CCNA Ms Compliance Capabilities Questions

Microsoft Purview Audit (Standard) is specifically designed with a fixed retention period of 90 days for all audit logs. This means that any audit records generated will be automatically retained for exactly 90 days from their creation date. After this 90-day window expires, these logs are automatically and permanently purged from the system, making them irretrievable. This inherent limitation is a primary reason why older audit logs might appear to be missing.

Microsoft Purview Communication Compliance is specifically designed to help organizations detect and remediate regulatory compliance violations, such as insider trading, harassment, or sensitive data sharing, within their internal and external communications. It uses intelligent templates and customizable policies to proactively scan messages across Microsoft 365 services for specific keywords, sensitive information types, or patterns indicative of policy breaches. Compliance officers can then review, investigate, and take action on identified risky communications through a dedicated workflow.

Data Lifecycle Management provides auto-apply retention label policies that can use sensitive information types (SITs) to classify and retain content automatically. This is the correct solution to apply a retention label based on content detection.

Configuring an auto-labeling policy with a sensitive information type for credit card numbers is the most effective and accurate method for automatic protection. This approach leverages Microsoft Purview's built-in capabilities to scan content for specific patterns, keywords, and checksums associated with credit card numbers, then automatically applies the appropriate sensitivity label and its associated protection actions (e.g., encryption, access restrictions) without any user intervention.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and automatically protect sensitive information across Microsoft 365 services, endpoints, and on-premises repositories. By defining rules based on sensitive information types, labels, or keywords, DLP policies can actively prevent users from sharing files containing sensitive data externally, internally, or to unauthorized applications, thus directly addressing the requirement to block file sharing. These policies enforce controls to stop data exfiltration.

Data Lifecycle Management (DLM) effectively establishes a baseline retention policy to retain data for seven years and then automatically delete it, ensuring general compliance with record-keeping regulations. Concurrently, eDiscovery (Premium) allows for the precise application of a legal hold on specific project documents, which critically overrides any deletion policy, including the DLM policy, to preserve evidence for potential litigation. This combination ensures both routine data governance and specific, immutable preservation for legal requirements.

Correct. Information Barriers enforce restrictions between user segments to prevent unwanted communication and collaboration.

DLP blocks sharing; retention policy retains; sensitivity label provides manual classification with encryption and expiration.

An auto-labeling policy for sensitivity labels is specifically configured to automatically detect and apply predefined sensitivity labels to content that matches specific conditions, such as the presence of sensitive information types, keywords, or patterns. This capability directly addresses the need to automatically apply a 'confidential' label, which can then enforce protective actions like encryption, visual markings, and access restrictions, ensuring consistent data protection without manual intervention.

Retention labels in Microsoft Purview Data Lifecycle Management enable organizations to classify content and apply specific retention settings directly to individual items, such as emails or documents. These labels can be applied manually by users, automatically based on conditions, or through event-based triggers, ensuring that data is retained or deleted according to regulatory or business requirements throughout its lifecycle. They also facilitate the declaration of records, making content immutable for compliance.

Microsoft Purview eDiscovery (Premium) is the appropriate solution for legal teams preparing for litigation due to its advanced capabilities for managing large volumes of data. It provides intelligent analytics such as relevance ranking, email threading, and near-duplicate detection, which significantly reduce the data set requiring manual review. Furthermore, it supports advanced review workflows, legal holds, and communication with custodians, making it comprehensive for complex legal discovery processes.

Microsoft Purview eDiscovery provides a comprehensive set of tools specifically designed to search for, preserve, collect, analyze, and export electronic content from Microsoft 365 for legal and investigative purposes. It enables legal teams to perform targeted searches across mailboxes, SharePoint sites, and Teams messages using keywords, date ranges, and sender/recipient criteria, making it the ideal solution for retrieving specific emails relevant to litigation.

This DLP policy is configured with an action to 'BlockAccess' specifically targeting 'BlockExternal' sharing. Consequently, any document matching the policy's conditions will be prevented from being shared outside the organization. Concurrently, the 'NotifyUser' action ensures that the individual attempting the sharing receives an immediate notification, informing them of the policy violation and the blocked action.

Data Loss Prevention (DLP) policies are purpose-built to identify, monitor, and protect sensitive information across various locations, including email, cloud apps, and endpoints. By utilizing sensitive information types (SITs) to detect patterns like credit card numbers, DLP policies can proactively enforce actions such as blocking an email from being sent, notifying administrators, or encrypting the content. This directly prevents the unauthorized sharing or exfiltration of sensitive data.

