justification) is met by a Data Loss Prevention (DLP) policy that can block sharing and require user override with business justification. Requirement 3 (monitor access outside business hours) is met by Insider Risk Management, which can detect anomalous access patterns.

Requirement 4 (compliance score) is met by Compliance Manager. Option A is wrong because Information Protection labels are for classification, not retention; also monitoring access outside hours needs Insider Risk Management, not DLP. Option B is wrong because Communication Compliance is for monitoring communications, not for preventing sharing via email; DLP is needed for that.

Option D is wrong because eDiscovery is for legal discovery, not for access monitoring.

Practice this question →

137

MCQmedium

Your organization uses Microsoft Purview Records Management to manage high-value contracts. You need to ensure that once a contract is declared as a record, it cannot be modified or deleted by any user, including administrators. Which type of record should you use?

A.Disposition review

B.Event-based retention policy

C.Retention label with default settings

D.Regulatory record

AnswerD

A regulatory record in Microsoft Purview is specifically designed to meet stringent regulatory compliance requirements for absolute immutability. Once an item is declared a regulatory record, it becomes permanently locked, preventing any modification or deletion by any user, including global administrators. This level of unalterable preservation ensures the content's integrity and authenticity throughout its lifecycle, making it suitable for the most demanding legal and regulatory obligations.

Why this answer

Regulatory records provide the highest level of protection and cannot be modified or deleted by any user, including administrators. Option A is wrong because disposition review is a process for reviewing content before deletion, not a record type that locks content. Option B is wrong because event-based retention policies apply retention based on a trigger event, but they do not prevent modification or deletion once declared a record.

Option C is wrong because a retention label with default settings does not lock the record; it only applies retention settings without regulatory protections.

Practice this question →

138

MCQmedium

A financial services company uses Microsoft 365 and must comply with PCI DSS. They want to automatically prevent users from sending emails that contain credit card numbers to external recipients. If a user tries to send such an email, the system should block the message and notify the user with a policy tip. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP)

B.Communication Compliance

C.Information Protection

D.Insider Risk Management

AnswerA

Microsoft Purview DLP policies can automatically detect sensitive data (e.g., credit card numbers) and take actions such as blocking the email and notifying the sender with a policy tip.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive data, such as credit card numbers, in transit (e.g., email). DLP policies can be configured with conditions to match credit card number patterns (using a built-in sensitive info type) and set actions to block the message and display a policy tip to the sender, meeting the PCI DSS compliance requirement.

Exam trap

The trap here is that candidates often confuse Information Protection (labels/encryption) with DLP, but Information Protection does not provide real-time blocking of outbound data; it only applies protection after classification, whereas DLP actively monitors and blocks data in motion.

How to eliminate wrong answers

Option B is wrong because Communication Compliance is designed to detect and remediate inappropriate or policy-violating communications (e.g., harassment, insider trading), not to block sensitive data like credit card numbers in email. Option C is wrong because Information Protection (e.g., sensitivity labels and encryption) focuses on classifying and protecting data at rest or in transit via encryption, but it does not automatically block outbound emails containing credit card numbers or provide policy tips. Option D is wrong because Insider Risk Management is used to detect, investigate, and act on risky user activities (e.g., data theft, leaks) based on analytics, not to enforce real-time blocking of specific data patterns in email.

Practice this question →

139

MCQhard

A company receives a subject rights request (SRR) from a customer under GDPR, asking for the deletion of all personal data held about them. The compliance team needs a tool to orchestrate the discovery of this data across Microsoft 365 and other systems, and to track the response and fulfillment of the request. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management (retention labels)

D.Microsoft Priva (Privacy Management)

AnswerD

Microsoft Priva (Privacy Management) is purpose-built to streamline the complex process of responding to Subject Rights Requests (SRRs). It offers automated data discovery across Microsoft 365, Azure, and other connected data sources, identifying personal data relevant to a specific data subject. Priva provides a comprehensive workflow for review, redaction, collaboration, and secure fulfillment, ensuring compliance with global privacy regulations like GDPR and and CCPA.

Why this answer

Microsoft Priva (Privacy Management) is the correct solution because it is specifically designed to help organizations manage subject rights requests (SRRs) under regulations like GDPR. It automates the discovery of personal data across Microsoft 365 and connected systems, provides a workflow to track the request lifecycle, and facilitates the fulfillment of actions such as deletion. This directly addresses the compliance team's need to orchestrate discovery and track response for an SRR.

Exam trap

The trap here is that candidates often confuse eDiscovery (which handles legal holds and litigation) with privacy management (which handles subject rights requests), but eDiscovery lacks the automated SRR workflow and privacy-specific orchestration that Priva provides.

