CCNA Ms Compliance Capabilities Questions — Page 4 of 5

226

MCQmedium

Contoso Pharmaceuticals is implementing Microsoft Purview to meet regulatory compliance (HIPAA and GDPR). They need to: (1) automatically classify and protect patient health information (PHI) and personally identifiable information (PII) in Exchange Online, SharePoint Online, and OneDrive for Business; (2) detect and prevent unauthorized sharing of sensitive data; (3) retain audit logs for 7 years; and (4) allow users to manually apply classification labels to documents. The company has 5,000 users and uses Microsoft 365 E5 licenses. The security team wants to minimize manual effort and ensure consistent protection. What should the compliance administrator configure first?

A.Configure Data Loss Prevention (DLP) policies to block sharing of content containing PHI and PII.

B.Create sensitivity labels with auto-labeling policies configured to detect PHI and PII, and publish them via label policies.

C.Set up retention policies for Exchange, SharePoint, and OneDrive to retain data for 7 years.

D.Enable auditing for all workloads and configure alert policies for unauthorized access.

AnswerB

Auto-labeling provides consistent classification and protection with minimal manual effort.

Why this answer

Sensitivity labels with auto-labeling policies can automatically classify and protect PHI and PII across Exchange Online, SharePoint Online, and OneDrive for Business, meeting the requirement for automated classification and consistent protection. Option A is wrong because DLP policies detect and prevent unauthorized sharing but do not classify or label data. Option C is wrong because retention policies only manage data retention, not classification or protection.

Option D is wrong because auditing logs activities but does not classify or protect content.

Practice this question →

227

MCQhard

A financial services firm uses Microsoft Purview Information Barriers to prevent traders from communicating with investment bankers. A new employee in the trading department cannot access a SharePoint site used for compliance training. What should the administrator do?

A.Add the employee to the 'Traders' Microsoft 365 group.

B.Add the employee to the 'Traders' segment in Microsoft Purview Information Barriers.

C.Use the 'Override' option in the Information Barrier policy.

D.Disable the Information Barrier policy for the trading department.

AnswerB

Microsoft Purview Information Barriers operate by defining distinct user segments based on specific user attributes and then applying policies to restrict communication and collaboration between these segments. To allow an employee to legitimately communicate and collaborate with others in the 'Traders' segment, their user account must be correctly assigned to that 'Traders' segment. This is typically achieved by updating the relevant user attribute in Microsoft Entra ID that defines the 'Traders' segment, ensuring compliance with the established IB policies.

Why this answer

Microsoft Purview Information Barriers use segments to group users based on their organizational roles. Adding the new employee to the 'Traders' segment ensures that the Information Barrier policy applies to them correctly, allowing them to access the compliance training SharePoint site while still being blocked from communicating with investment bankers.

Exam trap

The trap here is that candidates confuse Microsoft 365 groups with Purview segments, assuming that adding a user to a group will automatically resolve Information Barrier restrictions, when in fact segments are the only mechanism for defining user roles in these policies.

How to eliminate wrong answers

Option A is wrong because adding the employee to the 'Traders' Microsoft 365 group does not affect Information Barrier segmentation; segments are separate from Microsoft 365 groups and are defined in Purview. Option C is wrong because the 'Override' option in Information Barrier policies is not a standard feature; policies are enforced automatically and cannot be overridden per user. Option D is wrong because disabling the Information Barrier policy for the entire trading department would remove compliance controls for all traders, which is excessive and not the correct solution for granting access to a single site.

Practice this question →

228

MCQhard

An organization's security team needs to investigate a security incident that occurred two months ago. They need to search the unified audit log for specific activities performed by a user, such as file access, email actions, and sign-in events, to understand the scope of the compromise. Which Microsoft Purview solution provides these audit log search capabilities?

A.Microsoft Purview eDiscovery

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Communication Compliance

AnswerB

Microsoft Purview Audit (Standard and Premium) is specifically designed to capture, retain, and enable searching of user and administrator activities across Microsoft 365 services via the unified audit log. This capability is crucial for security investigations, allowing organizations to identify who performed what action, when, and from where. It provides the necessary historical data to understand the scope and timeline of a security incident, directly addressing the need to investigate security events.

Why this answer

Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) provides the ability to search the unified audit log for activities like file access, email actions, and sign-in events. This solution is designed for forensic investigation of user and admin activity within Microsoft 365, making it the correct choice for investigating a security incident that occurred two months ago.

Exam trap

The trap here is that candidates often confuse eDiscovery (which deals with legal holds and content search) with Audit (which deals with activity logs), leading them to select eDiscovery when the question specifically asks for searching user activities like file access and sign-in events.

Why the other options are wrong

Microsoft Purview eDiscovery is designed for legal discovery and exporting content from mailboxes, SharePoint, and Teams, not for searching the unified audit log for historical user activities like file access, email actions, and sign-in events.

Microsoft Purview Data Lifecycle Management governs data retention and deletion policies, not audit log search. It does not provide the ability to search historical user activities like file access, email actions, or sign-in events.

Microsoft Purview Communication Compliance is designed to detect and manage inappropriate communications (e.g., offensive language, conflicts of interest) within an organization, not to search the unified audit log for historical activities like file access or sign-in events.

Practice this question →

229

MCQmedium

A company wants to monitor internal communications for inappropriate content such as harassment or threats, and also prevent employees from accidentally sharing credit card numbers via email. Which combination of Microsoft Purview solutions should they use?

A.Use Communication Compliance for both detecting harassment and preventing credit card sharing

B.Use Data Loss Prevention (DLP) for both detecting harassment and preventing credit card sharing

C.Use Communication Compliance for harassment detection and DLP for preventing sharing of credit card numbers

D.Use eDiscovery for both harassment detection and data leak prevention

AnswerC

This option correctly assigns the distinct capabilities of each solution. Microsoft Purview Communication Compliance leverages machine learning and predefined or custom policies to proactively detect inappropriate content, including harassment, threats, and discriminatory language, across various communication channels. Concurrently, Microsoft Purview Data Loss Prevention (DLP) is precisely designed to identify and prevent the unauthorized sharing or leakage of sensitive information, such as credit card numbers, by applying policies that can block, warn, or encrypt data based on its content and context.

Why this answer

Communication Compliance is designed to detect and investigate inappropriate internal communications (e.g., harassment, threats) by analyzing messages against customizable policies. Data Loss Prevention (DLP) is purpose-built to identify and prevent the accidental sharing of sensitive data, such as credit card numbers, by scanning content for predefined patterns (e.g., regex for credit card formats) and enforcing policy actions like blocking the email. Together, they address the two distinct requirements: Communication Compliance for behavioral monitoring and DLP for data protection.

Exam trap

The trap here is that candidates often confuse the overlapping capabilities of Communication Compliance and DLP, assuming one tool can handle both behavioral monitoring and data protection, when in fact each is specialized for a distinct compliance domain.

How to eliminate wrong answers

Option A is wrong because Communication Compliance is not designed to prevent the sharing of sensitive data like credit card numbers; it focuses on communication surveillance and policy violations, not data leak prevention actions. Option B is wrong because DLP is not intended for detecting harassment or threats in communications; it scans for sensitive data patterns (e.g., credit card numbers, PII) and enforces data handling policies, not behavioral monitoring. Option D is wrong because eDiscovery is used for legal discovery and holds, not for real-time monitoring or prevention of harassment or data leaks; it is an investigation tool, not a proactive compliance solution.

Practice this question →

230

MCQeasy

A company needs to automatically detect and protect sensitive information such as credit card numbers in emails sent from Exchange Online and documents stored in SharePoint Online. They want to create policies that can block emails if such data is detected, and also automatically encrypt documents with specific labels. Which Microsoft Purview solution should they use?

A.Microsoft Purview Information Protection

B.Microsoft Purview Data Loss Prevention

C.Microsoft Purview Audit

D.Microsoft Purview Compliance Manager

AnswerB

Microsoft Purview Data Loss Prevention (DLP) is specifically designed to automatically detect sensitive information types, such as credit card numbers or national IDs, across various Microsoft 365 services and endpoints. It then enforces policy-driven actions, including blocking email transmission, encrypting files, or notifying administrators, to prevent unauthorized sharing or leakage. This proactive capability directly addresses the requirement to automatically detect and protect sensitive information in real-time by preventing its inappropriate use or transfer.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect sensitive information (e.g., credit card numbers) in Exchange Online emails and SharePoint Online documents, and then enforce protective actions such as blocking email transmission or applying encryption labels. DLP policies use sensitive information types and policy tips to identify and remediate data exposure risks across these workloads.

Exam trap

The trap here is that candidates often confuse Information Protection (labeling/encryption) with DLP (detection and enforcement), but DLP is the engine that triggers the protective actions, while Information Protection provides the labels and encryption mechanisms that DLP can apply.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Information Protection focuses on classifying, labeling, and protecting data at rest (e.g., applying sensitivity labels) but does not natively include the automated detection and blocking of sensitive data in transit or the enforcement of DLP actions like email blocking. Option C is wrong because Microsoft Purview Audit is solely for logging and investigating user and admin activities, not for detecting or protecting sensitive data in real time. Option D is wrong because Microsoft Purview Compliance Manager is a risk assessment and compliance management tool that helps track regulatory compliance posture, not a solution for detecting or protecting sensitive content in emails or documents.

Practice this question →

231

MCQmedium

A financial services company uses Microsoft Purview to manage compliance. They need to automatically apply a 'Confidential' label to all documents containing financial data in SharePoint. What should they configure?

A.Auto-labeling policy for sensitivity labels

B.Data classification dashboard

C.Trainable classifiers for manual labeling

D.Data Loss Prevention (DLP) policy

AnswerA

This policy type in Microsoft Purview is specifically designed to automatically apply sensitivity labels to content at scale, both at rest and in transit. It leverages conditions based on sensitive information types, keywords, or trainable classifiers to identify specific content patterns, ensuring consistent classification and protection without manual intervention. This directly fulfills the requirement for automatic data management.

Why this answer

Auto-labeling policies for sensitivity labels in Microsoft Purview allow organizations to automatically apply labels to documents based on conditions such as sensitive information types (e.g., financial data patterns). This meets the requirement to label documents containing financial data in SharePoint without manual intervention, leveraging built-in or custom sensitive info types.

Exam trap

The trap here is that candidates confuse DLP policies with auto-labeling policies, as both involve content scanning and actions, but DLP does not apply sensitivity labels—it only enforces protection rules like blocking or encryption.

How to eliminate wrong answers

Option B is wrong because the Data Classification dashboard is a monitoring and reporting tool that shows where sensitive data resides, but it does not automatically apply labels. Option C is wrong because Trainable classifiers are used for pattern-based content classification and can be used in auto-labeling policies, but they are not a standalone labeling mechanism; the question asks what to configure, and the policy itself is the auto-labeling policy, not the classifier. Option D is wrong because Data Loss Prevention (DLP) policies enforce actions like blocking or alerting on data sharing, but they do not apply sensitivity labels; labeling is a separate capability.

Practice this question →

232

MCQmedium

Your organization uses Microsoft Purview Records Management to manage high-value records that must not be deleted. You need to apply a label that marks content as a regulatory record. What label type should you use?

A.Data loss prevention policy

B.Retention label configured for regulatory records

C.Retention label configured for record

D.Sensitivity label

AnswerB

Regulatory records provide the highest level of protection, preventing deletion and modification.

Why this answer

A retention label configured for regulatory records is the correct choice because it locks the label so that no user, including an administrator, can remove it or reduce the retention period. This meets the requirement to mark content as a regulatory record that must not be deleted, as regulatory records provide the highest level of immutability in Microsoft Purview Records Management.

Exam trap

The trap here is that candidates confuse 'record' with 'regulatory record,' assuming both offer the same immutability, but only regulatory records provide a locked, unchangeable label that prevents any deletion or modification.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy is used to prevent accidental sharing of sensitive data, not to mark content as a regulatory record. Option C is wrong because a retention label configured for 'record' (standard record) allows administrators to modify or delete the label after it is applied, whereas a regulatory record label is locked and immutable. Option D is wrong because a sensitivity label is used for classification and protection (e.g., encryption or visual markings), not for managing retention or declaring content as a regulatory record.

Practice this question →

233

MCQhard

An organization has a Microsoft Purview Data Lifecycle Management policy that retains all documents for 5 years. However, legal requires that documents related to a specific lawsuit be preserved indefinitely. What should you do?

A.Configure information barriers

B.Place the relevant sites on litigation hold

C.Apply a retention label with indefinite retention

D.Create a DLP policy to block deletion

AnswerB

Placing relevant sites on litigation hold, also known as an eDiscovery hold, is the precise and legally recognized mechanism within Microsoft Purview to preserve electronically stored information (ESI) indefinitely for legal or investigative purposes. This action overrides all existing retention policies and user deletion actions, ensuring that all content, including documents, emails, and versions, remains immutable and discoverable for the entire duration of the legal matter, regardless of any other retention settings.

Why this answer

Litigation hold (now called legal hold in Microsoft Purview) preserves all content in a SharePoint site or OneDrive account indefinitely, overriding any retention policy. This ensures documents related to the lawsuit are not deleted or altered, even if a Data Lifecycle Management policy would otherwise remove them after 5 years. The hold applies at the site level, not to individual items, and prevents both deletion and modification.

Exam trap

The trap here is that candidates confuse retention labels (which require manual or automatic application to individual items) with litigation hold (which applies to an entire site or OneDrive account), leading them to choose option C despite its impracticality for bulk preservation.

How to eliminate wrong answers

Option A is wrong because information barriers restrict communication and collaboration between specific groups, not preserve data for legal purposes. Option C is wrong because a retention label with indefinite retention would need to be applied manually to each document, which is impractical for a large set of lawsuit-related files; litigation hold automatically covers all content in the site. Option D is wrong because a DLP policy blocks sharing of sensitive data but does not prevent deletion or retention of documents; it is designed for data loss prevention, not legal preservation.

Practice this question →

234

MCQmedium

A law firm needs to retain client documents for 10 years after case closure, but automatically delete drafts after 30 days. Which two Microsoft Purview solutions should be combined?

A.Microsoft Purview Data Loss Prevention and eDiscovery

B.Microsoft Purview eDiscovery and Audit

C.Microsoft Purview Audit and Data Loss Prevention

D.Microsoft Purview Records Management and Data Lifecycle Management

AnswerD

Records Management for regulatory records and Data Lifecycle Management for non-records.

Why this answer

Microsoft Purview Records Management enables the firm to mark client documents as records and enforce a 10-year retention period after case closure, while Data Lifecycle Management allows automatic deletion of drafts after 30 days. Together, they provide both long-term retention for compliance and short-term cleanup for non-record content, aligning with the firm's specific requirements.

Exam trap

The trap here is that candidates confuse Data Lifecycle Management with Data Loss Prevention or eDiscovery, mistakenly thinking DLP or eDiscovery can enforce retention or deletion policies, when in fact only Records Management and Data Lifecycle Management provide the necessary lifecycle controls.

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) focuses on preventing unauthorized sharing of sensitive data, not on retention or deletion policies, and eDiscovery is used for searching and exporting content for legal cases, not for automated lifecycle management. Option B is wrong because eDiscovery handles content search and export for litigation, while Audit tracks user and admin activities; neither solution enforces retention or deletion schedules. Option C is wrong because Audit logs activities but does not manage data retention or deletion, and DLP again addresses data protection, not lifecycle policies.

Practice this question →

235

MCQeasy

Your organization needs to monitor Microsoft Teams chats for inappropriate language and alert compliance officers. Which Microsoft Purview solution should you implement?