Content Search, accessible through the Microsoft Purview compliance portal, is specifically engineered for eDiscovery and investigative purposes, enabling comprehensive searches across diverse content locations. It allows investigators to pinpoint specific keywords, phrases, sensitive information types, or other properties within mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams chats. This capability makes it the ideal tool for locating and collecting potentially leaked data across an organization's digital repositories during an investigation.

After a retention label is defined, it must be published via a retention label policy to make it available for users or auto-application within Microsoft 365 services like SharePoint, OneDrive, and Exchange. This policy specifies which locations the label will be published to, ensuring the label appears as an option for manual application or is used by auto-apply policies. Without publishing through a policy, the label remains an administrative definition and cannot be actively used to manage content lifecycle.

Data Classification in Microsoft Purview is the foundational process of identifying, categorizing, and labeling sensitive information, such as personal data subject to GDPR, across an organization's Microsoft 365 environment. This involves using sensitive information types, trainable classifiers, and sensitivity labels to automatically or manually tag data based on its content and context. Accurate data classification is crucial for understanding where sensitive data resides, enabling organizations to apply appropriate protection, retention, and compliance policies.

Marking content as sensitive involves applying a Microsoft Purview sensitivity label, which embeds persistent metadata directly within the file or email. This embedded metadata is the core mechanism that allows the sensitivity label to be tracked and recognized across various Microsoft 365 services and applications. Consequently, when content is copied, moved, or shared, the label's properties and associated protection policies (e.g., encryption, visual markings) travel with the data, ensuring consistent information protection.

Sensitivity labels with auto-labeling can automatically classify and encrypt documents based on sensitive content.

The configuration of this sensitivity label explicitly includes both encryption and visual markings, such as headers and footers. Encryption, powered by Azure Information Protection, ensures that only authorized users can access the document and defines their specific usage rights. Concurrently, visual markings provide clear, persistent indicators within the document itself, communicating its sensitivity level to all who view it.

Microsoft Defender for Office 365 provides comprehensive protection against sophisticated email and collaboration threats, including phishing, business email compromise (BEC), malware, and zero-day attacks. It actively scans emails, attachments, and links in real-time before they reach user inboxes. A core capability of Defender for Office 365 is its ability to automatically detect and quarantine malicious emails, preventing users from interacting with harmful content.

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to identify, monitor, and automatically protect sensitive information across various locations and applications. DLP policies can be configured to detect specific sensitive content, such as financial data or personal health information, and then enforce preventative actions like blocking the sharing of that content, quarantining it, or notifying administrators. This directly fulfills the requirement for an automatic policy that blocks sharing based on sensitive content.

The Microsoft Purview Data Map is the foundational component that automatically discovers, classifies, and catalogs data across an organization's entire data estate, including multi-cloud, SaaS, and on-premises sources. By continuously scanning and ingesting metadata, it creates a unified, holistic view of data assets, their lineage, and relationships, which is essential for understanding and monitoring the data landscape's composition and changes.

Microsoft Purview Multi-Geo is the specific feature designed to address data residency requirements for multinational organizations within a single Microsoft 365 tenant. It enables administrators to provision satellite geo locations and store eligible user data, such as Exchange mailboxes, SharePoint sites, and OneDrive content, at rest in specified geographical regions. This capability directly ensures compliance with local data residency regulations by controlling the physical storage location of data.

Given the configuration for auto-labeling, the system will automatically identify documents meeting the specified conditions and apply the 'Highly Confidential' sensitivity label. Concurrently, the label's policy dictates that the document will be encrypted, ensuring that only authorized users with the correct permissions can access its content. This dual action of automatic classification and protection is a core function of sensitivity labels.

Microsoft 365 Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations like Exchange Online, SharePoint Online, and OneDrive. These policies leverage sensitive information types (SITs) to detect financial data, PII, or other critical data, providing real-time policy tips to users and blocking sharing actions that violate organizational policies. This proactive approach ensures sensitive data, such as customer financial records, is not inadvertently or maliciously exfiltrated, directly addressing the institution's need for prevention.

Microsoft Purview Insider Risk Management is the correct solution because it proactively identifies, investigates, and acts on risky activities by users within an organization. It leverages machine learning to detect behavioral patterns indicative of data exfiltration, intellectual property theft, or confidentiality violations across various signals, providing a comprehensive workflow for managing potential insider threats and enforcing policies against sharing confidential information.