Why the other options are wrong

eDiscovery is designed for legal discovery of content in litigation or investigations, not for orchestrating and tracking subject rights requests under GDPR. It lacks the workflow automation and privacy-specific features needed to manage SRR fulfillment across multiple systems.

Microsoft Purview Audit is designed for logging and investigating user and admin activity, not for orchestrating discovery or tracking fulfillment of subject rights requests under GDPR.

Data Lifecycle Management (retention labels) is used to classify and manage data retention and deletion policies, not to orchestrate discovery of personal data across systems or track subject rights request fulfillment.

Practice this question →

140

MCQmedium

A compliance officer needs to investigate a potential data exfiltration incident. They must search the unified audit log for all activities where users accessed a specific sensitive SharePoint site in the last 7 days. Additionally, they need to create a custom alert that triggers when more than 10 file downloads occur from that site within an hour. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit (Standard)

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview eDiscovery

D.Microsoft Purview Communications Compliance

AnswerA

Microsoft Purview Audit (Standard) provides access to the unified audit log, enabling organizations to search for user and administrator activities across various Microsoft 365 services, including SharePoint Online. This service allows compliance officers to investigate past events, such as unusual file downloads, and to create custom alert policies based on specific activity patterns or thresholds. Its capability to search historical audit data and configure alerts for suspicious behaviors directly addresses the need for both investigation and proactive monitoring.

Why this answer

Microsoft Purview Audit (Standard) logs all user activities, including file accesses and downloads from SharePoint sites, for 90 days. The compliance officer can search the unified audit log for the specific site's activities over the last 7 days and create custom alert policies (e.g., threshold-based alerts for >10 downloads per hour) using the Microsoft 365 Defender portal. This makes Audit (Standard) the correct solution for both investigation and alerting.

Exam trap

The trap here is that candidates confuse the investigative and alerting capabilities of Audit (Standard) with the preventive controls of DLP, assuming DLP can retroactively search logs or create threshold-based alerts, when in fact DLP only applies real-time policies to content in transit or at rest.

Why the other options are wrong

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data exfiltration by enforcing policies on sensitive data, not to investigate past incidents or create alerts based on activity thresholds from the unified audit log.

Microsoft Purview eDiscovery is designed for legal investigations and content searches across data sources, not for real-time monitoring of user activities or creating custom alerts based on download thresholds from the unified audit log.

Microsoft Purview Communications Compliance is designed to monitor and manage internal and external communications for regulatory compliance, not to investigate data exfiltration via audit logs or create alerts based on file download thresholds from SharePoint.

Practice this question →

141

MCQeasy

Your company uses Microsoft Purview to manage records. You need to ensure that financial records are retained for 7 years and then permanently deleted. Which type of policy should you create?

A.A retention policy with a retention period of 7 years and then delete

B.A sensitivity label set to 'Financial' with auto-labeling

C.A retention label that triggers a disposition review after 7 years

D.A DLP policy that blocks sharing of financial records

AnswerA

A retention policy with a retention period of 7 years and then delete is the correct solution because retention policies are designed to automatically apply retention and deletion actions across entire locations, such as SharePoint sites or Exchange mailboxes. This policy ensures that content is retained for the specified 7 years and then permanently deleted without requiring any manual intervention, directly fulfilling the requirement for automatic disposition.

Why this answer

A retention policy with a retention period of 7 years and then delete is correct because it applies a time-based retention rule to financial records at the container or folder level, ensuring they are kept for exactly 7 years and then permanently removed without human intervention. This meets the requirement for automatic deletion after the retention period, as opposed to a disposition review which requires manual approval.

Exam trap

The trap here is that candidates confuse a retention label with a retention policy, thinking a label is required for deletion, but a retention policy can enforce deletion at the container level without needing a label or human review.

How to eliminate wrong answers

Option B is wrong because a sensitivity label set to 'Financial' with auto-labeling classifies data based on sensitivity but does not enforce a retention or deletion schedule; it only applies protection actions like encryption or headers. Option C is wrong because a retention label that triggers a disposition review after 7 years requires a human to approve deletion, which contradicts the requirement for permanent deletion without manual steps. Option D is wrong because a DLP policy blocks sharing of financial records to prevent data loss but does not manage retention or deletion timelines.

Practice this question →

142

MCQeasy

A company wants to automatically detect and remediate compliance issues such as sharing sensitive data externally. Which Microsoft Purview solution should they use?