A.Communication Compliance

B.eDiscovery

C.Auditing

D.Information Protection

AnswerA

Microsoft 365 Communication Compliance is specifically designed to proactively detect, investigate, and remediate policy violations within an organization's communications, including Microsoft Teams chats. It leverages machine learning to identify sensitive information, regulatory compliance issues, or inappropriate conduct based on customizable policies. This tool enables organizations to monitor ongoing conversations for potential risks and take corrective actions before they escalate.

Why this answer

Communication Compliance is the correct solution because it is specifically designed to detect inappropriate language, such as profanity, harassment, or sensitive content, in Microsoft Teams chats and other communication channels. It uses built-in trainable classifiers and customizable policies to automatically flag violations and alert compliance officers, enabling proactive remediation.

Exam trap

The trap here is that candidates often confuse Communication Compliance with eDiscovery or Auditing, assuming any monitoring or alerting feature falls under those broader categories, but Communication Compliance is the only solution that specifically analyzes message content for policy violations like inappropriate language.

How to eliminate wrong answers

Option B (eDiscovery) is wrong because it is used for legal discovery and litigation support, not for real-time monitoring of inappropriate language; it focuses on searching, holding, and exporting content for legal cases. Option C (Auditing) is wrong because it logs user and admin activities for security and compliance investigations, but it does not analyze message content for inappropriate language or trigger alerts based on policy violations. Option D (Information Protection) is wrong because it applies sensitivity labels and encryption to protect data based on classification, not to monitor or detect inappropriate language in communications.

Practice this question →

236

MCQhard

An organization needs to automatically apply a 'Highly Confidential' sensitivity label to all documents that contain a specific custom sensitive information type. The label should be applied when the document is created or modified. Which feature of Microsoft Purview Information Protection should be used?

A.Manual sensitivity labeling

B.Data Loss Prevention (DLP) policies

C.Auto-labeling policies

D.Communication Compliance policies

AnswerC

Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content based on predefined conditions, such as the presence of specific sensitive information types, keywords, or patterns. These policies can be configured to apply labels to files at rest in SharePoint and OneDrive, or to emails and documents in Exchange, ensuring consistent classification without manual intervention. This direct application of labels fulfills the requirement for automatically classifying highly confidential information.

Why this answer

Auto-labeling policies in Microsoft Purview Information Protection are designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types. This feature supports both simulation and real-time enforcement, and it can be triggered when documents are created or modified, meeting the organization's requirement exactly.

Exam trap

The trap here is that candidates often confuse auto-labeling policies with DLP policies, mistakenly thinking DLP can apply labels, when in fact DLP only monitors and protects data in transit or at rest without modifying the label itself.

How to eliminate wrong answers

Option A is wrong because manual sensitivity labeling requires users to manually select and apply a label, which does not meet the requirement for automatic application. Option B is wrong because Data Loss Prevention (DLP) policies are focused on preventing unauthorized sharing or leakage of sensitive data through actions like blocking or alerting, not on automatically applying sensitivity labels to content. Option D is wrong because Communication Compliance policies are designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) and do not apply sensitivity labels based on sensitive information types.

Practice this question →

237

MCQeasy

Your organization needs to audit all changes to sensitive files in SharePoint Online for at least 180 days. Which Microsoft Purview feature should be enabled?

A.Microsoft Purview eDiscovery

B.Microsoft Purview Audit (Premium)

C.Microsoft Purview Data Loss Prevention

D.Microsoft Purview Data Lifecycle Management

AnswerB

Microsoft Purview Audit (Premium) is the correct solution because it provides advanced auditing capabilities specifically designed to capture and retain detailed user and admin activities across Microsoft 365 services. It offers extended retention of audit logs for up to one year (or 10 years with an add-on license) and access to crucial audit events like file and folder activities, enabling organizations to perform forensic investigations, respond to regulatory requests, and proactively monitor changes to sensitive files with high fidelity.

Why this answer

Microsoft Purview Audit (Premium) provides the extended retention of audit logs (up to 10 years) and the ability to search for high-value events such as changes to sensitive files. For a requirement of at least 180 days, Audit (Premium) is necessary because standard audit logs are retained for only 90 days. This feature logs all modifications to SharePoint Online files, including who changed what and when, meeting the auditing requirement.

Exam trap

The trap here is that candidates confuse the 90-day default retention of standard audit with the extended retention of Audit (Premium), and mistakenly choose eDiscovery because it sounds like it involves logs, but eDiscovery is for content search, not audit log retention.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview eDiscovery is used for searching and exporting content from Exchange, SharePoint, and Teams for legal or investigative purposes, not for auditing changes to sensitive files over a retention period. Option C is wrong because Microsoft Purview Data Loss Prevention (DLP) is designed to prevent unauthorized sharing or leakage of sensitive data by applying policies, not to audit historical changes. Option D is wrong because Microsoft Purview Data Lifecycle Management (formerly Records Management) focuses on retaining or deleting data based on policies (e.g., retention labels), not on logging and auditing changes to files.

Practice this question →

238

MCQeasy

Your organization needs to retain all email communications with customers for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?

A.Sensitivity labels

B.eDiscovery (Standard)

C.Retention policies

D.Data Loss Prevention policies

AnswerC

Retention policies enforce data retention for a defined period.

Why this answer

Retention policies in Microsoft Purview are designed to retain data for a specified period to meet regulatory or legal requirements. For email communications, a retention policy can be applied to Exchange mailboxes to ensure all messages are preserved for exactly 7 years, regardless of user deletion. This directly addresses the need to retain all customer emails for the mandated duration.

Exam trap

The trap here is that candidates often confuse retention policies (which enforce time-based preservation) with sensitivity labels (which focus on classification and protection), leading them to choose option A when the question explicitly requires a fixed retention duration.

How to eliminate wrong answers

Option A is wrong because sensitivity labels classify and protect data based on sensitivity (e.g., confidential, PII) but do not enforce time-based retention; they can trigger retention via auto-labeling but are not the primary solution for fixed-duration retention. Option B is wrong because eDiscovery (Standard) is used for searching and exporting content for legal or investigative purposes, not for automatically retaining data for a set period. Option D is wrong because Data Loss Prevention (DLP) policies monitor and prevent unauthorized sharing of sensitive data (e.g., credit card numbers) but do not enforce retention schedules.

Practice this question →

239

MCQmedium

A financial organization needs to automatically detect emails containing the phrase 'Non-Public Material Information' and apply a retention policy that retains those emails for 7 years. They also need to train senders with a policy tip before sending, and if they still send the email, it should be encrypted and blocked from being forwarded outside the organization. Which Microsoft Purview solution should they use?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Data Loss Prevention (DLP)

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Data Loss Prevention (DLP) is specifically engineered to identify, monitor, and protect sensitive information across Microsoft 365, including email communications. It leverages sensitive information types, keywords, and trainable classifiers to detect specific content patterns. Upon detection, DLP policies can automatically enforce a range of protective actions, such as blocking email delivery, encrypting messages, applying specific retention labels, or providing policy tips to users, directly addressing the need for automatic detection and enforcement.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically detect sensitive content (e.g., 'Non-Public Material Information') in emails, apply policy tips to train senders before sending, enforce encryption, and block forwarding outside the organization. DLP policies also integrate with retention labels to retain emails for a specified period, such as 7 years, by applying a retention label automatically when the sensitive content is detected.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (retention only) with DLP (detection + action), or assume Communication Compliance handles all email content monitoring, but DLP is the only solution that combines real-time content detection, user training via policy tips, and automated enforcement actions like encryption and forwarding blocks.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management focuses solely on retaining and deleting data based on policies, but it cannot detect sensitive content in real-time, apply policy tips, or enforce encryption and forwarding restrictions. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect policy violations (e.g., harassment, insider trading) for review and remediation, not to automatically apply retention, encryption, or forwarding blocks on emails containing specific phrases. Option D is wrong because Microsoft Purview Audit provides logging and investigation of past activities, but it cannot proactively detect content, apply policy tips, encrypt emails, or block forwarding.

Practice this question →

240

MCQmedium

A company is subject to a legal investigation and must preserve all email communications related to the case for an indefinite period, even if users try to delete them. The compliance officer needs a solution that can place a hold on specific user mailboxes and prevent any permanent deletion of relevant content. Which Microsoft Purview feature should be used?

A.Retention labels

B.Litigation hold

C.Data loss prevention

D.Compliance Manager

AnswerB

Litigation hold is specifically designed to preserve all electronically stored information (ESI) within a user's mailbox, including active items, deleted items, and even items modified after the hold is placed. It places an indefinite hold on content, preventing users from permanently deleting items and ensuring data immutability for legal discovery or investigation purposes. This mechanism is crucial for meeting eDiscovery requirements by ensuring no relevant data is lost.

Why this answer

Litigation hold is the correct feature because it places a hold on an entire mailbox, preserving all content including deleted items and versions, and prevents permanent deletion by users or automated processes. Unlike retention labels or policies, litigation hold applies to the entire mailbox and is designed specifically for legal investigations where indefinite preservation is required.

Exam trap

The trap here is that candidates often confuse retention labels or policies with litigation hold, not realizing that retention labels apply granularly to content while litigation hold applies to the entire mailbox and is specifically designed for legal preservation scenarios.

Why the other options are wrong

Retention labels are used to classify and retain data based on policies, but they do not prevent users from deleting items; they only ensure that deleted items are preserved in a recoverable state for a specified period. In this scenario, the requirement is to place a hold that prevents permanent deletion indefinitely, which is a feature of Litigation hold, not retention labels.

Data loss prevention (DLP) policies prevent accidental sharing of sensitive data but cannot place a legal hold on mailboxes to preserve content indefinitely against user deletion.

Compliance Manager is a risk assessment and compliance score tool, not a feature for placing holds on mailboxes to preserve content. It does not prevent deletion of emails.

Practice this question →

241

MCQhard

A financial services firm must comply with regulatory requirements that mandate supervisory review of communications between advisors and clients. They need to automatically capture emails and Microsoft Teams messages from a specific group of advisors, assign them to a supervisor for review, and flag messages containing potential code words for insider trading. Which Microsoft Purview solution should they use?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Communication Compliance

C.Microsoft Purview Information Protection

D.Microsoft Purview Insider Risk Management

AnswerB

Microsoft Purview Communication Compliance is specifically designed to help organizations detect, investigate, and remediate policy violations in communications. It leverages machine learning and customizable dictionaries to identify problematic content, such as potential insider trading code words, across various communication channels. This solution provides a structured workflow for supervisory review, allowing designated personnel to examine flagged messages, assign them for further investigation, and take appropriate action, directly addressing the need for content flagging and review.

Why this answer

Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to capture and review communications (email, Teams messages) for regulatory compliance, such as supervisory oversight of advisor-client interactions. It can automatically flag messages containing sensitive keywords or patterns (e.g., potential code words for insider trading) and route them to designated supervisors for review, meeting the firm's regulatory mandate.

Exam trap

The trap here is that candidates often confuse the 'capture and review communications' requirement with Insider Risk Management (Option D), which focuses on behavioral analytics and risk scoring rather than direct communication capture and keyword-based flagging.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management focuses on retaining, deleting, and managing data based on policies (e.g., retention labels, disposition review), not on capturing and reviewing communications for compliance or flagging specific content. Option C is wrong because Microsoft Purview Information Protection is used for classifying, labeling, and protecting sensitive data (e.g., encryption, rights management), not for supervisory review or automated flagging of communications. Option D is wrong because Microsoft Purview Insider Risk Management is designed to detect and investigate risky user activities (e.g., data exfiltration, policy violations) using analytics and behavioral indicators, not to capture and review communications for regulatory compliance or flag specific keywords.

Practice this question →

242

MCQmedium

Your organization must ensure that financial reports are protected with encryption and cannot be forwarded. Which two Microsoft Purview features should you combine?

A.Data Lifecycle Management and Data Loss Prevention

B.Retention policies and Records Management

C.Information Barriers and Communication Compliance

D.eDiscovery (Premium) and Audit (Standard)

E.Sensitivity labels with encryption and Data Loss Prevention

AnswerE

Sensitivity labels allow organizations to classify and protect sensitive content by applying persistent encryption, visual markings, and access restrictions directly to documents and emails. This ensures the financial reports are encrypted regardless of where they are stored or shared. Data Loss Prevention (DLP) policies then complement this by detecting sensitive information and actively preventing its unauthorized forwarding or sharing based on predefined rules, thus providing comprehensive protection.

Why this answer

Sensitivity labels with encryption allow you to apply persistent encryption to financial reports, ensuring they remain protected even when shared. Data Loss Prevention (DLP) policies can then block or warn users from forwarding these encrypted reports via email or other channels, providing a combined solution for encryption and forwarding prevention.

Exam trap

The trap here is that candidates often think DLP alone can prevent forwarding, but without encryption (via sensitivity labels), the content remains unprotected if forwarded outside the organization, so both features must be combined.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management governs retention and deletion, not encryption or forwarding prevention, and DLP alone doesn't provide encryption. Option B is wrong because Retention policies and Records Management control data retention and disposition, not encryption or blocking forwarding. Option C is wrong because Information Barriers restrict communication between specific groups, and Communication Compliance monitors for policy violations, neither directly encrypts nor prevents forwarding of financial reports.

Option D is wrong because eDiscovery (Premium) is for legal discovery and Audit (Standard) logs activities, neither provides encryption or forwarding controls.

Practice this question →

243

MCQhard

Tailspin Toys is a toy manufacturer with headquarters in the US and subsidiaries in Europe and Asia. You are the compliance administrator. The company must comply with the EU General Data Protection Regulation (GDPR). Requirements: 1) Personal data of EU residents must be retained only for as long as necessary (max 5 years after last interaction). 2) If a user tries to share personal data outside the EU, the action must be blocked. 3) Users must be able to manually mark documents as 'GDPR High Risk' which will encrypt them and add a watermark 'GDPR PROTECTED'. 4) All access to personal data must be audited. You have Microsoft Purview with E5 compliance licenses. What is the most efficient solution?

A.Use a retention policy to delete all content after 5 years; create a DLP policy to block sharing of personal data outside EU; create a sensitivity label for manual application with encryption and watermark; enable audit logging

B.Create an auto-labeling policy to apply a 'Personal Data' sensitivity label; create a retention label 'GDPR Retention' to auto-apply to personal data and retain for 5 years; create a DLP policy to block sharing of labeled personal data outside EU; create a separate sensitivity label 'GDPR High Risk' for manual application with encryption and watermark; enable audit logging

C.Use a retention policy to delete personal data after 5 years; create a DLP policy to block cross-border sharing; use a sensitivity label with auto-labeling for personal data; enable audit logging

D.Create a DLP policy to block sharing of personal data outside EU; use a retention label for 5 years; use a single sensitivity label for both automatic and manual scenarios; enable audit logging

AnswerB

Auto-labeling applies sensitivity label; retention label retains personal data for 5 years; DLP blocks cross-border sharing; manual label provides encryption and watermark; audit logging tracks access.

Why this answer

The most efficient because it uses a retention label 'GDPR Retention' with auto-labeling to automatically retain personal data for 5 years, precisely meeting requirement 1. It creates a DLP policy to block sharing of labeled personal data outside the EU, satisfying requirement 2. It provides a separate sensitivity label 'GDPR High Risk' for manual application with encryption and watermark, meeting requirement 3.

Audit logging is enabled for requirement 4. Option A uses a retention policy on all content, which is too broad and not specific to personal data. Option C lacks a manual sensitivity label for high-risk documents.

Option D attempts to use a single sensitivity label for both automatic and manual scenarios, which is less flexible and may not apply encryption/watermark correctly for manual labeling.

