Microsoft SC-401Administering Information Security in Microsoft 365 Exam Dumps and Practice Test Questions Set 7 Q91-105
Visit here for our full Microsoft SC-401 exam dumps and practice test questions.
Question 91:
You want to ensure that external users cannot access SharePoint or Teams content unless they meet your organization’s security policies. Which feature should you configure?
A) Conditional Access
B) Data Loss Prevention
C) Sensitivity Labels
D) Retention Labels
Answer: A
Explanation:
Conditional Access in Microsoft 365 allows organizations to enforce access policies for users, including external collaborators, based on device compliance, location, application, and risk level. By configuring policies, administrators can prevent unmanaged or non-compliant devices from accessing SharePoint or Teams content. Conditional Access can require multi-factor authentication (MFA), block access from risky locations, or allow access only from devices meeting security standards. For external users, this ensures that sensitive content is protected from unauthorized or insecure endpoints, aligning with zero-trust security principles. Integration with Microsoft Intune and Azure AD enables real-time evaluation of device health, compliance, and user context before granting access.
Data Loss Prevention focuses on monitoring and blocking sensitive content from being shared inappropriately. While DLP protects content, it does not enforce access restrictions based on device or user compliance for external users.
Sensitivity Labels classify and protect content by applying encryption and usage restrictions. Labels secure content but do not evaluate the compliance or security status of devices used by external users.
Retention Labels enforce content preservation or deletion schedules for compliance purposes. They are primarily designed to help organizations meet regulatory and legal requirements by ensuring that information is kept for a specific duration or disposed of systematically. While they are effective for managing data lifecycle and ensuring that critical records are retained, they do not control who can access content at any given moment. Retention Labels operate independently of the user’s access environment, meaning they cannot prevent external users from accessing a document if the underlying permissions allow it, nor can they enforce device compliance or conditional access policies.
Conditional Access, on the other hand, addresses the security of data access in real-time. It is the correct solution when the goal is to enforce security policies for external users interacting with platforms like SharePoint or Teams. Conditional Access evaluates the context in which access is requested—taking into account user identity, device health, location, and risk signals—before granting access. For example, an external collaborator trying to access a confidential SharePoint document from an unmanaged device or an unusual location can be automatically blocked or required to pass multifactor authentication. This ensures that only trusted users and devices can interact with sensitive resources, reducing the risk of data breaches.
Unlike Data Loss Prevention (DLP), which focuses on monitoring and protecting content after it has been accessed, Conditional Access acts proactively, restricting access based on the security posture and context of the request. While Sensitivity Labels embed persistent protections within a document or email, they do not evaluate the user’s environment or enforce dynamic access decisions. Similarly, while Retention Labels manage how long content is stored or deleted, they do not enforce security controls in real-time or assess whether a device or user meets security compliance standards.
By implementing Conditional Access, organizations gain granular control over who can access corporate data and under what circumstances. This capability is especially critical for hybrid work environments or when collaborating with external partners, ensuring that access policies are consistently applied without relying solely on user behavior or static content protections. It bridges the gap between compliance, security, and usability by dynamically adapting to potential risks and maintaining secure access to organizational resources.
Question 92:
You want to ensure that privileged roles in Microsoft 365 require approval before activation and are time-limited. Which feature should you implement?
A) Privileged Access Management
B) Conditional Access
C) Identity Protection
D) Data Loss Prevention
Answer: A
Explanation:
Privileged Access Management (PAM) in Microsoft 365 allows organizations to enforce just-in-time (JIT) access to high-risk administrative roles. Administrators must request temporary access, often requiring approval, and provide a business justification. This ensures that elevated privileges are not continuously active, reducing the risk of misuse or compromise. PAM workflows can include approval, multi-factor authentication, and audit logging, creating a comprehensive trail of all privileged activity. Temporary activation helps enforce the principle of least privilege, ensuring that administrators only have elevated rights when necessary for a specific task. Integration with Azure AD and Microsoft 365 roles provides seamless enforcement across workloads, including Exchange, SharePoint, and Teams.
Conditional Access controls access to Microsoft 365 applications based on device compliance, location, or risk. While it can block access or require MFA, it does not provide just-in-time activation of privileged roles or approval workflows.
Identity Protection evaluates user and sign-in risk and can trigger automated actions such as password resets or account blocks. It does not manage activation of privileged roles or enforce time-limited access.