A.Microsoft Purview Records Management

B.Microsoft Purview Data Loss Prevention

C.Microsoft Purview eDiscovery

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Data Loss Prevention (DLP) is precisely designed to identify, monitor, and protect sensitive information across various locations, including cloud services, endpoints, and on-premises. DLP policies use sophisticated rules to detect sensitive data and automatically apply remediation actions, such as blocking sharing, encrypting content, or notifying administrators, effectively preventing unauthorized disclosure and ensuring compliance.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, alert, and automatically remediate when sensitive data (e.g., credit card numbers, personally identifiable information) is shared externally via email, Teams, or cloud apps. DLP policies can enforce actions like blocking the transmission or applying encryption, directly addressing the requirement to prevent unauthorized external sharing of sensitive data.

Exam trap

The trap here is that candidates often confuse the proactive, blocking capability of DLP with the reactive, investigative tools like eDiscovery or Audit, mistakenly thinking that logging or searching for past incidents fulfills the requirement to 'automatically detect and remediate' in real time.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Records Management focuses on managing the lifecycle of records (retention, deletion, and disposition) for compliance with regulatory requirements, not on detecting or preventing real-time data sharing violations. Option C is wrong because Microsoft Purview eDiscovery is used for searching, preserving, and exporting content for legal investigations or litigation, not for proactive detection and remediation of data sharing compliance issues. Option D is wrong because Microsoft Purview Audit provides logging and forensic visibility into user and admin activities (e.g., who accessed what and when), but it does not have the capability to automatically detect and block sensitive data sharing in transit.

Practice this question →

143

MCQhard

A multinational corporation stores highly sensitive intellectual property in SharePoint Online. To meet regulatory requirements, they need an additional layer of encryption beyond Microsoft's baseline encryption. The company wants to manage their own encryption keys using Azure Key Vault, so that if they remove the key from the service, the data becomes unreadable. Which Microsoft Purview solution should they implement?

A.Double Key Encryption

B.Customer Key

C.Information Rights Management

D.Customer Lockbox

AnswerB

Correct. Microsoft Purview Customer Key allows customers to provide and manage their own encryption keys using Azure Key Vault, providing an additional layer of encryption on top of the baseline. Data is encrypted using these keys, and the customer can control key access.

Why this answer

Customer Key (Option B) is the correct solution because it provides the ability to control and manage the encryption keys used to encrypt data at rest in Microsoft 365, including SharePoint Online. By using Azure Key Vault to store the keys, the organization can revoke access at any time, rendering the data unreadable—a key requirement for meeting regulatory obligations. This goes beyond Microsoft's baseline encryption by adding a customer-controlled layer of encryption.

Exam trap

The trap here is that candidates often confuse Customer Key with Double Key Encryption, mistakenly thinking DKE is required for customer-managed keys in Azure Key Vault, when in fact Customer Key is the correct solution for managing encryption keys at rest across Microsoft 365 workloads.

Why the other options are wrong

Double Key Encryption (DKE) requires two keys: one managed by Microsoft and one managed by the customer. The question specifies that the company wants to manage their own encryption keys using Azure Key Vault and that removing the key makes data unreadable, which aligns with Customer Key, not DKE. DKE is designed for scenarios where data must be encrypted with a key held outside Microsoft's control, but it does not use Azure Key Vault for the customer key.

Customer Lockbox provides controlled access for Microsoft engineers to your data during support requests, not an additional layer of encryption where you manage your own keys. It does not make data unreadable if you remove a key.

Practice this question →

144

MCQmedium

Your organization uses Microsoft Purview Audit to investigate a security incident. You need to search for activities performed by a specific user over the past 90 days. Which solution should you use?

A.Microsoft Purview Audit (Standard)

B.Microsoft Purview Audit (Premium)

C.Microsoft Defender XDR Advanced Hunting

D.Microsoft Purview eDiscovery (Standard)

AnswerA

Microsoft Purview Audit (Standard) is the appropriate service for general investigations requiring access to audit logs. It provides a default retention period of 90 days for most audited activities, which directly supports the requirement for a 90-day search. This service captures user and admin activities across various Microsoft 365 services, making it the foundational tool for compliance and forensic analysis within that timeframe.

Why this answer

Microsoft Purview Audit (Standard) provides 90-day retention for audit logs, which meets the requirement to search for user activities over the past 90 days. Option B (Audit Premium) offers longer retention but is not necessary for this 90-day search. Option C (Microsoft Defender XDR Advanced Hunting) is used for advanced threat hunting, not for auditing user activities.

Option D (eDiscovery Standard) is designed for legal and compliance searches, not for routine audit log searches.