Microsoft 365 Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. These policies leverage sensitive information types, labels, or keywords to detect data such as patient records or financial details. Upon detection, DLP can automatically block sharing, warn users with policy tips, or encrypt content, thereby preventing accidental or malicious data exfiltration in real-time.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and automatically protect sensitive information across various locations, including cloud services, on-premises repositories, and endpoints. DLP can detect specific sensitive information types within files, such as Personally Identifiable Information (PII), and then enforce actions like blocking external sharing, notifying users, or encrypting content. This direct enforcement capability makes DLP the ideal solution for preventing accidental data exfiltration by employees.

Microsoft Purview Communication Compliance is specifically designed to help organizations detect, investigate, and take action on inappropriate messages across various communication channels within the organization. It leverages machine learning and predefined or custom policies to identify content related to harassment, threats, adult content, and regulatory compliance violations. This solution provides the necessary tools for proactive monitoring, review, and remediation of problematic communications, directly addressing the requirement to automatically detect and remediate inappropriate messages.

eDiscovery (Premium) legal holds are specifically designed to preserve content across various Microsoft 365 locations, such as Exchange mailboxes, SharePoint sites, OneDrive accounts, and Microsoft Teams. When a legal hold is applied, it places an immutable preservation lock on all specified content, preventing users from modifying, deleting, or otherwise altering the data, even if a retention policy or label would normally allow it. This ensures that all relevant information is maintained in its original state for legal or investigative purposes, making it the most robust solution for preventing modification and deletion.

Communication Compliance is the dedicated Microsoft Purview solution designed for proactively monitoring and reviewing employee communications across platforms like Microsoft Teams and Exchange. It enables organizations to create policies that detect potential violations, such as harassment, inappropriate content, or regulatory non-compliance, using machine learning and keyword matching. Designated reviewers can then investigate flagged messages, apply remediation actions, and ensure adherence to internal and external standards.

This option is correct because a Sensitive Information Type (SIT) is specifically designed to identify and classify sensitive data based on predefined or custom patterns, keywords, and proximity rules. For detecting Social Security Numbers, a SIT leverages pattern matching (e.g., regular expressions) and checksums to accurately identify these specific data elements across various content sources within Microsoft Purview. This direct detection capability makes it the fundamental classification mechanism for such requirements.

Microsoft Purview Compliance Manager is the primary solution for a compliance officer to evaluate their organization's adherence to various regulatory standards and internal policies. It provides a quantifiable compliance score, pre-built assessment templates for numerous global and industry-specific regulations (e.g., GDPR, HIPAA, ISO 27001), and actionable recommendations. This service enables organizations to manage and track improvement actions, assign responsibilities, and generate reports to demonstrate compliance posture effectively.

Configuring a DLP policy tip that allows users to override the block with a business justification is the optimal solution. This approach provides real-time notification to users when a potential policy violation occurs, offering them the flexibility to proceed if they can provide a valid business reason. This balances robust data protection with operational continuity, ensuring legitimate workflows can proceed while maintaining an auditable record of all overrides and their justifications for compliance and accountability.

DLP policy meets all requirements with minimal overhead.

eDiscovery (Standard) can place holds on Exchange mailboxes and OneDrive accounts.

Data Lifecycle Management (DLM) in Microsoft 365 utilizes retention labels to define how long content should be retained or deleted across various services, ensuring compliance with organizational policies and regulations. Concurrently, eDiscovery holds (also known as litigation holds) are specifically designed to preserve content indefinitely for legal proceedings, overriding any existing retention or deletion policies applied by retention labels. This combination effectively addresses both routine data retention and specific legal preservation requirements.

Sensitivity labels, particularly when configured with auto-labeling policies, are specifically designed to automatically classify and apply protection to documents containing sensitive information types. These labels can enforce encryption, visual markings, and access restrictions directly on the content, ensuring data is protected both at rest and in transit, precisely meeting the requirement to automatically classify and encrypt documents.

The policy includes BlockAccess and NotifyUser actions.

Data Loss Prevention (DLP) policies are specifically engineered to inspect content in real-time for sensitive information types (SITs), such as credit card numbers or national ID numbers, across various locations including Exchange Online. When a policy match is detected in an outgoing email, DLP can automatically enforce protective actions like blocking the email, notifying administrators, or applying encryption to prevent unauthorized disclosure of sensitive data in transit. This makes DLP the direct solution for automatically detecting and encrypting emails containing sensitive information.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including email communications. DLP policies leverage sensitive information types (SITs) to detect specific content patterns, such as credit card numbers, and can then automatically apply actions like blocking the email, notifying users, or applying encryption (often via sensitivity labels) to ensure compliance and prevent unauthorized sharing.