Practice this question →

244

MCQmedium

An organization needs to detect and address potential policy violations in Microsoft Teams chat messages and channel conversations. They want to configure a policy that automatically scans for keywords related to confidential information and for sensitive data patterns like credit card numbers. When a violation is found, the policy should notify the user and their manager, and optionally escalate to a designated reviewer. Which Microsoft Purview solution should they configure?

A.Communication Compliance

B.Data Lifecycle Management

C.eDiscovery

D.Audit

AnswerA

Communication Compliance is the correct solution as it proactively identifies and addresses potential policy violations within an organization's communications, such as Microsoft Teams chats, Exchange emails, and Yammer posts. It leverages machine learning and predefined or custom policies to detect issues like harassment, threats, or the sharing of sensitive information. When a policy is triggered, it generates alerts for designated reviewers, enabling them to investigate, remediate, and escalate findings through a structured workflow.

Why this answer

Communication Compliance is the correct solution because it is specifically designed to detect policy violations in Microsoft Teams messages and other communication channels by scanning for keywords and sensitive data patterns (e.g., credit card numbers). It can automatically notify the user and their manager, and optionally escalate violations to a designated reviewer for remediation, directly matching the organization's requirements.

Exam trap

The trap here is that candidates may confuse Communication Compliance with Data Loss Prevention (DLP) or eDiscovery, but DLP focuses on preventing data leaks (e.g., blocking sharing) rather than detecting and escalating policy violations with user/manager notifications, while eDiscovery is reactive and not designed for automated detection and notification workflows.

Why the other options are wrong

Data Lifecycle Management focuses on retaining or deleting data based on policies, not on scanning messages for policy violations or notifying users and managers.

eDiscovery is used for searching and exporting content for legal or investigative purposes, not for real-time policy violation detection and user notification in Teams messages.

Audit logs user and admin activity but does not scan Teams messages for policy violations or sensitive data patterns like credit card numbers.

Practice this question →

245

MCQhard

A company wants to prevent users from sharing files containing personally identifiable information (PII) with external recipients. They also need to notify users if they attempt to share such files. Which Microsoft Purview solution should be configured?

A.Microsoft Purview Sensitivity Labels

B.Microsoft Purview Communication Compliance

C.Microsoft Purview eDiscovery

D.Microsoft Purview Data Loss Prevention

AnswerD

DLP policies can block sharing of sensitive data and notify users.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, prevent, and notify users about the sharing of sensitive data, such as personally identifiable information (PII), with external recipients. DLP policies can be configured to automatically block the sharing of files containing PII and display a policy tip notification to the user when they attempt to share such content.

Exam trap

The trap here is that candidates often confuse Sensitivity Labels with DLP, but Sensitivity Labels only classify and protect data without enforcing sharing restrictions or user notifications, whereas DLP is the solution that actively monitors and blocks the external sharing of sensitive data.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Sensitivity Labels are used to classify and protect data by applying encryption or visual markings, but they do not inherently block sharing or provide user notifications when a user attempts to share PII externally. Option B is wrong because Microsoft Purview Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) within an organization, not to prevent the sharing of files containing PII with external recipients. Option C is wrong because Microsoft Purview eDiscovery is used for searching, preserving, and exporting content for legal or investigative purposes, not for real-time prevention or notification of data sharing violations.

Practice this question →

246

MCQeasy

Your organization uses Microsoft Purview to classify documents containing health information. You need to ensure that only users with explicit permission can access these documents. Which Microsoft Purview capability should you use?

A.Audit logs

B.Retention policies

C.Data Loss Prevention

D.Sensitivity labels with encryption

AnswerD

Sensitivity labels in Microsoft Purview allow organizations to classify and protect their sensitive data throughout its lifecycle, regardless of where it's stored or shared. When configured with encryption, these labels apply persistent, rights-management protection directly to the document content. This ensures that only authorized users, as defined by the label's policy, can open, view, or modify the document, even if it leaves the organization's controlled environment, thereby enforcing access controls.

Why this answer

Sensitivity labels with encryption are the correct choice because they allow you to classify documents containing health information and apply encryption to restrict access to only users with explicit permissions. This ensures that even if the document is shared or moved, only authorized users can decrypt and read it, meeting the requirement for access control.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with access control, but DLP only monitors and blocks data exfiltration, not who can view or edit documents after they are stored.

How to eliminate wrong answers

Option A is wrong because Audit logs record user activities and access events but do not enforce access restrictions; they are for monitoring, not controlling access. Option B is wrong because Retention policies manage how long data is kept or when it is deleted, not who can access it; they do not provide permission-based access control. Option C is wrong because Data Loss Prevention (DLP) policies detect and prevent unauthorized sharing of sensitive data but do not enforce encryption or granular user permissions; DLP can trigger actions like blocking sharing but cannot restrict access to documents already stored.

Practice this question →

247

Multi-Selecthard

A healthcare organization subject to HIPAA regulations stores patient health information (PHI) in SharePoint Online and OneDrive. The compliance team needs to automatically detect and classify medical record numbers and other PHI when documents are uploaded. Detected sensitive content must be protected by encryption and restricted to authorized users only. Additionally, the team wants to prevent users from sharing such documents externally. Which TWO Microsoft Purview solutions should they combine to achieve these requirements? (Choose two.)

Select 2 answers

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Information Protection

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Data Lifecycle Management

AnswersA, B

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations within Microsoft 365, including Exchange Online, SharePoint Online, OneDrive, and Teams. It leverages sensitive information types, trainable classifiers, and exact data match to detect HIPAA-regulated data, such as Protected Health Information (PHI). Upon detection, DLP can enforce actions like blocking sharing, notifying users and administrators, or automatically applying sensitivity labels to prevent unauthorized disclosure, directly addressing detection and prevention requirements.

Why this answer

Microsoft Purview Information Protection (B) enables automatic classification and labeling of sensitive data like medical record numbers and PHI based on sensitive info types or trainable classifiers. Microsoft Purview Data Loss Prevention (A) then enforces policies to apply encryption, restrict access to authorized users, and block external sharing of labeled documents. Together, they meet the requirements for detection, protection, and sharing prevention.

Exam trap

The trap here is that candidates may confuse Communication Compliance (which monitors communications) with DLP or Information Protection, or assume Data Lifecycle Management handles classification, but it only manages retention and deletion.

Why the other options are wrong

Communication Compliance focuses on detecting policy violations in communications (e.g., inappropriate language, insider trading) rather than automatically detecting and protecting PHI in documents. It does not provide encryption or access restrictions for sensitive content.

Data Lifecycle Management manages retention and deletion of data based on policies, but does not detect, classify, or protect sensitive content like PHI, nor does it prevent external sharing.

Practice this question →

248

MCQhard

A data analyst is planning to leave the company in two weeks and has access to a large volume of sensitive customer data. The compliance team wants to detect if the analyst starts downloading large amounts of files to a personal USB drive or sending sensitive content to an external email address. They need to set up a policy that alerts on such anomalous data exfiltration activities without blocking operations until a thorough investigation is completed. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Insider Risk Management

B.Microsoft Purview Data Lifecycle Management

C.Microsoft Purview Communication Compliance

D.Microsoft Purview eDiscovery (Standard)

AnswerA

Microsoft Purview Insider Risk Management is the correct solution as it proactively identifies and mitigates potential data exfiltration risks from within the organization. It leverages machine learning to detect anomalous user behaviors, such as unusual download volumes, email forwarding, or cloud uploads, especially when correlated with HR signals like an employee's impending departure. The service provides configurable policies, alerts security teams to suspicious activities, and offers case management tools for investigation and remediation, directly addressing the scenario of a departing data analyst.

Why this answer

Microsoft Purview Insider Risk Management is designed to detect, investigate, and act on risky user activities, including data exfiltration by departing employees. It uses predefined indicators such as downloading files to USB drives or sending emails to external addresses, and can generate alerts without automatically blocking operations, allowing for a thorough investigation first.

Exam trap

The trap here is that candidates often confuse Insider Risk Management with Communication Compliance, but Communication Compliance focuses on communication content (e.g., offensive language) rather than behavioral data exfiltration patterns like USB downloads or bulk external emails.

Why the other options are wrong

Microsoft Purview Data Lifecycle Management focuses on retaining and deleting data based on policies, not on detecting anomalous user behavior like data exfiltration to USB drives or external emails.

Microsoft Purview Communication Compliance monitors communications for policy violations like inappropriate language or sharing sensitive info, but it does not detect anomalous data exfiltration activities such as bulk file downloads to USB drives.

Microsoft Purview eDiscovery (Standard) is used for searching and exporting content for legal or investigative purposes, not for real-time detection and alerting on anomalous data exfiltration activities. It does not provide proactive alerts on user behavior like downloading files to USB drives or sending sensitive emails.

Practice this question →

249

MCQmedium

A user receives a sensitivity label that automatically marks the email as 'Confidential' and prevents forwarding. The label was applied without user intervention. Which mechanism most likely applied the label?

A.Azure Information Protection file policy

B.Auto-classification via DLP policy

C.Default label configured in Microsoft 365

D.Manual labeling by the user

AnswerB

Auto-classification via a Data Loss Prevention (DLP) policy is the correct mechanism for this scenario. Microsoft Purview DLP policies can be configured to detect specific sensitive information types (SITs) or trainable classifiers within content, such as emails, documents, or Teams messages. Upon detection, the DLP policy can automatically apply a pre-defined sensitivity label to the item, ensuring consistent protection based on the content's sensitivity without requiring any manual user action.

Why this answer

Auto-classification via DLP policy can automatically apply sensitivity labels based on sensitive content, such as credit card numbers, enabling the label to be applied without user intervention. Option A is incorrect because the Azure Information Protection file policy applies to files in Windows File Explorer, not emails. Option C is incorrect because a default label applies to all unlabeled emails but does not use content detection.

Option D is incorrect because manual labeling requires the user to select the label.

Practice this question →

250

MCQmedium

A multinational corporation must retain all financial records for 7 years and then permanently delete them. The compliance officer wants to ensure that even a global administrator cannot modify or delete the retention policy. Which Microsoft Purview solution and configuration should they use?

A.eDiscovery (Standard)

B.Compliance Manager

C.Data Lifecycle Management with a preservation lock

D.Information Protection with sensitivity labels

AnswerC

Data Lifecycle Management (DLM), specifically through Microsoft 365 retention policies, allows organizations to define how long content is retained or deleted. For financial records requiring mandatory retention, a retention policy can be configured to preserve content for a specified period. Applying a preservation lock to this policy makes it immutable, preventing anyone, including administrators, from turning off the policy, deleting it, or making it less restrictive, thus ensuring compliance with stringent regulatory requirements for long-term record retention.

Why this answer

C is correct because Data Lifecycle Management with a preservation lock allows an organization to apply a retention policy that cannot be modified, deleted, or turned off by any administrator, including a global administrator. This ensures financial records are retained for exactly 7 years and then permanently deleted, meeting the compliance officer's requirement for immutable retention.

Exam trap

The trap here is that candidates often confuse retention policies with sensitivity labels or eDiscovery, not realizing that only a preservation lock provides the immutable, administrator-proof retention enforcement required for regulatory compliance.

Why the other options are wrong

eDiscovery (Standard) is used for searching and exporting content for legal or investigative purposes, not for enforcing immutable retention policies. It cannot prevent administrators from modifying or deleting retention settings.

Compliance Manager is a risk assessment and compliance score tool, not a data retention solution. It cannot enforce retention policies or prevent modification/deletion of retention settings.

Practice this question →

251

MCQeasy

You are the compliance administrator for a retail company that uses Microsoft 365 Business Premium. The company needs to: - Block customers' credit card numbers from being sent via email. - Retain all sales invoices for 3 years as per financial regulations. - Allow managers to search and export employee emails for HR investigations. - Ensure that only HR can access employee salary information. Which Microsoft Purview solutions should you use?

A.DLP, Information Barriers, eDiscovery, and sensitivity labels

B.DLP, Data Lifecycle Management, eDiscovery, and sensitivity labels

C.Insider Risk Management, Data Lifecycle Management, eDiscovery, and sensitivity labels

D.Communication Compliance, Data Lifecycle Management, eDiscovery, and sensitivity labels

AnswerB

This combination correctly addresses all implied compliance requirements. Data Loss Prevention (DLP) is essential for blocking the sharing of sensitive information like credit card numbers. Data Lifecycle Management (DLM) provides the necessary capabilities for defining and enforcing retention and disposition policies, ensuring data is kept for the required duration and then appropriately deleted. eDiscovery enables the organization to efficiently search, preserve, and produce electronic information for legal or investigative purposes, while sensitivity labels allow for data classification and protection, applying encryption or access restrictions based on content.

Why this answer

DLP (Data Loss Prevention) blocks credit card numbers from being sent via email, Data Lifecycle Management retains sales invoices for 3 years, eDiscovery allows managers to search and export employee emails for HR investigations, and sensitivity labels restrict access to salary information to HR only. Each requirement maps directly to a specific Purview solution: DLP for sensitive data protection, retention policies for compliance, eDiscovery for legal/HR investigations, and sensitivity labels for access control.

Exam trap

The trap here is that candidates confuse Information Barriers (which restrict communication between groups) with DLP (which blocks sensitive data patterns), or assume Insider Risk Management or Communication Compliance can replace DLP for proactive blocking of credit card numbers in email.

How to eliminate wrong answers

Option A is wrong because Information Barriers are designed to prevent communication between specific groups (e.g., to avoid conflicts of interest), not to block sensitive data like credit card numbers or to retain data for a fixed period; DLP handles the blocking, and retention requires Data Lifecycle Management, not Information Barriers. Option C is wrong because Insider Risk Management focuses on detecting risky user activities (e.g., data exfiltration) rather than proactively blocking credit card numbers via email; DLP is the correct solution for that requirement. Option D is wrong because Communication Compliance is used to monitor communications for policy violations (e.g., harassment), not to block specific sensitive data patterns like credit card numbers; DLP is required for that blocking action.

Practice this question →

252

MCQmedium

Your organization uses Microsoft Purview to manage compliance. You need to ensure that financial documents are automatically labeled as 'Financial' and retained for 7 years. Additionally, if a user tries to share a financial document externally, they must see a policy tip warning them and be blocked if they proceed. You also need to audit all access to financial documents. Which configuration should you implement?

A.Create a DLP policy to detect financial data and block external sharing; use default audit logging

B.Create a manual labeling policy for users to apply 'Financial' label; create a retention label for 7 years; create a DLP policy to warn on external sharing

C.Create a retention label 'Financial' with auto-apply based on sensitive info type; create a DLP policy to block external sharing

D.Create an auto-labeling policy to apply a sensitivity label 'Financial' with encryption; create a retention policy to retain all labeled content for 7 years; create a DLP policy to block external sharing of 'Financial' labeled content with a policy tip; enable audit logging

AnswerD

Auto-labeling applies label automatically; retention policy retains; DLP blocks sharing; audit logging tracks access.

Why this answer

It combines auto-labeling to automatically apply the 'Financial' sensitivity label with encryption, a retention policy to retain labeled content for 7 years, a DLP policy to block external sharing with a policy tip, and audit logging (enabled by default) to track access. Option A lacks labeling and retention. Option B uses manual labeling, which is not automatic, and the DLP only warns, not blocks.

Option C uses a retention label instead of a sensitivity label, so it does not provide encryption or protection, and the DLP policy does not include a policy tip.

Practice this question →

253

MCQmedium

Your organization uses Microsoft 365 and needs to identify internal users who are sending confidential data to external domains repeatedly. Which Microsoft Purview solution should you use?