Practice this question →

145

MCQmedium

A legal team is managing a large litigation case involving over two million documents in SharePoint Online and Exchange Online. They want to reduce the time required for manual review by using a machine learning model that learns from a seed set of relevant and non-relevant documents and then predicts the relevance of the remaining documents. Which Microsoft Purview solution provides this advanced analytical capability?

A.Communication Compliance

B.eDiscovery (Standard)

C.eDiscovery (Premium)

D.Audit (Premium)

AnswerC

eDiscovery (Premium) is specifically designed to manage large-scale, complex litigation and regulatory investigations by offering an end-to-end workflow within Microsoft Purview. It extends beyond Standard capabilities with advanced features like custodian management, legal hold orchestration, and collection from non-Microsoft 365 sources. Crucially, it incorporates machine learning-driven analytics, including predictive coding (TAR), near-duplicate detection, and email threading, which significantly streamline the review process, reduce data volumes, and lower legal costs for extensive document sets.

Why this answer

eDiscovery (Premium) in Microsoft Purview provides advanced analytics capabilities, including predictive coding, which uses machine learning models trained on a seed set of relevant and non-relevant documents to automatically predict the relevance of the remaining content. This directly addresses the legal team's need to reduce manual review time for over two million documents in SharePoint Online and Exchange Online.

Exam trap

The trap here is that candidates often confuse eDiscovery (Standard) with eDiscovery (Premium) because both involve searching and holding content, but only Premium includes the advanced analytics and machine learning capabilities described in the scenario.

Why the other options are wrong

Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, insider trading), not to perform machine learning-based relevance prediction on documents for eDiscovery review.

Audit (Premium) provides advanced auditing capabilities such as long-term retention and high-bandwidth access to audit logs, but it does not include machine learning models for predictive relevance scoring of documents in eDiscovery.

Practice this question →

146

MCQhard

Your organization uses Microsoft Purview Communication Compliance to detect harassing messages. You receive an alert for a message that appears to be a joke between colleagues. What should you do to prevent similar false positives?

A.Train users not to joke about sensitive topics

B.Delete the alert and ignore future similar messages

C.Refine the policy conditions to exclude certain keywords or users

D.Turn off the policy and use a different solution

AnswerC

Refining the policy conditions within Microsoft Purview Communication Compliance is the most effective and technically sound solution to reduce false positives while preserving the policy's intended protective scope. This involves precisely adjusting keywords, phrases, dictionaries, or even excluding specific users or groups known to generate benign matches, thereby ensuring the policy accurately targets genuine compliance risks without generating unnecessary alerts and administrative overhead.

Why this answer

Microsoft Purview Communication Compliance policies are configurable to reduce false positives. You can refine the policy by adding conditions to exclude specific keywords (e.g., 'joke' or 'just kidding') or specific users (e.g., known colleagues) from triggering alerts, without disabling the policy or relying on user behavior changes.

Exam trap

The trap here is that candidates may choose Option A (training users) because it seems proactive, but the question specifically asks how to prevent false positives in the detection system, which requires policy refinement, not user behavior change.

How to eliminate wrong answers

Option A is wrong because training users does not prevent false positives in the detection system; it only addresses human behavior, not the policy's configuration. Option B is wrong because deleting alerts and ignoring future similar messages bypasses compliance monitoring and violates audit requirements; alerts must be investigated or the policy adjusted. Option D is wrong because turning off the policy removes the compliance control entirely, which is unnecessary when the policy can be refined to exclude benign content.

Practice this question →

147

Multi-Selecteasy

Which TWO features are part of Microsoft Purview Information Protection?

Select 2 answers

A.Communication monitoring

B.Retention policies

C.Automatic classification based on sensitive content

D.Sensitivity labels

E.Audit log investigation

AnswersC, D

Automatic classification based on sensitive content is a cornerstone feature of Microsoft Purview Information Protection. This capability leverages sensitive information types, trainable classifiers, and exact data match to automatically identify and categorize sensitive data across various locations, including documents, emails, and cloud services. By proactively classifying content, Information Protection can then apply appropriate sensitivity labels and protection actions, significantly reducing the manual effort required to secure vast amounts of organizational data.

Why this answer

Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Automatic classification based on sensitive content (Option C) is a core capability of MIP, using built-in or custom sensitive information types to detect and label data automatically. Sensitivity labels (Option D) are the primary mechanism in MIP to apply protection actions such as encryption, access restrictions, and visual markings to documents and emails.

Exam trap

The trap here is that candidates confuse the broad scope of Microsoft Purview (which includes many compliance solutions) with the specific boundaries of Information Protection, often mistaking retention or audit features as part of MIP because they all appear under the Purview umbrella.

Practice this question →

148

Multi-Selectmedium

Which TWO actions can be performed using Microsoft Purview Data Lifecycle Management?