Data Loss Prevention (DLP) enforces content-level policies to prevent sensitive data from leaving the organization. It monitors files, emails, and other communication channels for confidential information such as financial records, personal data, or intellectual property, and can block or alert on unauthorized sharing. While DLP is essential for protecting data, its scope is limited to content usage and movement. It does not manage administrative privileges, control who can perform high-risk operations, or require approval before granting access to sensitive roles or systems. In other words, DLP safeguards the data itself but does not govern the people or processes that can modify system configurations or access critical infrastructure.
Privileged Access Management (PAM) is the correct solution when the focus is on securing administrative and high-privilege roles. PAM enforces Just-In-Time (JIT) access, granting elevated privileges only for the duration needed to perform a specific task. It often requires approval and justification for role activation, ensuring that sensitive permissions are only used with explicit authorization. Additionally, PAM logs all privileged activity, providing full audit trails that support accountability and compliance. By minimizing standing privileges, PAM reduces the attack surface for malicious insiders or compromised accounts, ensuring that even if credentials are stolen, the potential for harm is limited.
Unlike Conditional Access, which primarily governs user access to applications and resources based on risk context, PAM is specifically designed for privileged workflows and administrative tasks. Unlike Identity Protection, which evaluates risk for general accounts and may enforce multi-factor authentication or password resets, PAM governs who can activate privileged roles and under what conditions. And unlike DLP, which focuses on preventing sensitive content from being shared inappropriately, PAM directly controls administrative actions, reducing operational risk associated with elevated permissions.
By integrating PAM into an organization’s security strategy, administrators gain granular control over sensitive roles, enforce compliance requirements, and mitigate potential security breaches arising from excessive privileges. It complements DLP and other security tools by focusing on the human and procedural side of access management rather than the content itself, providing a comprehensive defense-in-depth approach to organizational security.
Question 93:
You want to prevent users from accidentally sharing sensitive HR documents externally but still allow internal collaboration. Which feature should you implement?
A) Data Loss Prevention
B) Sensitivity Labels
C) Retention Labels
D) Conditional Access
Answer: A
Explanation:
Data Loss Prevention (DLP) in Microsoft 365 allows organizations to detect sensitive content, such as HR documents, and prevent it from being shared externally. By creating policies specific to sensitive information types (like PII or employee data), administrators can block emails or Teams messages containing HR documents, alert compliance teams, or provide users with Policy Tips to educate them about the potential risk. DLP ensures that sensitive content remains within the organization while still allowing users to collaborate internally. It integrates with Exchange Online, SharePoint, OneDrive, and Teams to provide comprehensive coverage across Microsoft 365 workloads.
Sensitivity Labels classify and protect content through encryption and access restrictions. While labels secure sensitive documents, they do not proactively block accidental external sharing or provide real-time warnings to users. Labels focus on persistent protection rather than proactive behavioral control.
Retention Labels enforce content preservation or deletion schedules for compliance purposes. They are designed to help organizations meet legal and regulatory obligations by ensuring that documents, emails, and other records are retained for a specified period or disposed of in a controlled manner. While Retention Labels are effective for content lifecycle management, their primary focus is on how long data exists, not how it is used. For instance, HR documents tagged with a retention label will be preserved according to the retention policy, but this does not prevent users from copying, printing, or sharing the documents externally. Retention Labels do not monitor user behavior, enforce sharing restrictions, or provide real-time protection against accidental or intentional data leaks. Their utility lies in compliance and record-keeping rather than proactive security.
Conditional Access is another important layer of security, but its purpose differs significantly from Retention Labels. Conditional Access evaluates the context in which access requests are made, such as the user’s location, device compliance, or the risk associated with the account. It can block or allow access to Microsoft 365 applications like SharePoint, Teams, or OneDrive based on these conditions, effectively controlling who can enter the system and under what circumstances. However, Conditional Access does not inspect the content of documents or prevent internal users from sharing sensitive files once access is granted. Its strength is in access governance rather than content-level protection.
