A financial services firm is implementing Microsoft Purview Data Loss Prevention (DLP) to protect client data on corporate Windows 11 devices. The firm's policy must prevent users from copying sensitive content, identified by the 'Financial Records' sensitivity label, to any personal USB storage device. However, copying to company-issued, encrypted USB devices must be permitted. All other USB devices should be blocked entirely for any file transfer. Which Endpoint DLP setting is the most precise and efficient for achieving this granular control?
Answer and explanation
Correct answer: C
This is the most precise and scalable solution. By creating a 'Removable storage device group' for the authorized devices, you can create specific DLP rules that reference this group. This allows you to build a policy that explicitly permits copying of sensitive data ONLY to this approved group, while a more general rule can block copying to all other USB devices. Simply allowing hardware IDs in the global settings doesn't integrate with the sensitivity label context, and a simple block rule doesn't allow for the required exception for company-issued devices.
Question 2
Multiple answers
A legal firm is required to retain all client-related email communications for a period of 10 years after a case is officially closed. The closure of a case is a specific event that varies for each client. The firm needs to automate this retention process to ensure compliance and minimize manual overhead. Which combination of features in Microsoft Purview should be implemented to meet this requirement? (Select TWO).
Answer and explanation
Correct answers: B, E
A retention label is required to define the retention settings, such as the 10-year period and the disposition action. Critically, it must be configured to start the retention period based on an event rather than the content creation or modification date.
Event-based retention requires an event type to be defined (e.g., 'Case Closed'). When a case is closed, an instance of this event is created (often via a script or Power Automate) with asset IDs (like the email message IDs or mailbox), which triggers the 10-year retention countdown defined in the associated retention label.
Question 3
A healthcare organization is configuring Microsoft Purview Insider Risk Management to detect potential HIPAA data violations. They have connected their HR system, which provides employee termination dates. A policy needs to be created that specifically monitors for high-volume downloads of files containing patient health information (PHI) from SharePoint Online by employees within 30 days of their termination date. What is the most critical prerequisite for this policy to function effectively?
Answer and explanation
Correct answer: C
Insider Risk Management relies heavily on signals from the Microsoft 365 audit log to detect user activities. Without auditing enabled for SharePoint file activities (like FileDownloaded), the policy will not receive the necessary signals to detect the high-volume downloads, rendering the policy ineffective regardless of other configurations like the HR connector or policy template.
Question 4
An administrator at a manufacturing company has created a file plan in Microsoft Purview Records Management. They have defined several retention labels, including 'Engineering-Blueprints' which is configured to mark items as a regulatory record. The administrator now needs to ensure that this label is automatically applied to all documents within a specific SharePoint document library named 'Active Projects\Final Blueprints'. What is the most direct method to achieve this?
Answer and explanation
Correct answer: B
The most direct and simplest way to apply a default retention label to all new content in a specific document library is to configure it directly in that library's settings. This ensures any new document uploaded or created in that location automatically inherits the 'Engineering-Blueprints' label. An auto-apply policy is more complex and typically used for applying labels based on content or metadata across multiple locations.
Question 5
True or False: After a Preservation Lock is applied to a retention policy in the Microsoft Purview compliance portal, a Global Administrator can remove the lock if a valid business or legal justification is provided through a Microsoft support case.
Answer and explanation
Correct answer: B
A Preservation Lock is designed to make a retention policy immutable to meet strict regulatory requirements (like SEC Rule 17a-4). Once a lock is applied, it cannot be disabled or made less restrictive by anyone, including a Global Administrator or Microsoft Support. This is a fundamental principle of the feature.
Question 6
A multinational corporation uses Microsoft Teams for collaboration between its Research and Development (R&D) and Sales departments. To prevent conflicts of interest and protect sensitive intellectual property, the company needs to prevent users in the R&D department from communicating via chat or calls with users in the Sales department. However, both departments must be able to communicate with the Legal department. Which Microsoft Purview solution should be implemented to enforce this communication boundary?