A.Data Loss Prevention

B.Insider Risk Management

C.Audit (Premium)

D.Communication Compliance

AnswerB

Microsoft Purview Insider Risk Management is specifically engineered to identify, analyze, and act on potential insider risks by correlating diverse signals from Microsoft 365 and other sources. It leverages machine learning and advanced analytics to detect subtle, cumulative patterns of user activity, such as unusual data exfiltration, unauthorized access attempts, or policy violations, that collectively indicate malicious or inadvertent insider threats over time. This capability directly addresses the need to identify evolving patterns of risky behavior.

Why this answer

Insider Risk Management (IRM) is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that violate organizational policies, such as repeatedly sending confidential data to external domains. IRM uses predefined or custom policies to correlate signals from Microsoft 365 logs (e.g., email, SharePoint, Teams) and user behavior analytics to identify patterns of data exfiltration by internal users. Unlike other solutions, IRM focuses on user-centric risk scenarios and can trigger automated responses like escalation or case creation.

Exam trap

The trap here is that candidates often confuse Data Loss Prevention (DLP) with user behavior analysis, assuming DLP's alerting on individual sensitive data sends is sufficient to identify repeat offenders, but DLP lacks the cross-event correlation and user-centric risk scoring that Insider Risk Management provides.

How to eliminate wrong answers

Option A (Data Loss Prevention) is wrong because DLP is primarily a content-aware policy engine that blocks or alerts on sensitive data in transit or at rest based on rules (e.g., credit card numbers), but it does not natively analyze repeated user behavior patterns over time or correlate multiple incidents to identify a user as a repeat offender. Option C (Audit (Premium)) is wrong because Audit (Premium) provides detailed logging and forensic investigation capabilities but is a passive recording tool; it does not proactively detect or alert on repeated data exfiltration patterns without additional custom queries or manual analysis. Option D (Communication Compliance) is wrong because Communication Compliance is designed to monitor and review communications (e.g., email, Teams) for offensive language, harassment, or regulatory compliance (e.g., FINRA), not for detecting repeated data exfiltration of confidential data to external domains.

Practice this question →

254

MCQmedium

A financial services organization needs to prevent communication between its research analysts and investment bankers to comply with regulatory requirements. Which Microsoft Purview solution should the compliance team implement?

A.Data Loss Prevention (DLP)

B.Information Barriers

C.Data Lifecycle Management

D.Microsoft Purview eDiscovery

AnswerB

Information Barriers, a feature within Microsoft Purview, are designed to prevent specific groups of users from communicating or collaborating with each other. This is crucial for organizations like financial services firms to establish 'ethical walls' between departments, such as analysts and bankers, ensuring regulatory compliance and preventing conflicts of interest. These policies restrict communication channels like Microsoft Teams chats, calls, and SharePoint site access, directly addressing the need to prevent communication.

Why this answer

Information Barriers (IB) in Microsoft Purview is specifically designed to prevent communication and collaboration between certain user groups to comply with regulatory requirements, such as those in financial services that require separation between research analysts and investment bankers. IB policies enforce restrictions on Microsoft Teams, SharePoint, and OneDrive to block unauthorized communication and file sharing, directly addressing the need to avoid conflicts of interest.

Exam trap

Microsoft often tests the distinction between DLP and Information Barriers, where candidates mistakenly choose DLP because they think preventing communication is about protecting data, but DLP does not restrict person-to-person communication—it only restricts data sharing based on content classification.

Why the other options are wrong

Data Loss Prevention (DLP) is designed to prevent unauthorized sharing of sensitive data, not to block communication between specific groups of users. The requirement is to prevent communication between research analysts and investment bankers, which is a classic information barrier scenario, not a data protection issue.

Data Lifecycle Management governs retention and deletion of data based on policies, but it does not restrict communication between users or groups. The question requires preventing communication between analysts and bankers, which is a real-time access control need, not a data retention policy.

eDiscovery is used for identifying, preserving, and exporting electronic content for legal or investigative purposes, not for preventing communication between groups. It does not enforce real-time communication restrictions.

Practice this question →

255

MCQhard

Your organization uses Microsoft Purview Insider Risk Management. You need to create a policy that detects users exfiltrating sensitive data via email to external recipients. Which policy type should you configure?

A.Offensive language

B.Data leaks

C.Data theft

D.Security policy violations

AnswerB

Microsoft Purview Insider Risk Management is specifically engineered to identify and mitigate risks related to the unauthorized disclosure or exfiltration of sensitive organizational data, whether intentional or accidental. Policies configured within this solution directly target behaviors indicative of data leaving the organization, such as emailing sensitive files to personal accounts, uploading to unsanctioned cloud storage, or copying to removable media, making "data leaks" the most accurate description of its core function.

Why this answer

Data leaks policy type in Microsoft Purview Insider Risk Management is specifically designed to detect and alert on the unauthorized transmission of sensitive data to external recipients, including via email. This policy type analyzes email headers, attachments, and body content against defined sensitive information types (e.g., credit card numbers, PII) and triggers when data is sent outside the organization, matching the scenario described.

Exam trap

The trap here is that candidates often confuse 'Data theft' (which implies physical or logical removal of data) with 'Data leaks' (which specifically covers unauthorized external sharing via communication channels like email), leading them to select Option C incorrectly.

How to eliminate wrong answers

Option A is wrong because Offensive language policy type is designed to detect and manage workplace harassment or inappropriate communication patterns (e.g., bullying, threats), not the exfiltration of sensitive data via email. Option C is wrong because Data theft policy type focuses on unauthorized removal or copying of data by users (e.g., downloading to USB, printing), but it does not specifically target email-based exfiltration to external recipients; it covers broader theft scenarios. Option D is wrong because Security policy violations policy type is intended to detect users bypassing security controls (e.g., disabling antivirus, tampering with logs), not the direct exfiltration of sensitive data via email.

Practice this question →

256

MCQhard

A security analyst runs the above KQL query in Microsoft Sentinel. What is the primary purpose of this query?

A.Correlate MFA failures with other security events

B.Identify all users who had an MFA failure anomaly in the last 7 days

C.Identify users who have been blocked due to MFA failures

D.Identify users with more than 5 MFA failure anomalies in the last 7 days

AnswerD

The query correctly filters `SecurityAlert` records generated within the last 7 days for MFA failure anomalies. It then groups these anomalies by user and calculates the total count for each user. The subsequent `where AlertCount > 5` clause precisely isolates and presents only those users whose aggregated count of MFA failure anomalies exceeds five, directly matching the objective described in this option.

Why this answer

The KQL query uses `summarize` with `count()` on MFA failure anomalies, then filters with `where count_ > 5` and `where TimeGenerated > ago(7d)`. This explicitly returns only users whose anomaly count exceeds 5 in the last 7 days, making option D correct. The query does not correlate with other events, list all users with any anomaly, or check block status.

Exam trap

The trap here is that candidates see 'MFA failure anomalies' and 'last 7 days' and assume the query returns all users with any anomaly (option B), missing the critical `where count_ > 5` threshold filter that narrows the result to only high-frequency failures.

How to eliminate wrong answers

Option A is wrong because the query only filters on a single table (presumably `SigninLogs` with MFA failure anomalies) and does not use `join` or `union` to correlate with other security event tables. Option B is wrong because the query includes a `where count_ > 5` filter, so it does not identify all users with any MFA failure anomaly—only those exceeding the threshold. Option C is wrong because the query does not reference any column indicating a blocked status (e.g., `Status` or `Blocked`), nor does it use `where ResultType` values like `500121` (MFA blocked); it only counts anomaly occurrences.

Practice this question →

257

MCQmedium

You work for a law firm that uses Microsoft 365 E5. The firm handles highly confidential client information and must comply with attorney-client privilege. You need to implement a compliance solution that: - Prevents unauthorized sharing of privileged documents via email. - Enables lawyers to easily classify documents as 'Privileged' and automatically encrypt them. - Allows the compliance team to monitor for accidental exposure of privileged information in Teams chats. - Ensures that privileged documents are retained for 7 years after case closure, then automatically deleted. - Provides the ability to search for privileged documents in case of a legal hold. What should you configure?

A.Sensitivity labels with encryption, DLP, Communication Compliance, Data Lifecycle Management, and eDiscovery

B.DLP, Communication Compliance, Data Lifecycle Management, and Audit (Standard)

C.Insider Risk Management, DLP, Data Lifecycle Management, and eDiscovery

D.Sensitivity labels, Information Barriers, Data Lifecycle Management, and eDiscovery

AnswerA

All requirements are covered: classification, encryption, DLP, monitoring, retention, and eDiscovery.

Why this answer

It combines all required capabilities: Sensitivity labels with encryption allow lawyers to classify documents as 'Privileged' and automatically encrypt them; DLP prevents unauthorized sharing of privileged documents via email; Communication Compliance monitors Teams chats for accidental exposure; Data Lifecycle Management retains privileged documents for 7 years after case closure and then automatically deletes them; eDiscovery provides the ability to search for privileged documents in case of a legal hold. Option B is incorrect because it lacks Sensitivity labels (needed for classification and encryption) and includes Audit (Standard) which does not provide the retention or search capabilities of Data Lifecycle Management and eDiscovery. Option C is incorrect because Insider Risk Management focuses on detecting risky user activities but does not enable lawyers to classify or encrypt documents, and it is not designed for monitoring Teams chats for privilege exposure; Communication Compliance is needed for that.

Option D is incorrect because Information Barriers restrict communication between specific groups to prevent information sharing, but does not monitor for accidental exposure in Teams; Communication Compliance is required for that monitoring.

Practice this question →

258

Multi-Selecthard

Which THREE capabilities are included in Microsoft Purview Audit (Premium)?

Select 3 answers

A.Trainable classifiers

B.Access to high-value critical events

C.Custom alert policies

D.Higher bandwidth for API access

E.Longer retention of audit logs (up to 1 year)

AnswersB, D, E

Audit (Premium) logs high-value events like admin actions.

Why this answer

Microsoft Purview Audit (Premium) provides access to high-value critical events, such as when mailbox items are accessed or when administrative actions are performed on sensitive data. These events are not logged in Audit (Standard) and require Premium licensing to capture, enabling deeper forensic investigation.

Exam trap

The trap here is that candidates confuse trainable classifiers or custom alert policies as audit-specific features, when in fact they belong to other compliance solutions like Information Protection or Defender, not Audit (Premium).

Practice this question →

259

MCQmedium

Your organization uses Microsoft Purview to manage data lifecycle. You need to ensure that after a project ends, all related files are automatically deleted after 3 years. What should you configure?

A.Create a retention label with a retention period of 3 years and a disposition action of deletion

B.Configure a DLP policy to delete files after 3 years

C.Create an eDiscovery case and manually delete the files

D.Apply a sensitivity label marked 'Project' and configure auto-deletion

AnswerA

Retention labels in Microsoft Purview are specifically designed to manage the lifecycle of data, including its eventual deletion. By creating a retention label with a 3-year retention period and a disposition action set to deletion, the organization ensures that content is preserved for the required duration and then automatically removed from its location. This mechanism is central to compliant data lifecycle management, enforcing policy across various Microsoft 365 services to meet regulatory and internal governance requirements.

Why this answer

A retention label in Microsoft Purview allows you to define a retention period and then automatically trigger a disposition action—such as permanent deletion—when that period expires. By creating a label with a 3-year retention period and setting the disposition action to 'Delete', all files tagged with that label will be automatically removed after three years, meeting the requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which handle classification and protection) with retention labels (which handle lifecycle and disposition), leading them to choose Option D even though sensitivity labels lack native auto-deletion capabilities.

How to eliminate wrong answers

Option B is wrong because a Data Loss Prevention (DLP) policy is designed to detect and prevent the unauthorized sharing or leakage of sensitive data, not to enforce time-based retention or deletion of files. Option C is wrong because eDiscovery cases are used for legal holds and manual review/discovery of content, not for automated lifecycle management or scheduled deletion. Option D is wrong because sensitivity labels in Microsoft Purview primarily classify and protect data based on sensitivity (e.g., encryption, markings), and while they can support auto-labeling, they do not natively include a configurable auto-deletion action based on a retention period.

Practice this question →

260

MCQhard

A multinational corporation must comply with several regulatory frameworks, including GDPR, SOX, and HIPAA. The compliance officer wants to continuously assess the organization's compliance posture against these regulations, receive prioritized improvement actions, and track the implementation progress of those actions. Which Microsoft Purview solution should the compliance officer use?

A.Information Protection

B.Compliance Manager

C.Data Lifecycle Management

D.Insider Risk Management

AnswerB

Microsoft Purview Compliance Manager is specifically designed to help organizations manage their compliance posture against various regulatory frameworks. It provides pre-built assessment templates for numerous regulations (e.g., GDPR, HIPAA, ISO 27001), a quantifiable compliance score, and actionable improvement recommendations. This centralized dashboard allows for continuous monitoring, tracking progress on improvement actions, and generating reports to demonstrate adherence to complex global and industry-specific compliance requirements.

Why this answer

Compliance Manager is the correct solution because it provides a centralized dashboard for continuously assessing compliance posture against multiple regulatory frameworks (GDPR, SOX, HIPAA), generates prioritized improvement actions based on built-in assessments, and tracks implementation progress of those actions through a task-based workflow. It uses automated control mapping and continuous monitoring to help organizations meet evolving compliance requirements.

Exam trap

The trap here is that candidates confuse Compliance Manager with Information Protection, thinking that protecting data automatically ensures compliance, but Compliance Manager is the only solution that provides continuous assessment and actionable improvement tracking across multiple regulations.

Why the other options are wrong

Information Protection focuses on classifying, labeling, and protecting sensitive data (e.g., encryption, rights management), not on assessing compliance posture against multiple regulations or tracking improvement actions.

Data Lifecycle Management focuses on governing data retention and deletion policies, not on assessing compliance posture against regulations or tracking improvement actions.

Insider Risk Management is designed to detect, investigate, and act on risky user activities (e.g., data theft, policy violations), not to assess compliance posture against regulations or track improvement actions.

Practice this question →

261

MCQeasy

A company uses Microsoft 365. The compliance department requires that all financial documents be retained for 10 years and then automatically deleted, while marketing documents must be retained for 3 years and then deleted. Additionally, they want to apply a default retention policy to all SharePoint Online sites. Which Microsoft Purview solution should the company use?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview eDiscovery

C.Microsoft Purview Compliance Manager

D.Microsoft Purview Data Loss Prevention (DLP)

AnswerA

Microsoft Purview Data Lifecycle Management (DLM), formerly known as Microsoft 365 Records Management, is the primary service within Microsoft Purview for managing the entire lifecycle of an organization's data. It enables the creation and application of retention labels and policies to define how long content should be kept, whether for regulatory compliance, legal hold, or business requirements, and when it should be permanently deleted. This ensures that data is retained for the necessary period and then defensibly disposed of according to established policies, directly addressing compliance department requirements for data retention and deletion.

Why this answer

Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it allows organizations to define retention and deletion policies based on content type and location. In this scenario, the company needs to apply different retention periods (10 years for financial documents, 3 years for marketing documents) and a default retention policy for all SharePoint Online sites, which is exactly what Data Lifecycle Management's retention policies and labels provide.

Exam trap

The trap here is that candidates often confuse eDiscovery (which holds content for legal reasons) with Data Lifecycle Management (which automates retention and deletion based on time), leading them to select eDiscovery when the question clearly asks for automated retention and deletion schedules.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview eDiscovery is used for legal discovery and litigation hold, not for automated retention and deletion based on time periods. Option C is wrong because Compliance Manager is a risk assessment and compliance score tool that helps track regulatory compliance posture, not a solution for applying retention or deletion policies. Option D is wrong because Data Loss Prevention (DLP) is designed to prevent unauthorized sharing or leakage of sensitive data through policies, not to manage retention schedules or automatic deletion.

