Administering Information Security in Microsoft 365 Free Sample Questions

Forensic evidence is the opt-in Insider Risk Management feature that captures video clips of user on-screen activity on devices. Captures happen either for specific activities (when a triggering event brings an approved user into scope and a policy indicator is detected) or for all activities. Users must be requested and approved (dual authorization), and devices must be onboarded to Microsoft Purview with the Microsoft Purview Client installed. Microsoft Defender for Endpoint integration is not required. Policy indicators and device indicators only define what's scored; they don't capture clips. Source: Microsoft Learn 'Learn about Insider Risk Management forensic evidence'.

Endpoint DLP (and insider risk management) require Windows 10/11 devices to be onboarded so they can send monitoring data and enforce policies. You can onboard them directly in the Microsoft Purview portal (Settings > Device onboarding), or they're already onboarded if they're in Microsoft Defender for Endpoint. The Information Protection client isn't required. Advanced classification is optional (it adds cloud-based classification), and a policy in simulation mode doesn't enforce blocks. Source: Microsoft Learn - Onboard Windows devices into Microsoft 365 overview.

Match/Not a match feedback for a trainable classifier's matched items is given in the Microsoft Purview portal from the classifier's matched-items view (Data classification > Classifiers > Trainable classifiers, select the classifier). The same feedback is also available in Content explorer and Data explorer, but that isn't one of the listed choices. Activity explorer shows labeling and DLP activity, and the auto-labeling page manages auto-labeling policies. Note that published custom classifiers can't be retrained; feedback helps tune accuracy. Source: Microsoft Learn, 'Increase classifier accuracy'.

Microsoft 365 Copilot honors sensitivity label encryption through the EXTRACT (Copy) usage right. If a label applies encryption that grants users VIEW but not EXTRACT, Copilot won't summarize or return the content. An auto-labeling policy that detects EHR data applies that label reliably across existing and new documents. A DLP policy that only blocks sharing doesn't restrict Copilot. The Copilot-specific control is a DLP policy scoped to the 'Microsoft 365 Copilot and Copilot Chat' location with a sensitivity-label condition. Information barriers and retention policies don't control Copilot processing. Sources: learn.microsoft.com/purview/ai-m365-copilot-considerations and dlp-microsoft365-copilot-location-learn-about.

False. Whether a copy is kept in the Preservation Hold library depends on the retention settings. With retain-only or retain-and-delete settings, a file that's deleted during the retention period is copied to the Preservation Hold library. With delete-only settings nothing is preserved: the deleted document goes to the first-stage Recycle Bin, then the second-stage Recycle Bin, and is permanently deleted after 93 days. Source: Microsoft Learn, 'Learn about retention for SharePoint and OneDrive' (content paths for retain-only and delete-only settings).

For event-based retention, the process is to first define an 'event type' (e.g., 'Case Closed'). Once the label is associated with this event type, you then create a specific 'event' when a case actually closes. This event uses asset IDs (like a case number or project ID) to correlate with the metadata in the documents. This action triggers the start of the retention period for all documents tagged with that asset ID and the corresponding retention label. Manually applying the label does not trigger the event. The label policy just makes the label available; it doesn't trigger the retention start.

In a custom SIT pattern, the primary element defines the main pattern (the TX ID regular expression). Supporting elements are additional evidence, such as a keyword list containing 'transaction' or 'payment', that must appear within the configured character proximity of the primary element to raise confidence. Character proximity is only the distance setting, and 'corroborative evidence' is the XML rule-package term for these same supporting match elements. Source: Microsoft Learn 'Create custom sensitive information types' / 'Learn about sensitive information types'.

When multiple DLP policies are triggered for the same content in the same location, Microsoft Purview enforces the most restrictive policy. It does not simply aggregate them. The policy with the lowest priority order number (e.g., 0) is processed first, but the final action is determined by the most restrictive outcome among all matching policies. In this case, since Policy A is explicitly the most restrictive, its actions will be enforced on the email.

The Microsoft Purview Information Protection scanner is designed specifically for discovering, classifying, and protecting files on on-premises data stores like file shares and SharePoint Server. It can be configured to run in discovery mode or enforcement mode to automatically apply sensitivity labels based on content inspection. Defender for Cloud Apps is for cloud services, the MPIP client is for user endpoints, and Endpoint DLP focuses on preventing data loss from managed devices, not bulk classification of file shares.

Microsoft Purview Audit (Premium) allows the creation of specific audit log retention policies. These policies can be configured to retain logs for specific users, activities, or record types for longer periods (up to 10 years). This is the correct tool for applying different retention durations to different sets of users, such as the executive group. The default policy applies to everyone and cannot be customized in this granular way. eDiscovery holds and retention labels apply to user content, not audit logs.