Answer and explanation
Correct answer: C
Information Barriers (IB) are specifically designed to prevent individuals or groups from communicating with each other in Microsoft Teams, SharePoint, and OneDrive. You would define segments for R&D, Sales, and Legal, and then create IB policies to block communication between R&D and Sales while allowing both to communicate with Legal. Communication Compliance is for monitoring communications for inappropriate content, and DLP is for preventing data exfiltration.
Question 7
A consultant is tasked with creating a custom sensitive information type (SIT) to detect a new, internally developed project code format: PROJ- followed by two uppercase letters and four digits (e.g., PROJ-AB1234). The consultant needs to define a regular expression that has a high confidence level and minimizes false positives. Which of the following regular expressions is the most accurate and efficient for this requirement?
Answer and explanation
Correct answer: B
This is the most precise regex. \b denotes a word boundary, preventing partial matches within longer strings (e.g., 'OLDPROJ-AB12345'). PROJ- is a literal match. [A-Z]{2} specifically matches exactly two uppercase letters. [0-9]{4} (or \d{4}) specifically matches exactly four digits. This combination accurately reflects the required format while minimizing false positives.
Question 8
An eDiscovery manager for a global enterprise is preparing for litigation. The case involves custodians located in both Germany and the United States. Due to data residency regulations, data for German custodians must be processed and stored within the European Union. The manager needs to create a single eDiscovery (Premium) case to manage the litigation efficiently while respecting these regional data boundaries. What feature within Microsoft Purview eDiscovery (Premium) must be configured when creating the case to meet this requirement?
Answer and explanation
Correct answer: D
When creating an eDiscovery (Premium) case, there is a setting to specify the region where case data will be stored and processed. By selecting a region in the European Union for this case, the manager ensures that when data from German custodians is collected and processed, it will remain within the specified EU data boundary, thus complying with data residency regulations.
Question 9
A university is using trainable classifiers to identify student admission forms. After initial training with 250 positive examples, the classifier is performing with low accuracy, frequently misclassifying research papers as admission forms. A compliance administrator has collected an additional 50 admission forms and 200 research papers. What is the correct next step to improve the classifier's performance?
Answer and explanation
Correct answer: C
The most effective way to improve a trainable classifier is to provide it with feedback on its mistakes. By identifying the items it got wrong (the research papers) and explicitly telling it 'Not a match', you help the model learn the difference between positive and negative examples. This retraining process is more efficient than starting over and directly addresses the source of the inaccuracy.
Question 10
Case Study:
Contoso, Ltd. is a global consulting firm with a new Chief Compliance Officer (CCO) who has mandated a complete overhaul of the company's data governance strategy using Microsoft Purview. The primary goal is to automatically classify and protect sensitive client data without impeding employee productivity.
Existing Environment: Contoso uses Microsoft 365 E5 licenses. All employees store documents in SharePoint Online and OneDrive for Business and use Exchange Online for email. A basic sensitivity label structure (Public, Internal, Confidential) exists but is applied manually and inconsistently.
Key Requirements:
Project Proposals: Documents containing the keyword "Project Proposal" and a custom sensitive info type for "Client ID" must be automatically labeled as 'Confidential - Client'. This label must encrypt the document and apply a 'Contoso Confidential' watermark.
Financial Reports: Excel workbooks containing more than 10 credit card numbers must be automatically labeled as 'Highly Confidential - Finance'. This label must encrypt the document and restrict access to members of the 'Finance_Team' security group.
User Experience: When a label is automatically applied, users should be notified via a policy tip in Office apps. Users must not be allowed to downgrade the classification from 'Highly Confidential - Finance' to 'Confidential - Client' without providing a business justification.
Deployment: The CCO wants to test the accuracy of the auto-labeling logic for one month before any labels are actually applied to documents.
Which single Microsoft Purview configuration should the administrator create to meet all these requirements?
Answer and explanation
Correct answer: B
This solution correctly addresses all requirements. A single auto-labeling policy can contain multiple rules for different conditions. Running it in simulation mode meets the testing requirement. The two new sensitivity labels can be configured with the specific encryption, watermarking, and access restrictions. The requirement to provide justification for lowering classification is a setting within the sensitivity label policy that publishes the labels, not the auto-labeling policy itself, but this option correctly identifies that the auto-labeling policy and the label policy work together. This is the most comprehensive and accurate approach.