Practice this question →

262

MCQmedium

A company is required by a compliance regulation to retain all user and admin activity audit logs for 2 years. They also need the ability to perform faster, historical searches on this audit data. Which Microsoft Purview solution should they use?

A.Microsoft Purview Audit (Standard)

B.Microsoft Purview Audit (Premium)

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview eDiscovery (Premium)

AnswerB

Microsoft Purview Audit (Premium) is the appropriate solution for retaining audit logs for two years, as it offers a default retention of one year, which can be extended to up to 10 years for specific activities. This service provides advanced auditing capabilities, including higher-fidelity logging, faster access to audit data, and increased API bandwidth, making it suitable for meeting stringent regulatory compliance requirements for long-term audit log retention.

Why this answer

Microsoft Purview Audit (Premium) provides a 2-year retention capability for audit logs, which meets the compliance regulation requirement. Additionally, it offers faster, historical searches through features like high-bandwidth access to the Audit Log Search API and intelligent insights, enabling efficient querying of large volumes of audit data. Standard Audit only retains logs for 90 days by default and lacks the performance optimizations for historical searches.

Exam trap

The trap here is that candidates confuse the 90-day default retention of Audit (Standard) with the 2-year requirement, or mistakenly think Data Lifecycle Management or eDiscovery can fulfill audit log retention and search needs, when only Audit (Premium) combines long-term retention with high-performance historical search capabilities.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Audit (Standard) retains audit logs for only 90 days by default (extendable to 1 year with manual configuration), not the required 2 years, and does not provide the enhanced search performance for historical data. Option C is wrong because Microsoft Purview Data Lifecycle Management focuses on retention and deletion policies for content (e.g., documents, emails) based on labels, not on auditing user and admin activity logs or enabling faster historical searches. Option D is wrong because Microsoft Purview eDiscovery (Premium) is designed for legal investigations and content search across Exchange, SharePoint, and Teams, not for long-term retention and high-performance querying of audit logs.

Practice this question →

263

MCQmedium

A healthcare organization must comply with HIPAA regulations. They need to automatically detect and classify sensitive health information such as medical record numbers stored in SharePoint Online and OneDrive. When detected, the solution should apply encryption and restrict access to only authorized personnel. Which Microsoft Purview solution should they configure?

A.Information Protection

B.Data Lifecycle Management

C.Audit

D.eDiscovery

AnswerA

Microsoft Purview Information Protection (MIP) is the correct solution because it enables organizations to discover, classify, label, and protect sensitive data, including Protected Health Information (PHI) relevant to HIPAA. Sensitivity labels can be applied manually or automatically based on content inspection (e.g., detecting medical record numbers or other sensitive info types), enforcing encryption, visual markings, and access restrictions. This ensures that data is protected at rest and in transit, aligning directly with HIPAA's security rule requirements for safeguarding electronic PHI.

Why this answer

Microsoft Purview Information Protection (specifically sensitivity labels and auto-labeling policies) can automatically detect sensitive health information like medical record numbers using built-in sensitive information types (e.g., U.S. HIPAA-defined types). When detected, it can apply encryption via Rights Management and restrict access to authorized personnel, meeting HIPAA compliance requirements.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (retention/deletion) with Information Protection (classification/encryption), or assume Audit/eDiscovery can enforce access controls, when they only provide logging or search capabilities.

Why the other options are wrong

Data Lifecycle Management focuses on retaining or deleting data based on policies (e.g., retention labels), not on detecting, classifying, or protecting sensitive health information like medical record numbers.

Audit logs user and admin activities but does not detect, classify, or protect sensitive data like medical records. The question requires automatic detection, classification, encryption, and access restriction, which are capabilities of Information Protection, not Audit.

eDiscovery is used for searching and exporting content for legal or investigative purposes, not for automatically detecting, classifying, and protecting sensitive data like medical records.

Practice this question →

264

MCQeasy

Your company needs to detect and prevent employees from sharing confidential product plans via email with external parties. Which Microsoft Purview solution should you configure?

A.Sensitivity labels

B.Communication compliance

C.Data Loss Prevention (DLP)

D.Retention policies

AnswerC

Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and automatically protect sensitive information across various locations, including endpoints, cloud apps, and services like Exchange, SharePoint, and OneDrive. By detecting specific sensitive information types or content, DLP can actively block sharing, encrypt data, or notify users and administrators in real-time. This direct enforcement capability is crucial for preventing unauthorized data exfiltration or sharing.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive information, such as confidential product plans, via email and other channels. DLP policies can inspect email content and attachments for sensitive data types (e.g., custom keywords or patterns) and automatically block or quarantine the message if it is sent to external recipients. This aligns directly with the requirement to prevent employees from sharing confidential plans externally.

Exam trap

The trap here is that candidates often confuse sensitivity labels (which apply protection at rest) with DLP (which enforces actions in transit), leading them to select sensitivity labels when the question explicitly requires detection and prevention of sharing via email.

How to eliminate wrong answers

Option A is wrong because sensitivity labels classify and protect data by applying encryption or visual markings, but they do not actively monitor or block the transmission of data in transit like email. Option B is wrong because communication compliance focuses on detecting policy violations (e.g., harassment or insider trading) in communications, not on preventing the sharing of specific confidential data via DLP rules. Option D is wrong because retention policies manage how long data is kept or deleted, not how it is shared or blocked from external transmission.

Practice this question →

265

MCQhard

Refer to the exhibit. You are a compliance administrator managing a DLP policy in Microsoft Purview. The policy is set to 'enforce' mode but you notice that internal users can still share credit card numbers via email to external recipients. What is the most likely cause?

A.The policy is in test mode, not enforce mode

B.The policy is not applied to the user's mailbox

C.The condition requires a minimum count of 5

D.The action only blocks access to the content from external users, not sharing by internal users

AnswerD

The action "blockOnlyExternal" specifically prevents external users from accessing content that contains sensitive information, but it does not prevent internal users from initially sharing or sending that content to external recipients. While external access to the shared content might be blocked, the internal user successfully initiated the sharing action. This distinction is crucial because the policy allows the internal user to perform the outbound sharing, even if the external recipient cannot ultimately view the sensitive data within the shared item.

Why this answer

A DLP policy in 'enforce' mode can still allow internal users to share sensitive data if the policy action is configured to 'block access to content from external users' rather than 'block sharing by internal users'. In Microsoft Purview, the 'block access' action restricts external recipients from viewing the content but does not prevent the internal sender from transmitting the email. To stop internal users from sending, the policy must use the 'block sending' action, which prevents the message from being delivered.

Exam trap

The trap here is that candidates assume 'enforce' mode means all sharing is blocked, but they overlook that the action type (block access vs. block sending) determines whether internal users can still send the data externally.

How to eliminate wrong answers

Option A is wrong because the question explicitly states the policy is set to 'enforce' mode, not test mode, so test mode is not the cause. Option B is wrong because DLP policies in Microsoft Purview are applied at the scope of the policy (e.g., Exchange, SharePoint, OneDrive) and do not require individual mailbox assignment; if the policy is scoped to Exchange, it applies to all mailboxes in the organization by default. Option C is wrong because a minimum count condition (e.g., 5 credit card numbers) would only reduce false positives by requiring a threshold to trigger the policy; if the user shares fewer than 5 numbers, the policy would not act, but the question implies sharing is occurring and the policy is not blocking it, so the issue is the action type, not the condition threshold.

Practice this question →

266

MCQeasy

A company wants to automatically prevent users from sharing files containing personal data (e.g., passport numbers) via email. Which Microsoft Purview solution should they configure?

A.Communication Compliance

B.Data Loss Prevention (DLP)

C.Sensitivity labels

D.eDiscovery

AnswerB

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including cloud services, endpoints, and on-premises. DLP can detect specific sensitive data types, such as credit card numbers or personally identifiable information (PII), and enforce rules to prevent sharing, copying, or transferring this data outside defined organizational boundaries. It directly fulfills the requirement to automatically block sharing actions based on content.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block the sharing of sensitive information, such as passport numbers, via email. DLP policies use deep content analysis (e.g., regular expressions, keyword matching, and data classification) to inspect email attachments and body text in transit, and can enforce actions like blocking the message or sending a policy tip to the user. This aligns directly with the requirement to prevent users from sharing files containing personal data through email.

Exam trap

The trap here is that candidates often confuse Communication Compliance with DLP because both involve monitoring communications, but Communication Compliance is for auditing and review, not for automatic blocking of sensitive data in transit.

How to eliminate wrong answers

Option A is wrong because Communication Compliance is focused on monitoring and reviewing internal and external communications for policy violations (e.g., harassment, insider trading), not on automatically blocking data sharing based on content patterns like passport numbers. Option C is wrong because Sensitivity labels are classification and protection tools that apply markings and encryption to documents and emails, but they do not automatically inspect and block content in transit; they rely on users or automated labeling policies to apply labels, and blocking requires integration with DLP. Option D is wrong because eDiscovery is used for identifying, preserving, and exporting electronic data for legal or investigative purposes, not for real-time prevention of data sharing via email.

Practice this question →

267

MCQmedium

A multinational organization uses Microsoft 365 and must demonstrate compliance with both GDPR and ISO 27001. The compliance team needs a centralized tool to assess their current compliance posture against these frameworks, receive prioritized improvement actions, and track the implementation of those actions over time. Which Microsoft Purview solution should they use?

A.Compliance Manager

B.Data Lifecycle Management

C.Audit

D.eDiscovery

AnswerA

Compliance Manager provides a central dashboard to assess compliance posture, manage improvement actions, and track progress against multiple regulations like GDPR and ISO 27001.

Why this answer

Compliance Manager is the correct solution because it provides a centralized dashboard that assesses an organization's compliance posture against frameworks like GDPR and ISO 27001. It offers prioritized improvement actions based on built-in assessments and tracks the implementation of those actions over time, directly meeting the requirements for a unified compliance management tool.

Exam trap

The trap here is that candidates may confuse Audit or Data Lifecycle Management as compliance tools, but they lack the centralized assessment and action tracking capabilities that Compliance Manager uniquely provides for framework-specific compliance management.

Why the other options are wrong

Data Lifecycle Management focuses on governing data retention and deletion policies, not on assessing compliance posture against frameworks like GDPR and ISO 27001 or tracking improvement actions.

Audit is used for investigating specific security or compliance events by searching the unified audit log, not for assessing compliance posture against frameworks like GDPR and ISO 27001 or tracking improvement actions.

eDiscovery is used for identifying and preserving electronic content for legal cases, not for assessing compliance posture against frameworks like GDPR and ISO 27001 or tracking improvement actions.

Practice this question →

268

MCQmedium

A multinational corporation must comply with several regulations including GDPR, ISO 27001, and NIST. They need a single solution that provides a compliance score, tracks their progress, and recommends specific improvement actions that can be assigned to different departments. Which Microsoft Purview solution meets these requirements?

A.A

B.B

C.C

D.D

AnswerA

Microsoft Purview Compliance Manager is the correct solution as it provides a comprehensive dashboard to assess and manage an organization's compliance posture against various regulatory standards and industry benchmarks. It offers a real-time compliance score, recommended improvement actions, and the ability to assign and track tasks to address identified gaps. This tool is specifically designed to help multinational corporations navigate complex regulatory landscapes by simplifying compliance management and demonstrating adherence.

Why this answer

Microsoft Purview Compliance Manager provides a unified compliance score, tracks progress over time, and offers recommended improvement actions that can be assigned to specific departments. It supports multiple regulations like GDPR, ISO 27001, and NIST by mapping controls to these frameworks, making it the correct solution for the multinational corporation's needs.

Exam trap

The trap here is that candidates may confuse Compliance Manager with other Purview solutions like Audit or eDiscovery, which address different compliance needs (logging vs. scoring), but only Compliance Manager provides a centralized score and assignable improvement actions.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview Audit (Standard or Premium) is focused on logging and investigating user and admin activity, not on providing a compliance score or tracking improvement actions. Option C is wrong because Microsoft Purview eDiscovery is designed for identifying, collecting, and exporting content for legal or investigative purposes, not for compliance scoring or action assignment. Option D is wrong because Microsoft Purview Data Lifecycle Management (formerly Records Management) handles retention and deletion policies, not compliance scoring or improvement recommendations.

Practice this question →

269

MCQhard

A healthcare organization must comply with HIPAA. They need to automatically detect protected health information (PHI) in emails sent from Exchange Online, prevent users from sharing these emails with unauthorized external recipients, and apply a retention label that retains PHI emails for six years. Which Microsoft Purview solution should they configure?

A.Microsoft Purview Information Protection and Data Loss Prevention

B.Microsoft Purview eDiscovery

C.Microsoft Purview Communication Compliance

D.Microsoft Purview Insider Risk Management

AnswerA

Microsoft Purview Information Protection enables organizations to discover, classify, and protect sensitive data like Protected Health Information (PHI) through sensitivity labels, which can automatically apply encryption or visual markings. Concurrently, Microsoft Purview Data Loss Prevention (DLP) policies leverage these classifications to detect and prevent unauthorized sharing or transfer of PHI across various locations, including email, SharePoint, and Teams. This combined approach ensures data is appropriately handled, retained, and safeguarded against exfiltration, directly addressing HIPAA's privacy and security requirements.

Why this answer

Microsoft Purview Information Protection and Data Loss Prevention (DLP) is the correct solution because it combines sensitive data classification (to detect PHI via built-in HIPAA data classifiers) with policy-based enforcement (to block sharing with unauthorized external recipients) and can automatically apply a retention label (via auto-labeling policies) to retain PHI emails for six years. This directly addresses all three requirements: detection, prevention, and retention.

Exam trap

The trap here is that candidates may confuse Communication Compliance (which monitors for policy violations) with DLP (which enforces data protection actions), or assume eDiscovery handles retention and blocking, when in fact DLP is the only solution that combines detection, prevention, and retention label application in a single policy.

How to eliminate wrong answers

Option B is wrong because Microsoft Purview eDiscovery is used for searching, holding, and exporting content for legal or investigative purposes, not for real-time detection or prevention of data sharing. Option C is wrong because Microsoft Purview Communication Compliance is designed to detect policy violations in communications (e.g., harassment, insider trading) and does not natively enforce DLP actions like blocking external sharing or applying retention labels. Option D is wrong because Microsoft Purview Insider Risk Management focuses on identifying risky user activities (e.g., data theft, sabotage) through behavioral analytics, not on automatically detecting PHI in emails or preventing external sharing.

Practice this question →

270

MCQmedium

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy configuration for a compliance team. What is the effect of this policy?

A.The policy blocks access but allows users to override with a justification

B.The policy automatically applies encryption to the content

C.The policy sends a notification but does not block access

D.The policy automatically blocks access without user override

AnswerA

This policy action, often referred to as 'Block with override' in Microsoft Purview Data Loss Prevention (DLP) configurations, is designed to prevent sensitive data from being shared inappropriately. However, it provides a crucial flexibility: users are prompted to provide a business justification if they believe their action is legitimate, allowing them to bypass the block. This approach balances stringent data protection with operational continuity, empowering users to make informed decisions when necessary.

Why this answer

The policy includes a BlockAccess action with behavior set to BlockWithOverride, meaning the action is blocked by default but the user can override with a business justification. Additionally, the NotifyUser action sends a custom notification to the user. This matches Option A.