Select 2 answers

A.Create a retention policy to keep financial records for 7 years

B.Monitor internal emails for policy violations

C.Create a deletion policy to remove old drafts after 30 days

D.Block sharing of sensitive files with external users

E.Automatically classify documents containing PII

AnswersA, C

Microsoft Purview Data Lifecycle Management (DLM) is specifically designed to help organizations manage their data throughout its entire lifecycle, including long-term preservation. Creating a retention policy to keep financial records for a specified duration, such as seven years, is a fundamental capability within DLM. These policies ensure compliance with legal, regulatory, and business requirements by preventing premature deletion and ensuring data availability.

Why this answer

Microsoft Purview Data Lifecycle Management allows administrators to create retention policies that specify how long data must be kept to meet regulatory or business requirements, such as retaining financial records for 7 years. Option C is correct because the same solution enables deletion policies that automatically remove outdated content, like drafts older than 30 days, ensuring data is not kept longer than necessary.

Exam trap

The trap here is that candidates confuse the capabilities of Microsoft Purview Data Lifecycle Management with those of Information Protection or Communication Compliance, leading them to select options related to monitoring, blocking, or classifying data, which belong to other compliance solutions.

Practice this question →

149

MCQmedium

A healthcare organization must demonstrate compliance with HIPAA by assessing their current posture against regulatory controls, tracking improvement actions, and generating reports for auditors. Which Microsoft Purview solution should they use?

A.Microsoft Purview Information Protection

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Compliance Manager

D.Microsoft Purview Insider Risk Management

AnswerC

Microsoft Purview Compliance Manager is the dedicated solution for simplifying compliance and reducing risk by providing pre-built assessments for common industry regulations, such as HIPAA. It allows organizations to track progress on improvement actions, assign responsibilities, and generate detailed compliance reports, offering a measurable compliance score. This service directly addresses the need to demonstrate and manage an organization's adherence to regulatory requirements through a structured workflow.

Why this answer

Microsoft Purview Compliance Manager is the correct solution because it provides a built-in assessment template for HIPAA, enabling the organization to assess its current compliance posture against regulatory controls, track improvement actions, and generate auditor-ready reports. It offers a compliance score, automated control mapping, and evidence collection workflows specifically designed for regulatory frameworks like HIPAA.

Exam trap

The trap here is that candidates confuse Compliance Manager (which assesses and tracks compliance posture) with Information Protection (which protects data) or Insider Risk Management (which detects risky behavior), because all three are Purview solutions but serve fundamentally different compliance lifecycle stages.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying, labeling, and protecting sensitive data (e.g., encryption, rights management), not on assessing compliance posture or tracking improvement actions against regulatory controls. Option B is wrong because Microsoft Purview Data Lifecycle Management handles data retention, deletion, and archiving policies (e.g., retention labels, records management), not compliance assessment or audit reporting for HIPAA. Option D is wrong because Microsoft Purview Insider Risk Management detects and investigates risky user activities (e.g., data exfiltration, policy violations), not compliance posture assessment or improvement tracking against regulatory frameworks.

Practice this question →

150

MCQhard

Your organization is implementing Microsoft Purview Communication Compliance to detect potential regulatory violations. You need to configure a policy that alerts when employees discuss insider trading in emails and Microsoft Teams messages. The solution should minimize false positives. Which action should you take?

A.Include all message types without filtering

B.Use a trainable classifier and train it with sample data

C.Create a global keyword list of insider trading terms

D.Set the policy sensitivity threshold to 90%

AnswerB

Trainable classifiers learn from examples and improve detection accuracy.

Why this answer

Trainable classifiers use machine learning to identify content based on patterns learned from sample data, which significantly reduces false positives compared to static keyword lists. By training the classifier with relevant examples of insider trading discussions, the policy can accurately distinguish between genuine regulatory violations and benign uses of similar terms.

Exam trap

The trap here is that candidates often assume a keyword list or sensitivity threshold is sufficient for compliance, overlooking that trainable classifiers are specifically designed to minimize false positives by learning from sample data rather than relying on static rules.

How to eliminate wrong answers

Option A is wrong because including all message types without filtering would generate excessive alerts, including irrelevant communications, leading to high false positives and analyst fatigue. Option C is wrong because a global keyword list of insider trading terms would trigger alerts on any mention of those terms, even in harmless contexts (e.g., 'I read about insider trading in the news'), causing many false positives. Option D is wrong because setting the policy sensitivity threshold to 90% would only reduce alerts based on a generic confidence score, not address the root cause of false positives from ambiguous language; trainable classifiers provide more nuanced detection.

Practice this question →