Microsoft Purview Data Classification provides the foundational capabilities for identifying, categorizing, and understanding the data within an organization's digital estate. It leverages a robust set of built-in sensitive information types (SITs), named entities, and trainable classifiers to automatically detect specific content patterns, such as credit card numbers, national ID numbers, or industry-specific data. This service is crucial for automatically tagging and labeling data based on its content, forming the basis for subsequent protection and governance actions.

Creating an auto-labeling policy for sensitivity labels is the direct and most effective method within Microsoft Purview to automatically classify data based on its content. These policies are specifically engineered to scan content in locations like SharePoint, OneDrive, and Exchange, then apply appropriate sensitivity labels when specific conditions, such as the presence of sensitive information types or trainable classifiers, are met. This automation ensures consistent data classification and the application of associated protective actions without requiring manual user intervention.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including Exchange Online emails. These policies use sensitive information types (SITs) to detect content like credit card numbers in real-time as emails are sent. Upon detection, DLP can block the email, notify administrators, and offer users the option to override the block with a business justification, directly preventing unauthorized data egress.

Microsoft Purview Information Protection enables organizations to classify and label sensitive data using sensitivity labels, whether manually or automatically. These labels are crucial as they can be configured to automatically apply specific retention and deletion policies, ensuring data is retained for the required period or disposed of appropriately based on its content and classification. This capability is fundamental for enforcing data compliance requirements by governing data based on its sensitivity.

Information Barriers in Microsoft 365 are specifically designed to prevent specific groups of users from communicating or collaborating with each other, fulfilling "ethical wall" requirements. Administrators define policies that segment users and restrict interactions in services like Microsoft Teams, SharePoint, and Exchange Online. This directly addresses the firm's need to proactively block communication to ensure compliance and prevent information leakage between sensitive departments.

Assessments in Compliance Manager allow tracking against standards and assigning improvement actions.

This option accurately describes the retention label's behavior. The specified retention duration of 2555 days precisely equates to 7 years (2555 days / 365 days/year). Following this 7-year retention period, the 'DeleteAfterRetention' property, which is set to 'true', ensures that the content is automatically and permanently deleted without requiring any manual intervention or disposition review.

Auto-labeling policies for sensitivity labels are specifically engineered to automatically apply predefined labels to content, such as documents and emails, based on conditions like the presence of sensitive information types, keywords, or trainable classifiers. This automated process ensures consistent and scalable data classification across an organization without requiring manual user intervention. Once applied, these labels enable persistent protection and governance actions, regardless of where the data resides or travels.

Data Lifecycle Management, specifically through Microsoft 365 retention policies and retention labels, is the precise solution for enforcing long-term data retention requirements. Retention policies can be applied broadly to Exchange mailboxes to ensure all customer service emails are preserved for a specified duration, such as seven years, preventing both accidental and malicious deletion by users. These policies also manage the automatic deletion of content after its retention period expires, ensuring compliance with regulatory and organizational data lifecycle mandates.

Microsoft Purview Data Map provides a unified metadata store that automatically scans, classifies, and maps data across an organization's hybrid data estate, including on-premises, multi-cloud, and SaaS sources. This capability is fundamental for GDPR compliance as it enables organizations to discover where personal data resides, understand its lineage, and identify sensitive information types, which is crucial for fulfilling data subject access requests and demonstrating accountability.

Configuring a disposition review directly within a Microsoft Purview retention policy ensures that content reaching the end of its defined retention period is not automatically deleted. Instead, designated reviewers, typically compliance officers or administrators, receive notifications and can examine the content. This allows them to make an informed decision to either approve the final deletion, extend the retention period, or apply a different retention label, thereby providing essential human oversight before permanent data removal.

Sensitivity labels allow organizations to classify and protect data at the document or email level directly by users. When applied, these labels enforce predefined protection actions such as encryption, visual markings (headers, footers, watermarks), and access restrictions, ensuring that sensitive information is handled appropriately throughout its lifecycle, even when shared externally.

Actions are the core component of a Microsoft Purview DLP policy that dictates the response when content matches the defined conditions. These actions can include blocking access to the content, notifying users or administrators, encrypting the data, or applying retention labels. For instance, a DLP policy might be configured to block sharing of documents containing sensitive data externally and simultaneously send an alert to the security team. This directly addresses what happens when a DLP match occurs.

Microsoft Purview eDiscovery (Premium) is the comprehensive solution designed for managing legal, regulatory, and internal investigations. It provides an end-to-end workflow that includes placing legal holds on content, such as all Exchange Online mailboxes, to prevent alteration or deletion. This capability ensures that all relevant data is preserved, collected, reviewed, and exported in a defensible manner for litigation purposes, directly addressing the need to preserve content.

Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution for managing HR documents. It allows the creation of retention labels and policies that automatically retain content for a specified period, preventing premature deletion or modification by users. Once the retention period expires, these policies can then automatically initiate the deletion of the content, ensuring compliance with data retention schedules and organizational policies.

Trainable classifiers use machine learning to classify content based on examples.

Microsoft Purview eDiscovery (Advanced) is the correct solution for internal investigations requiring efficient document review. It incorporates advanced machine learning capabilities, such as predictive coding (also known as Technology Assisted Review or TAR), to intelligently identify and prioritize relevant documents from vast, unstructured data sets. This significantly accelerates the review process by reducing the volume of data human reviewers must examine, ensuring legal teams can focus on the most pertinent information for their case.

Microsoft Purview Insider Risk Management is the correct solution as it proactively identifies, analyzes, and acts on risky activities within an organization. It leverages machine learning and adaptive analytics to detect potential data exfiltration, intellectual property theft, and policy violations by employees, assigning risk scores and automatically generating cases for investigation by security teams. This capability directly addresses the need to identify and monitor potentially risky insider activities.

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct service for automatically retaining and deleting content based on an organization's policies and regulatory requirements. It allows administrators to create retention labels and policies that can be applied to content across various locations, ensuring that financial data, for example, is kept for a specific duration and then disposed of appropriately. This directly addresses the need for automated retention scheduling to meet compliance obligations.

Microsoft Purview Records Management is precisely engineered to help organizations meet their legal, business, and regulatory obligations for records retention and disposition, particularly for highly sensitive data like patient records. This solution enables the classification of content as a formal record, applying immutable retention labels that prevent modification or deletion, even by administrators, and managing the entire lifecycle from creation to final disposition. It ensures that critical information is preserved according to specific healthcare regulations, providing the necessary legal defensibility and compliance.

Disposition review allows administrators to permanently delete content after review.

Data Loss Prevention (DLP) is the correct solution as it proactively identifies, monitors, and protects sensitive information across Microsoft 365 services, including SharePoint. DLP policies leverage sensitive information types, trainable classifiers, and exact data match to automatically detect specific content (e.g., PII, credit card numbers). Upon detection, DLP can enforce various actions, such as blocking sharing, encrypting files, or notifying administrators, thereby preventing unauthorized disclosure and protecting sensitive data.

Correct. The sensitivity label must define the protection (encryption) that will be applied to documents containing credit card numbers.

The command specifies operations and user IDs to search.

This statement accurately describes the policy's behavior. The 'RetentionDurationType' is 'ModificationAgeInDays', meaning the the 2557-day (approximately 7 years) period begins from the item's last modification date. Upon reaching this duration, the policy's 'Action' of 'Delete' will be enforced, resulting in the permanent removal of the item.

DLP policies detect sensitive information (e.g., credit card numbers) and enforce actions such as blocking, encrypting, or notifying users. This matches the scenario requirements.

An auto-labeling policy for sensitivity labels automatically applies a pre-defined label to content, such as HR documents in SharePoint Online, when specific conditions are met. These conditions often include the detection of sensitive information types like passport numbers or national ID numbers. The applied label can enforce protection actions, including encryption, and can be configured to prevent users from changing or removing the label, ensuring consistent data protection.

Microsoft Purview Data Lifecycle Management (DLM) is specifically engineered to manage the lifecycle of information, including its retention and eventual disposition. DLM utilizes retention labels that can be manually applied or automatically assigned to content based on specific conditions, such as sensitive information types, keywords, or content properties. These labels then enforce retention periods, ensuring data is kept for the required duration and automatically deleted when no longer needed, directly addressing the need for automated retention and deletion policies.

Microsoft Purview Information Protection (MPIP) is a core component for classifying and protecting sensitive data throughout its lifecycle. It enables organizations to define and apply sensitivity labels, which can automatically detect sensitive information types and then apply visual markings, encryption, or access restrictions. This capability directly addresses the need to classify data based on its sensitivity and apply appropriate protective measures.

Microsoft Purview eDiscovery (Premium) is the optimal solution for managing complex legal and regulatory requests, including Data Subject Rights (DSRs). It offers advanced capabilities such as intelligent data identification, robust workflow automation, and granular role-based access controls, enabling privacy officers to efficiently search, review, redact, and export personal data across diverse data sources. This comprehensive solution streamlines the entire DSR fulfillment process, ensuring compliance and operational efficiency for multinational organizations.

RetentionDuration is 365, trigger is WhenCreated, action is Delete.

Auto-labeling automatically classifies documents based on content patterns.