Option B is incorrect because there is no encryption action configured. Option C is incorrect because the policy does block access (with override), not just send a notification. Option D is incorrect because the policy allows user override, so it does not automatically block without override.

Practice this question →

271

MCQeasy

A company has a SharePoint Online site that stores project documents. Due to legal requirements, all documents in this site must be retained for exactly 5 years from the date they were created, and then automatically deleted. No user should be able to permanently delete a document before the retention period ends. Which Microsoft Purview solution should the administrator configure?

A.Retention policy

B.Sensitivity label

C.Data loss prevention (DLP) policy

D.Audit policy

AnswerA

A retention policy in Microsoft Purview allows administrators to set a retention period (e.g., 5 years) and an action (such as automatic deletion) for content in SharePoint sites. Users cannot permanently delete the content until the retention period expires.

Why this answer

A retention policy in Microsoft Purview can be configured to retain documents for exactly 5 years from creation and then automatically delete them. This policy enforces a mandatory retention period that prevents users from permanently deleting documents before the period ends, meeting the legal requirement.

Exam trap

The trap here is that candidates may confuse a retention policy with a sensitivity label or DLP policy, mistakenly thinking those can enforce time-based retention and deletion, when only a retention policy provides the necessary preservation lock and automatic deletion capabilities.

How to eliminate wrong answers

Option B is wrong because sensitivity labels classify and protect data based on sensitivity (e.g., encryption, markings), but they do not enforce time-based retention or automatic deletion. Option C is wrong because a Data Loss Prevention (DLP) policy detects and prevents accidental sharing of sensitive data, but it cannot enforce a fixed retention period or block permanent deletion. Option D is wrong because an audit policy logs user activities (e.g., deletions) for investigation, but it does not prevent deletion or enforce retention.

Practice this question →

272

MCQmedium

A company needs to ensure that employees cannot share sensitive financial reports with external parties via email. They want to automatically detect and block emails that contain the phrase 'Confidential-Financial' in the subject line or body, regardless of the recipient's domain. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP)

B.Information Protection (sensitivity labels)

C.Data Lifecycle Management (retention policies)

D.Audit

AnswerA

DLP policies can be configured to detect custom phrases in emails and automatically block the email from being sent, protecting sensitive data from unauthorized sharing.

Why this answer

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block sensitive content—such as the phrase 'Confidential-Financial'—in emails, regardless of the recipient's domain. DLP policies can inspect subject lines and body text, then enforce actions like blocking delivery or notifying the user, making it ideal for preventing unauthorized external sharing of financial reports.

Exam trap

The trap here is that candidates confuse Information Protection (sensitivity labels) with DLP, thinking labels alone can block emails, but labels only classify and encrypt—blocking requires a DLP policy to enforce actions based on label conditions or content matches.

How to eliminate wrong answers

Option B (Information Protection/sensitivity labels) is wrong because sensitivity labels classify and protect data by applying encryption or visual markings, but they do not automatically detect and block emails based on content patterns like a specific phrase; they require manual or automated labeling and rely on DLP to enforce blocking actions. Option C (Data Lifecycle Management/retention policies) is wrong because retention policies govern how long data is kept or when it is deleted, not real-time detection and blocking of sensitive content in transit. Option D (Audit) is wrong because auditing logs user activities for review but does not actively detect or block emails; it is a detective control, not a preventive one.

Practice this question →

273

MCQeasy

A company uses Microsoft 365. The compliance team needs to create a policy that automatically blocks outgoing emails that contain personally identifiable information (PII) such as social security numbers. However, they want to allow users to override the block with a business justification if necessary. Which Microsoft Purview solution should they configure?

A.Data Loss Prevention (DLP)

B.Communication Compliance

C.Records Management

D.Audit

AnswerA

Data Loss Prevention (DLP) in Microsoft 365 is specifically designed to identify, monitor, and protect sensitive information across various locations, including email, SharePoint, and OneDrive. It uses sensitive information types (SITs) to detect data like credit card numbers or PII, allowing organizations to define policies that block sharing, encrypt content, or notify users and administrators. This capability directly addresses the need to prevent accidental or malicious sharing of sensitive data, often providing user override options for legitimate business cases.

Why this answer

Data Loss Prevention (DLP) in Microsoft Purview is designed to detect and protect sensitive information, such as social security numbers, by automatically blocking outgoing emails that contain PII. DLP policies support user override with a business justification through policy tips and allow overrides, enabling compliance teams to balance security with business needs.

Exam trap

The trap here is that candidates confuse Communication Compliance with DLP because both involve monitoring communications, but Communication Compliance is for policy violations and insider risk, not for automated blocking of sensitive data with user overrides.

Why the other options are wrong

Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, insider trading), not to automatically block outgoing emails containing PII with user override capabilities.

Records Management focuses on managing retention, disposition, and classification of records, not on preventing data leakage via email. It does not provide the ability to block outgoing emails containing PII or allow user overrides.

Audit in Microsoft Purview is used for logging and reviewing user and admin activities, not for creating policies that block or allow emails based on content like PII.

Practice this question →

274

MCQmedium

A user reports that a sensitive document labeled 'Highly Confidential' was accidentally shared with an external vendor. You need to investigate how the sharing occurred. Which two Microsoft Purview tools should you use together?

A.Audit (Standard) and Content Explorer

B.Insider Risk Management and Information Barriers

C.eDiscovery (Premium) and Communication Compliance

D.Data Loss Prevention and Sensitivity labels

E.Records Management and Data Lifecycle Management

AnswerA

Audit (Standard) logs all user and admin activities across Microsoft 365 services, including file sharing events, access, and modifications, providing a historical record of who shared the document and when. Content Explorer, part of Microsoft Purview data classification, allows security administrators to visualize and locate sensitive information across SharePoint, OneDrive, and Exchange, showing the document's current location, sensitivity labels, and other metadata, which helps confirm its status and context post-sharing.

Why this answer

Audit (Standard) logs all user activities, including sharing events, while Content Explorer shows where sensitive documents with specific sensitivity labels (like 'Highly Confidential') are stored and who has accessed them. Together, they allow you to trace the exact sharing action and identify the document's location and exposure.

Exam trap

The trap here is that candidates confuse 'investigating how sharing occurred' with 'preventing sharing' (DLP) or 'monitoring communications' (Communication Compliance), but the question specifically asks for forensic investigation tools, which require an audit trail and content visibility.

How to eliminate wrong answers

Option B is wrong because Insider Risk Management detects risky user behaviors (e.g., data exfiltration) but does not provide a direct audit trail of a specific sharing event, and Information Barriers prevent communication between groups but do not investigate past sharing. Option C is wrong because eDiscovery (Premium) is for legal discovery and content search, not real-time sharing investigation, and Communication Compliance monitors communications (e.g., email, Teams) for policy violations, not document sharing events. Option D is wrong because Data Loss Prevention (DLP) policies can block or alert on sharing but do not provide a historical audit log of who shared what; Sensitivity labels classify data but do not log sharing actions.

Option E is wrong because Records Management governs retention and disposition of records, and Data Lifecycle Management manages data retention policies—neither tool audits user sharing activities.

Practice this question →

275

MCQmedium

A company needs to retain all customer emails for 7 years for regulatory compliance. After 7 years, they must be permanently deleted. They also need a legal hold for an ongoing investigation. Which Microsoft Purview solution should they use for the retention and deletion requirement?

A.Data Lifecycle Management

B.Records Management

C.Compliance Manager

D.eDiscovery

AnswerA

Data Lifecycle Management (DLM), specifically through Microsoft 365 retention policies, is designed to automatically manage content throughout its lifecycle. These policies can be configured to retain emails for a specified duration, such as seven years, to meet regulatory compliance requirements. After the retention period expires, DLM policies can then automatically initiate the deletion of that content, ensuring compliance with both retention and disposal obligations without manual intervention. This directly addresses the need for automatic retention and subsequent deletion of customer emails.

Why this answer

Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution because it allows you to define retention policies that automatically retain customer emails for a specified period (7 years) and then permanently delete them. This directly addresses the regulatory compliance requirement for retention and deletion without manual intervention.

Exam trap

The trap here is that candidates often confuse Records Management with Data Lifecycle Management, thinking that 'records' implies retention and deletion, but Records Management is specifically for declaring items as records with immutable preservation, not for automated lifecycle-based retention and deletion.

How to eliminate wrong answers

Option B (Records Management) is wrong because it focuses on declaring records for long-term preservation and disposition, not on automated lifecycle-based retention and deletion for compliance; it is more about managing records as evidence. Option C (Compliance Manager) is wrong because it is a risk assessment and compliance score tool that helps track compliance posture, not a solution for implementing data retention or deletion policies. Option D (eDiscovery) is wrong because it is used for searching and exporting content for legal investigations, not for setting retention or deletion rules; it can place holds but does not manage lifecycle deletion.

Practice this question →

276

MCQmedium

A company must retain all vendor contracts for 10 years to meet regulatory requirements. After 10 years, the contracts must be permanently destroyed with no possibility of recovery. The compliance team wants to automate this lifecycle and ensure that during the retention period, the contracts cannot be edited or deleted by users. Which Microsoft Purview solution should they use?

A.Data Lifecycle Management (DLM)

B.Records Management

C.eDiscovery (Premium)

D.Sensitivity Labels

AnswerB

Microsoft Purview Records Management is specifically designed for regulatory, legal, and business-critical recordkeeping, ensuring content immutability. It utilizes retention labels to classify items as records, which prevents their modification or deletion for a specified period, such as 10 years for vendor contracts. This capability is crucial for meeting strict retention requirements and supporting automated disposition reviews, ensuring compliance with organizational and legal obligations.

Why this answer

Records Management in Microsoft Purview is designed to declare records (regulatory or legal) that must be retained for a specific period and then disposed of in a compliant manner. It enforces immutability during the retention period—users cannot edit or delete records—and supports a disposition review or automatic permanent deletion after the retention period ends, exactly matching the requirement for 10-year retention followed by destruction with no recovery.

Exam trap

Microsoft often tests the distinction between Data Lifecycle Management (which manages non-record content) and Records Management (which enforces immutability and disposition for regulatory records), so the trap here is assuming DLM can provide the required edit/delete prevention and automatic destruction, when only Records Management offers those capabilities.

Why the other options are wrong

Data Lifecycle Management (DLM) manages retention and deletion of data but does not enforce immutability or prevent users from editing/deleting records during the retention period. The question requires that contracts cannot be edited or deleted, which is a records management feature.

Practice this question →

277

MCQhard

A large enterprise is concerned about insider threats. The compliance team needs to detect and investigate potential data theft scenarios, such as when employees nearing their resignation date suddenly copy large amounts of sensitive data to USB drives or email confidential files to personal accounts. They require a solution that uses machine learning to identify risky activities and create alerts for investigation. Which Microsoft Purview solution should they deploy?

A.Data Lifecycle Management

B.Audit (Premium)

C.Insider Risk Management

D.Compliance Manager

AnswerC

Insider Risk Management uses machine learning to detect, investigate, and act on insider threats based on behavioral patterns.

Why this answer

Insider Risk Management is the correct solution because it uses machine learning to correlate signals from user activities (e.g., copying files to USB, emailing to personal accounts) with contextual indicators like resignation dates, enabling detection of potential data theft scenarios. It provides built-in alerting and investigation workflows specifically designed for insider threat use cases, unlike the other options which focus on retention, auditing, or compliance posture.

Exam trap

The trap here is that candidates often confuse Audit (Premium) with a detection solution, but Audit is purely a logging and search tool, not a proactive ML-based risk detection system like Insider Risk Management.

Why the other options are wrong

Data Lifecycle Management focuses on governing data retention and deletion policies, not on detecting insider threats or risky user behavior using machine learning.

Compliance Manager is a risk assessment tool that helps organizations evaluate their compliance posture against regulations, not a solution for detecting insider threats via machine learning on user activities.

Practice this question →

278

MCQhard

Refer to the exhibit. A sensitivity label is configured as shown. A user applies the parent label to a document containing credit card numbers. What is the expected behavior?

A.The document gets the parent label's header and the sublabel's encryption and watermark

B.The document gets no protection because credit card numbers are only detected by auto-labeling

C.The document gets the parent label's encryption (ViewOnly) and header, but no watermark

D.The document gets the parent label's encryption and header, and auto-labeling applies the sublabel

AnswerC

When a user manually applies a parent sensitivity label, the document inherits all the protection settings directly configured on that specific parent label. This includes the specified encryption (e.g., ViewOnly) and any content markings like a header. Since the parent label itself does not have a watermark configured, and sublabels are not automatically applied, the document will not receive a watermark, even if a sublabel has one.

Why this answer

When a user manually applies a parent sensitivity label that has sublabels, only the parent label's settings (encryption and header) are applied. The sublabel's watermark is not applied because sublabels are separate entities that must be explicitly selected; they are not automatically inherited or triggered by applying the parent label. The encryption (ViewOnly) and header come from the parent label's configuration, while the watermark belongs to the sublabel and is not applied.

Exam trap

The trap here is that candidates assume applying a parent label automatically cascades its settings to or includes its sublabels, but in reality, sublabels are separate labels that must be explicitly chosen, and no inheritance or automatic application occurs between parent and sublabels.

How to eliminate wrong answers

Option A is wrong because applying the parent label does not automatically apply the sublabel's encryption and watermark; sublabels must be manually selected by the user. Option B is wrong because credit card numbers are detected by auto-labeling, but the question states the user manually applies the parent label, so auto-labeling is not triggered; manual application applies the label's configured protections regardless of content detection. Option D is wrong because auto-labeling does not apply the sublabel when the parent label is manually applied; auto-labeling is a separate process that can apply labels based on sensitive content, but it does not automatically apply sublabels of a manually applied parent label.

Practice this question →

279

MCQeasy

A company wants to create a sensitivity label called 'Highly Confidential' in Microsoft 365. When applied to a document, the label should automatically encrypt the document and restrict access to employees in the finance department only. Which Microsoft Purview solution should the administrator use to configure this label?

A.Microsoft Purview Data Lifecycle Management

B.Microsoft Purview Information Protection

C.Microsoft Purview Compliance Manager

D.Microsoft Purview Audit

AnswerB

Microsoft Purview Information Protection is the correct service for creating and managing sensitivity labels, which classify and protect sensitive data. These labels can be configured to apply encryption, visual markings like headers or footers, and granular access restrictions to content, regardless of where it is stored or shared. This comprehensive approach ensures that sensitive information remains protected throughout its lifecycle, aligning with data governance policies.

Why this answer

Microsoft Purview Information Protection is the correct solution because it provides the ability to create and configure sensitivity labels that enforce protection actions such as encryption and access restrictions. When a 'Highly Confidential' label is applied, it can automatically encrypt the document using Azure Rights Management (Azure RMS) and restrict access to only members of the finance department via a defined permission policy.

Exam trap

The trap here is that candidates often confuse Microsoft Purview Information Protection with Data Lifecycle Management, mistakenly thinking retention labels can enforce encryption, when in fact only sensitivity labels can apply protection actions like encryption and access control.

How to eliminate wrong answers

Option A is wrong because Microsoft Purview Data Lifecycle Management (formerly Data Lifecycle Management) focuses on retaining, deleting, and managing data based on retention policies and labels, not on applying encryption or access control. Option C is wrong because Microsoft Purview Compliance Manager is a risk assessment and compliance scoring tool that helps manage compliance posture, not a tool for configuring sensitivity labels or encryption. Option D is wrong because Microsoft Purview Audit provides auditing and logging of user and admin activities, not the ability to create or apply sensitivity labels with encryption and access restrictions.

Practice this question →

280

MCQmedium

A company must retain all customer contracts for 10 years to comply with industry regulations. After 10 years, the contracts must be permanently deleted. Which Microsoft Purview solution should be used to automate this process?

A.Data Loss Prevention (DLP)

B.Data Lifecycle Management

C.eDiscovery

D.Information Protection

AnswerB

Data Lifecycle Management (DLM) in Microsoft 365 utilizes retention labels and policies to govern the entire lifecycle of data, from creation to deletion. It enables organizations to define specific retention periods, such as 10 years for customer contracts, ensuring compliance with legal or regulatory obligations. After the retention period expires, DLM policies can automatically dispose of the data, streamlining information governance and reducing risk.

Why this answer

Data Lifecycle Management (DLM) in Microsoft Purview is the correct solution because it allows you to define retention labels and policies that automatically retain contracts for a specified period (10 years) and then trigger a permanent deletion disposition review or direct deletion. This aligns directly with the regulatory requirement to retain data for a fixed duration and then dispose of it securely.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management with Data Loss Prevention, mistakenly thinking DLP can delete data after a period, when DLP only blocks or alerts on data exfiltration, not manage retention schedules.

Why the other options are wrong

Data Loss Prevention (DLP) is designed to prevent accidental sharing or leakage of sensitive data, not to automate retention and deletion of records based on a fixed time period.

Information Protection focuses on classifying, labeling, and protecting sensitive data (e.g., encryption, rights management), not on automated retention and deletion schedules. The requirement to retain and then delete contracts after 10 years is a lifecycle management task, not a protection task.

Practice this question →

281

MCQeasy

A compliance administrator creates the above custom sensitive information type for detecting social security numbers (SSNs). What is required for a document to be classified as containing an SSN?

A.The document must contain either the SSN regex or a keyword

B.The document must contain the SSN regex with high confidence level

C.The document must contain a pattern matching the SSN regex and at least two keywords

D.The document must contain a pattern matching the SSN regex and at least one keyword

AnswerD

This option accurately describes the conditions for a match. The custom sensitive information type (SIT) rule is configured with a logical AND operator, requiring both the detection of a pattern matching the Social Security Number (SSN) regular expression and the presence of associated keywords. Specifically, the `minMatches=1` setting for the keyword component means that at least one keyword must be found in proximity to the SSN pattern to trigger a successful detection.

Why this answer

A custom sensitive information type in Microsoft Purview uses a primary element (the SSN regex pattern) and requires at least one supporting element (a keyword) to trigger a match. This ensures that the document is not falsely classified by the regex alone, which could match random number sequences. The compliance administrator configured the type with a minimum count of one keyword as a proximity requirement, so the document must contain both the regex pattern and at least one keyword.

Exam trap

The trap here is that candidates confuse the confidence level (which is a calculated percentage) with the required matching criteria (regex plus keywords), leading them to select Option B, which incorrectly implies that high confidence alone is sufficient without the keyword requirement.

How to eliminate wrong answers

Option A is wrong because requiring either the SSN regex or a keyword would allow classification based solely on a keyword without any number pattern, which defeats the purpose of detecting SSNs. Option B is wrong because 'high confidence level' is a separate confidence setting (e.g., 85% or higher) that can be configured, but the question asks what is required for classification—not the confidence threshold; the requirement is the regex plus keywords, not just the regex with high confidence. Option C is wrong because the custom sensitive information type was created with a minimum count of one keyword, not two; requiring at least two keywords would be an incorrect interpretation of the proximity and count settings.

Practice this question →

282

MCQhard

Your organization uses Microsoft Purview for data governance. You need to ensure that when a user marks an email as 'Confidential' using a sensitivity label, the email is automatically encrypted and cannot be forwarded. What configuration is required?

A.Configure the sensitivity label with encryption and a rights management template that prohibits forwarding

B.Create a DLP policy that detects the 'Confidential' label and applies encryption

C.Use the Azure Information Protection unified labeling scanner

D.Apply a retention label that triggers encryption

AnswerA

Sensitivity labels are designed to classify and protect data directly at the point of creation or modification. By configuring a sensitivity label with encryption, it applies Azure Rights Management (Azure RMS) protection to the content. This protection can include specific usage rights, such as "Do Not Forward," which prevents recipients from forwarding, printing, or copying the protected email or document, ensuring the data remains within its intended scope. This method directly embeds the protection into the content, making it persistent wherever the data travels.

Why this answer

Microsoft Purview sensitivity labels can be configured with encryption settings that use Azure Rights Management (Azure RMS) to enforce usage restrictions. By selecting the 'Do Not Forward' template, the email is automatically encrypted and the recipient cannot forward, copy, or print the message, meeting the requirement.

Exam trap

The trap here is that candidates often confuse the role of DLP policies with sensitivity labels, assuming DLP can enforce encryption, when in fact encryption is a native capability of sensitivity labels using Azure RMS templates.

How to eliminate wrong answers

Option B is wrong because a Data Loss Prevention (DLP) policy can detect sensitivity labels and trigger actions like blocking or warning, but it cannot directly apply encryption to emails; encryption is a property of the sensitivity label itself, not a DLP action. Option C is wrong because the Azure Information Protection unified labeling scanner is used for discovering, classifying, and labeling files on-premises, not for configuring encryption on emails sent from Exchange Online. Option D is wrong because retention labels are designed to manage data lifecycle and retention, not to apply encryption or rights protection; they do not enforce 'Do Not Forward' restrictions.

Practice this question →

283

MCQhard

A company's security team needs to detect and investigate potential data theft by employees who have legitimate access to sensitive data. They want a solution that uses heuristics and behavioral analytics to identify risky user actions such as data exfiltration to personal cloud storage. Which Microsoft Purview solution should they use?

A.Microsoft Purview Data Loss Prevention (DLP)

B.Microsoft Purview Insider Risk Management

C.Microsoft Purview Audit (Standard)

D.Microsoft Purview Information Barriers

AnswerB

Microsoft Purview Insider Risk Management is the correct solution as it specifically leverages built-in risk indicators, machine learning, and behavioral analytics to identify and investigate potential insider risks, including data theft. It correlates various user activities across Microsoft 365 services to detect unusual patterns, enabling security teams to proactively identify, analyze, and respond to incidents.

Why this answer

Microsoft Purview Insider Risk Management is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that may lead to data theft, using heuristics and behavioral analytics. It correlates signals from Microsoft 365 and Azure services to identify patterns like data exfiltration to personal cloud storage, which aligns directly with the scenario's requirements.

Exam trap

The trap here is that candidates often confuse the reactive, policy-based enforcement of Data Loss Prevention (DLP) with the proactive, behavioral detection of Insider Risk Management, assuming DLP can detect risky user actions when it actually only blocks or alerts on content matching static rules.

Why the other options are wrong

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent accidental or unauthorized sharing of sensitive data by enforcing policies, but it does not use heuristics and behavioral analytics to detect risky user actions like data exfiltration by insiders.

Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest, not to detect or investigate data theft by employees with legitimate access.

Practice this question →

284

MCQmedium

Your company uses Microsoft Purview Data Lifecycle Management. You need to ensure that emails in users' mailboxes are retained for 7 years for compliance, but users should be able to delete emails they no longer need before that period. Which configuration achieves this?

A.Configure a Data Loss Prevention policy

B.Place a litigation hold on the mailboxes

C.Apply a retention label with record locking

D.Apply a retention policy without a preservation lock

AnswerD

Applying a retention policy without a preservation lock allows users to delete items from their primary view within applications like Outlook or SharePoint. However, the retention policy ensures that a copy of the deleted item is moved to a secure, hidden location (e.g., the Recoverable Items folder for Exchange, or the Preservation Hold library for SharePoint/OneDrive) and retained for the policy's duration. This mechanism precisely meets the requirement of allowing user deletion while guaranteeing the item remains discoverable and recoverable by administrators.

Why this answer

A retention policy without a preservation lock (Option D) allows you to define a retention period (7 years) for emails while still permitting users to delete items before that period ends. When a user deletes an email, it is moved to the Recoverable Items folder and retained for the remainder of the 7-year period, after which it is permanently deleted. This meets the compliance requirement without preventing user deletion.

Exam trap

The trap here is that candidates often confuse retention policies with holds or labels, assuming that any retention mechanism must block user deletion, but a retention policy without a preservation lock allows deletion while still retaining the data in the background.

How to eliminate wrong answers

Option A is wrong because a Data Loss Prevention (DLP) policy is designed to prevent sensitive data from being shared or leaked, not to retain emails for a fixed period. Option B is wrong because a litigation hold preserves all mailbox content indefinitely (or until the hold is removed) and does not allow users to delete emails before the retention period expires. Option C is wrong because a retention label with record locking marks items as records, preventing users from deleting or modifying them, which contradicts the requirement that users should be able to delete emails they no longer need.

Practice this question →

285

MCQmedium

A company is involved in a legal dispute and must preserve all emails and documents related to the case. The legal team needs to identify specific custodians (employees) and place a hold on their Exchange Online mailboxes and SharePoint sites to prevent any deletion or alteration of relevant content. Additionally, they need to collect the preserved data for review and analysis. Which Microsoft Purview solution should they use?

A.Microsoft Purview eDiscovery (Premium)

B.Microsoft Purview Audit

C.Microsoft Purview Data Lifecycle Management

D.Microsoft Purview Communication Compliance

AnswerA

eDiscovery (Premium) provides end-to-end workflow for identifying, preserving, collecting, and reviewing data relevant to legal cases, including placing holds on custodians' data.

Why this answer

Microsoft Purview eDiscovery (Premium) is the correct solution because it provides end-to-end workflow for legal investigations: identifying and placing custodians on hold (via litigation hold on Exchange Online mailboxes and SharePoint sites), preserving content from deletion or alteration, and then collecting, reviewing, and analyzing the preserved data. This directly matches the scenario's requirements for legal hold and data collection for review.

Exam trap

The trap here is confusing the logging/auditing capability (Audit) with the preservation and collection workflow (eDiscovery), or assuming that retention policies (Data Lifecycle Management) can serve as a legal hold, when in fact they are designed for lifecycle management and do not support custodian-based holds or case-specific collection.

How to eliminate wrong answers

Option B (Microsoft Purview Audit) is wrong because it only logs and records user and admin activities (e.g., who accessed or deleted content) but does not place holds on data or allow collection for review. Option C (Microsoft Purview Data Lifecycle Management) is wrong because it focuses on retention and deletion policies based on data lifecycle (e.g., automatically deleting old emails), not on preserving data for a specific legal case or identifying custodians. Option D (Microsoft Purview Communication Compliance) is wrong because it is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading) by analyzing messages, not for legal hold or eDiscovery collection.

Practice this question →

286

Multi-Selectmedium

Which TWO Microsoft Purview solutions can help protect sensitive data in Microsoft Teams?

Select 2 answers

A.Microsoft Purview Insider Risk Management

B.Microsoft Purview Audit

C.Microsoft Purview eDiscovery

D.Microsoft Purview Data Loss Prevention

E.Microsoft Purview Communication Compliance

AnswersD, E

Microsoft Purview Data Loss Prevention (DLP) is a direct data protection solution that identifies, monitors, and automatically protects sensitive information across various locations, including endpoints, cloud apps, and services like Microsoft Teams. By defining policies based on sensitive information types, DLP can prevent the unauthorized sharing, transfer, or use of sensitive data, such as credit card numbers or health records, ensuring it remains within organizational boundaries and complies with regulations. It actively blocks or alerts on policy violations in real-time.

Why this answer

DLP can protect sensitive data shared in Teams, and Communication Compliance can detect inappropriate content. eDiscovery is for searching, not protection. Insider Risk Management is for risky behavior. Audit is for logging.

Practice this question →

287

MCQeasy

A compliance officer needs to search for emails containing trade secrets across all mailboxes in the organization. Which Microsoft Purview solution should they use?

A.eDiscovery (Premium)

B.Communication Compliance

C.Data Loss Prevention

D.Audit (Standard)

AnswerA

eDiscovery (Premium) is the appropriate solution for a compliance officer who needs to search for specific email content across an organization's data. This service in Microsoft Purview enables robust content searches, legal holds, and the collection of electronically stored information (ESI) from various sources like Exchange mailboxes, SharePoint sites, and OneDrive accounts. It is specifically designed for investigative purposes, allowing for advanced querying, review, and export of relevant content.

Why this answer

eDiscovery (Premium) is the correct solution because it is specifically designed for legal and investigative searches across all mailboxes, including the ability to search for specific content like trade secrets using keyword queries and advanced features like predictive coding and review sets. It supports searching across Exchange Online mailboxes, SharePoint sites, and OneDrive for Business, making it ideal for a compliance officer conducting a broad, targeted search for sensitive information.

Exam trap

The trap here is that candidates often confuse Communication Compliance (which monitors for policy violations) with eDiscovery (which performs content searches), leading them to choose B because they think 'compliance' implies searching for trade secrets, but Communication Compliance is reactive and policy-based, not a search tool.

How to eliminate wrong answers

Option B (Communication Compliance) is wrong because it focuses on monitoring and detecting policy violations in communications (e.g., harassment, insider trading) based on configurable policies, not on performing ad-hoc searches for specific content like trade secrets across all mailboxes. Option C (Data Loss Prevention) is wrong because it is designed to prevent accidental or unauthorized sharing of sensitive data through policies that block or warn users in real-time, not to retrospectively search for existing emails containing specific content. Option D (Audit (Standard)) is wrong because it provides logging of user and admin activities (e.g., who accessed a mailbox or deleted an email) but does not allow searching the actual content of emails for specific keywords or phrases.

Practice this question →

288

Multi-Selecteasy

Which TWO Microsoft Purview solutions can be used to identify and protect sensitive data in Microsoft 365?

Select 2 answers

A.Data Loss Prevention (DLP)

B.Communication compliance

C.Insider risk management

D.Sensitivity labels

E.eDiscovery

AnswersA, D

Microsoft Purview Data Loss Prevention (DLP) policies are designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and non-Microsoft cloud apps. DLP utilizes sensitive information types, keywords, and content matching to detect sensitive data, such as credit card numbers or national ID numbers, both at rest and in transit. Upon detection, DLP can block sharing, notify users, or encrypt the content, effectively identifying and protecting the data.

Why this answer

Data Loss Prevention (DLP) is correct because it uses content analysis (e.g., keyword matching, regex patterns, and machine learning classifiers) to detect and automatically protect sensitive data like credit card numbers or PII across Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are correct because they classify and protect data at rest and in transit by applying encryption, visual markings, and access restrictions based on label policies, enabling persistent protection even when data leaves Microsoft 365.

Exam trap

The trap here is that candidates confuse 'identifying and protecting sensitive data' with broader compliance solutions like Communication compliance or Insider risk management, which address behavioral monitoring rather than data classification and protection.

Practice this question →

289

MCQeasy

Your organization needs to automatically detect and prevent accidental sharing of sensitive data in Microsoft Teams messages. Which Microsoft Purview solution should you use?

A.Retention policies

B.Data Loss Prevention (DLP)

C.eDiscovery

D.Sensitivity labels

AnswerB

DLP policies can detect sensitive data in transit and block sharing in Teams messages.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect and prevent accidental sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), in Microsoft Teams messages. DLP policies can scan messages in real time, apply actions like blocking the message or sending a policy tip to the user, and integrate with Microsoft Teams' chat and channel infrastructure. This directly addresses the requirement for automatic detection and prevention of accidental data sharing.

Exam trap

The trap here is that candidates confuse sensitivity labels with DLP because both deal with data protection, but sensitivity labels are for classification and encryption, not real-time detection and prevention of accidental sharing in messages.

How to eliminate wrong answers

Option A is wrong because retention policies are used to preserve or delete content for compliance or legal reasons, not to detect or prevent data sharing in real time. Option C is wrong because eDiscovery is a search and export tool for legal investigations, not a preventive control that blocks sensitive data from being shared. Option D is wrong because sensitivity labels classify and protect data with encryption or visual markings but do not automatically detect and prevent sharing of sensitive data in Teams messages; they require manual application or automatic labeling based on content, not real-time message scanning.

Practice this question →

290

MCQhard

A compliance officer is tasked with continuously assessing the organization's compliance posture against GDPR and ISO 27001. The solution should generate a compliance score based on implemented controls, provide recommended improvement actions, and track remediation progress over time. Which Microsoft Purview solution should they use?

A.Audit (Premium)

B.Communication Compliance

C.Compliance Manager

D.Data Lifecycle Management

AnswerC

Compliance Manager provides built-in assessments, a compliance score, recommended actions, and supports ongoing tracking of improvement activities for standards like GDPR and ISO 27001.

Why this answer

Compliance Manager is the correct solution because it provides a continuous compliance score based on implemented controls, offers recommended improvement actions, and tracks remediation progress over time. It supports frameworks like GDPR and ISO 27001 by mapping controls to assessments and generating a dynamic score that reflects the organization's compliance posture.

Exam trap

The trap here is that candidates confuse Compliance Manager with Audit (Premium) because both involve compliance, but Audit is for log investigation, not for scoring or tracking control implementation against a framework.

Why the other options are wrong

Audit (Premium) provides advanced auditing capabilities for forensic and security investigations, but it does not generate compliance scores, recommend improvement actions, or track remediation progress against frameworks like GDPR or ISO 27001.

Communication Compliance is designed to detect and remediate inappropriate communications (e.g., harassment, insider trading), not to assess compliance posture against regulations like GDPR or ISO 27001 or generate compliance scores.

Data Lifecycle Management focuses on governing data retention and deletion policies, not on assessing compliance posture, generating scores, or tracking remediation against frameworks like GDPR and ISO 27001.

Practice this question →

291

MCQeasy

A company wants to monitor employee communications for potential harassment or policy violations. Which Microsoft Purview solution should they use?

A.Data Loss Prevention (DLP)

B.eDiscovery

C.Communication compliance

D.Insider risk management

AnswerC

Microsoft Purview Communication Compliance is purpose-built to help organizations detect, investigate, and act on inappropriate messages within their Microsoft 365 environment. It leverages machine learning and customizable policies to identify potential policy violations, such as harassment, threats, or regulatory non-compliance, across various communication channels. This solution provides a structured workflow for reviewers to examine flagged communications and take appropriate remedial action.

Why this answer

Communication compliance is the correct solution because it is specifically designed to detect and remediate inappropriate communications, such as harassment, threats, or policy violations, by analyzing email, Microsoft Teams, and third-party messages. It uses customizable policies to scan for sensitive content, keywords, or patterns, and provides alerts for review by designated investigators.

Exam trap

The trap here is that candidates often confuse Communication compliance with Insider risk management, but the former focuses on communication content (e.g., harassment) while the latter focuses on user behavior patterns (e.g., data exfiltration).

How to eliminate wrong answers

Option A is wrong because Data Loss Prevention (DLP) focuses on preventing the unauthorized sharing of sensitive data (e.g., credit card numbers or PII) rather than monitoring communications for harassment or policy violations. Option B is wrong because eDiscovery is used for legal discovery and litigation support, such as searching and exporting content for court cases, not for proactive monitoring of employee communications. Option D is wrong because Insider risk management is designed to detect risky user activities like data theft or sabotage, not to monitor communications for harassment or policy violations.

Practice this question →

292

MCQmedium

A financial services firm must monitor employee communications (email and Microsoft Teams) for potential insider trading. The compliance team wants to automatically detect messages containing specific financial keywords (e.g., 'non-public material information') and flag them for review. They also need to be able to remove violating messages from recipients' inboxes. Which Microsoft Purview solution should they configure?

A.Data Lifecycle Management

B.Communication Compliance

C.Insider Risk Management

D.Audit

AnswerB

Communication Compliance detects policy violations in messages and allows actions like removal.

Why this answer

Communication Compliance is the correct solution because it is specifically designed to detect and remediate inappropriate communications, including insider trading signals. It can automatically scan emails and Microsoft Teams messages for configurable sensitive information types (e.g., 'non-public material information') and enforce actions like removing violating messages from recipients' inboxes.

Exam trap

The trap here is confusing Communication Compliance (which detects and remediates message content) with Insider Risk Management (which focuses on behavioral analytics and risk scoring), leading candidates to choose the latter despite its inability to perform keyword-based message removal.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management focuses on retaining and deleting data based on policies (e.g., legal hold, expiration), not on real-time detection or remediation of message content. Option C is wrong because Insider Risk Management analyzes user behavior patterns (e.g., unusual data exfiltration) to identify potential insider threats, but it does not directly scan communications for specific keywords or remove messages from inboxes. Option D is wrong because Audit provides logging and investigation of past activities (e.g., who accessed what), not proactive detection or automatic removal of violating messages.

Practice this question →

293

Multi-Selectmedium

Which THREE of the following are capabilities of Microsoft Purview Information Protection?

Select 3 answers

A.Auto-labeling for sensitive data

B.Communication monitoring

C.Sensitivity labels

D.Encryption and rights protection

E.Retention policies

AnswersA, C, D

Auto-labeling is a feature of Information Protection.

Why this answer

A, C, D are correct. Sensitivity labels, auto-labeling, and encryption are key capabilities of Microsoft Purview Information Protection. B (Communication monitoring) is a Communication Compliance capability.

E (Retention policies) is Data Lifecycle Management.

Practice this question →

294

MCQeasy

Your organization is implementing Microsoft Purview to manage sensitive data. You need to ensure that documents containing credit card numbers are automatically detected and protected. Which Microsoft Purview solution should you configure?

A.eDiscovery (Premium)

B.Data Loss Prevention (DLP)

C.Audit (Standard)

D.Information Barriers

AnswerB

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and on-premises repositories. These policies leverage sensitive information types, trainable classifiers, and exact data match to detect content containing, for example, credit card numbers or health records. Upon detection, DLP can enforce actions such as blocking sharing, encrypting files, or notifying administrators to prevent unauthorized disclosure or exfiltration.

Why this answer

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect sensitive data, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply protective actions like blocking sharing or encrypting the document. Microsoft Purview DLP policies can scan content at rest, in transit, and in use across Exchange, SharePoint, OneDrive, Teams, and endpoints, ensuring credit card numbers are identified and protected in real time.

Exam trap

The trap here is that candidates may confuse eDiscovery (Premium) with DLP because both involve content scanning, but eDiscovery focuses on search and hold for legal cases, not automated real-time protection of sensitive data.

How to eliminate wrong answers

Option A is wrong because eDiscovery (Premium) is used for legal discovery and investigation workflows, not for automated detection and protection of sensitive data like credit card numbers. Option C is wrong because Audit (Standard) provides logging and auditing of user and admin activities, but it does not detect or protect sensitive data in documents. Option D is wrong because Information Barriers are designed to restrict communication and collaboration between specific groups to prevent conflicts of interest, not to scan for or protect sensitive data patterns like credit card numbers.

Practice this question →

295

Multi-Selecthard

Which THREE actions can be performed by Microsoft Purview Data Loss Prevention (DLP) policies?

Select 3 answers

A.Create audit reports of policy matches

B.Send notification to users

C.Block sharing of sensitive data

D.Automatically delete files containing sensitive data

E.Apply encryption via sensitivity labels

AnswersB, C, E

DLP can show policy tips and send email notifications.

Why this answer

Microsoft Purview DLP policies can send email notifications to users when a policy match occurs, alerting them to potential policy violations and providing guidance on proper data handling. This is a core end-user notification feature that helps educate users and reduce accidental data leaks.

Exam trap

The trap here is that candidates may confuse DLP's ability to generate alerts or logs with the separate audit log functionality, or assume DLP can delete files when it only blocks or encrypts data.

Practice this question →

296

MCQhard

Refer to the exhibit. A Microsoft Purview administrator imported this JSON policy for automatic sensitivity labeling. After deployment, users report that emails containing German social security numbers are not being automatically labeled. What is the most likely cause?

A.The sensitive info type 'EU_Deutschland_SocialSecurityNumber' is not defined in the tenant.

B.Auto-labeling for emails requires 'applyWithOverride' behavior, not 'apply'.

C.The encryption setting prevents auto-labeling on emails.

D.The label is not published to users.

AnswerB

For automatic sensitivity labeling of content in Exchange Online (emails), the `behavior` parameter in the auto-labeling policy must be set to `applyWithOverride`. The `apply` behavior is typically used for SharePoint and OneDrive content, where it applies the label without allowing users to change it. However, Exchange requires `applyWithOverride` to ensure the label is applied while still permitting users to manually modify or remove it if necessary, aligning with email workflow flexibility.

Why this answer

Microsoft Purview auto-labeling for emails requires the 'applyWithOverride' action to allow users to override the label, whereas 'apply' is used for static labeling in other scenarios like SharePoint. The JSON policy uses 'apply' without override, which prevents automatic labeling on emails, as email auto-labeling policies specifically need the 'applyWithOverride' behavior to function correctly.

Exam trap

The trap here is that candidates confuse the 'apply' action (used for static labeling in SharePoint/OneDrive) with the 'applyWithOverride' action required for email auto-labeling, assuming all auto-labeling uses the same action.

How to eliminate wrong answers

Option A is wrong because the sensitive info type 'EU_Deutschland_SocialSecurityNumber' is a built-in Microsoft Purview sensitive information type that is defined by default in all tenants, so its absence is not the issue. Option C is wrong because encryption settings do not prevent auto-labeling; they are applied after labeling and are configured separately in the label policy. Option D is wrong because label publishing affects user visibility in apps like Office, but auto-labeling policies apply labels automatically regardless of whether the label is published to users.

Practice this question →

297

MCQmedium

A healthcare organization must automatically detect documents containing patient health information (PHI) in SharePoint Online and apply a retention label that retains the documents for 10 years. Additionally, they want to prevent users from permanently deleting these documents during the retention period. Which Microsoft Purview solution should they use to achieve this?

A.Data Lifecycle Management

B.Records Management

C.Data Loss Prevention (DLP)

D.Communication Compliance

AnswerB

Correct. Records Management uses retention labels that can be configured to mark items as records. When an item is a record, it cannot be deleted, edited, or modified by users during the retention period. This satisfies the requirement to prevent permanent deletion.

Why this answer

Records Management (option B) is correct because it enables organizations to declare documents as records, which locks them against deletion or modification for a specified retention period. In this scenario, automatically detecting PHI in SharePoint Online and applying a retention label that both retains documents for 10 years and prevents permanent deletion is a core Records Management capability, as it uses retention labels configured to mark items as records (or regulatory records) to enforce immutability.

Exam trap

The trap here is that candidates often confuse Data Lifecycle Management (which handles retention and deletion but not immutability) with Records Management (which adds the critical 'lock as a record' capability to prevent deletion), leading them to incorrectly select option A.

How to eliminate wrong answers

Option A is wrong because Data Lifecycle Management (DLP lifecycle) focuses on managing retention and deletion of content based on policies but does not inherently prevent users from permanently deleting documents during the retention period; it lacks the 'lock as a record' functionality that enforces immutability. Option C is wrong because Data Loss Prevention (DLP) is designed to detect and prevent unauthorized sharing or leakage of sensitive information (e.g., PHI), not to enforce retention or prevent deletion of documents. Option D is wrong because Communication Compliance is used to monitor and analyze communications (e.g., email, Teams) for policy violations, such as insider trading or harassment, and does not provide retention labeling or deletion prevention for documents.

Practice this question →

298

Multi-Selecteasy

Which TWO Microsoft Purview solutions help organizations respond to data subject requests under GDPR?

Select 2 answers

A.eDiscovery

B.Information barriers

C.Data Lifecycle Management

D.Data Loss Prevention (DLP)

E.Communication compliance

AnswersA, C

eDiscovery in Microsoft Purview is specifically designed to identify, preserve, collect, process, review, and export electronically stored information (ESI). This functionality is crucial for responding to legal requests, regulatory investigations, and data subject access requests (DSARs) by allowing organizations to efficiently locate and retrieve relevant data across various Microsoft 365 services. It centralizes the search and collection process for compliance needs.

Why this answer

eDiscovery (A) is correct because it enables organizations to search for and export personal data across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject access and export requests under GDPR Article 15. Data Lifecycle Management (C) is correct because it allows organizations to retain personal data for the minimum necessary period and permanently delete it when no longer needed, supporting the right to erasure under GDPR Article 17.

Exam trap

Candidates often mistakenly think that Data Loss Prevention (DLP) can directly respond to data subject requests, but DLP only prevents data leaks and does not provide the search, export, or deletion workflows required for GDPR rights.

Practice this question →

299

MCQmedium

Your organization uses Microsoft Purview eDiscovery (Premium) to manage a legal case. You need to place a hold on custodians' mailboxes and SharePoint sites to preserve relevant data. Which step must you first take in the eDiscovery workflow?

A.Export results

B.Create a case

C.Create a review set

D.Search for content

AnswerB

You must create a case first to manage the legal matter.

Why this answer

In Microsoft Purview eDiscovery (Premium), the workflow begins with creating a case, which serves as the container for all subsequent actions, including holds, searches, and review sets. Without a case, you cannot place holds on custodians' mailboxes or SharePoint sites because the hold is scoped to the case. Therefore, creating a case is the mandatory first step before any preservation or search activities.

Exam trap

The trap here is that candidates often confuse the eDiscovery workflow with a simple search-and-export process, skipping the case creation step because they assume you can directly search or place holds without a container.

How to eliminate wrong answers

Option A is wrong because exporting results is a final step in the eDiscovery workflow, performed after searches and reviews are complete, not before placing holds. Option C is wrong because a review set is created after content is collected and processed, not as the first step; holds are placed before or during the search phase. Option D is wrong because searching for content typically occurs after the case is created and holds are defined, as the hold itself preserves data for the search scope.

Practice this question →

300

MCQhard

AdventureWorks, a multinational manufacturing company, uses Microsoft Purview and Microsoft Communication Compliance to monitor and manage internal communications. They need to: (1) detect and review emails containing offensive language or harassment; (2) allow employees to report inappropriate messages; (3) retain reviewed messages for 5 years; (4) ensure that only designated reviewers can access the communication compliance data; (5) integrate with Microsoft Teams and Exchange Online. The company has 10,000 users and Microsoft 365 E5 licenses. The compliance team wants a solution that automates detection and provides secure review. What should they configure?

A.Create a Communication Compliance policy with conditions for offensive language, enable user reporting, and configure a retention policy for 5 years on the original content locations (e.g., Exchange Online mailboxes, Teams chats, SharePoint sites).

B.Enable mailbox auditing and create a custom script to search for offensive language.

C.Create a Data Loss Prevention (DLP) policy to block offensive language and enable eDiscovery for review.

D.Configure information barriers between departments and use audit logs for review.

AnswerA

Communication Compliance meets all requirements for detection, reporting, retention, and access control.

Why this answer

Communication Compliance policies detect offensive language and harassment, allow user reporting, and support secure review by designated reviewers. A Microsoft 365 retention policy must be applied to the original content locations where the messages reside to retain them for 5 years. Option A is correct.

Practice this question →