Data Loss Prevention (DLP) is the correct solution for protecting sensitive HR documents because it operates at the content level in real time. DLP policies proactively monitor emails, files, and collaboration platforms for sensitive information, such as social security numbers, payroll data, or performance evaluations. When DLP detects a potential violation, it can block the action, notify the user, or alert administrators, preventing data from being accidentally or intentionally shared externally. Unlike Sensitivity Labels, which embed protection within a document, DLP enforces behavioral policies across the organization, shaping how users interact with sensitive data. Unlike Retention Labels, which govern the lifecycle of content, DLP ensures immediate protection regardless of how long the document exists. Unlike Conditional Access, which restricts access, DLP specifically controls how content is shared and transmitted, providing a safeguard against accidental leaks while still supporting internal collaboration.
Implementing DLP for HR documents allows organizations to maintain a balance between productivity and security. Employees can continue collaborating internally while sensitive information is actively monitored and protected. Alerts and reporting give administrators insight into potential risks, enabling them to respond quickly to incidents. In combination with Retention Labels and Conditional Access, DLP forms a comprehensive approach to data governance—managing lifecycle, access, and behavioral risks simultaneously. By focusing on content-level enforcement, DLP ensures that HR information is protected in a way that retention and access policies alone cannot achieve, making it essential for organizations handling confidential employee data.
Question 94:
You want to ensure that emails containing confidential financial data are encrypted and cannot be forwarded or printed outside the organization. Which feature should you implement?
A) Sensitivity Labels
B) Data Loss Prevention
C) Retention Labels
D) Conditional Access
Answer: A
Explanation:
Sensitivity Labels in Microsoft 365 enable the classification and protection of emails containing confidential financial data. By applying a label such as “Highly Confidential – Finance,” administrators can enforce encryption, restrict forwarding, printing, or copying, and control access to authorized internal users. These protections persist with the email, even if it is sent externally, preventing unauthorized access or misuse. Sensitivity Labels can be applied manually or automatically based on content detection, such as specific keywords, sensitive information types, or patterns like credit card numbers or financial statements. Integration with Exchange Online ensures that encrypted emails are protected across different devices and email clients.
Data Loss Prevention can detect sensitive information and prevent sharing externally, but it does not provide persistent encryption or control actions such as preventing forwarding or printing. DLP is reactive and cannot enforce content usage restrictions after delivery.
Retention Labels enforce content preservation or deletion schedules. While important for compliance, they do not encrypt emails or restrict user actions like forwarding or printing. Retention focuses on lifecycle management rather than content security.
Conditional Access controls access to applications based on user, device, or location. It does not protect the content of emails or prevent unauthorized actions on sensitive information.
Sensitivity Labels are the correct solution because they provide persistent encryption, restrict actions like forwarding or printing, and ensure sensitive financial data remains secure. Unlike DLP, they enforce usage restrictions; unlike Retention Labels, they protect content rather than lifecycle; and unlike Conditional Access, they secure content rather than access.
Question 95:
You need to monitor internal communications to detect harassment, offensive language, or policy violations in Teams messages. Which feature should you configure?
A) Communication Compliance
B) Data Loss Prevention
C) Sensitivity Labels
D) Retention Labels
Answer: A
Explanation:
Communication Compliance in Microsoft 365 allows organizations to monitor internal communications such as Teams messages, emails, and Yammer posts for policy violations. Machine learning and pattern matching identify harassment, offensive language, discrimination, or other non-compliant behavior. Alerts are generated for compliance teams, who can investigate incidents, remediate, or escalate as needed. Communication Compliance supports regulatory reporting and auditing, ensuring organizations maintain a safe and compliant communication environment. It can integrate with eDiscovery for investigation and evidence collection, providing a comprehensive approach to monitoring internal communications.
Data Loss Prevention protects sensitive content from being shared outside the organization. DLP does not monitor behavior, detect harassment, or flag offensive language. Its focus is on content security rather than policy compliance.
Sensitivity Labels are an essential tool for protecting organizational content. They classify documents and emails according to sensitivity levels and enforce security measures such as encryption, watermarking, or access restrictions. By embedding protection directly into the content, Sensitivity Labels ensure that confidential information remains secure even if it leaves the organization. However, their scope is limited to content protection. They do not actively monitor internal communications for compliance or behavioral violations, nor do they provide alerts or investigative capabilities. Labels focus on ensuring that sensitive content is handled securely, rather than assessing whether employees or users are following communication policies.
Retention Labels, in contrast, are primarily concerned with content lifecycle management. They enforce policies to preserve or delete data to meet legal, regulatory, or organizational requirements. While Retention Labels are vital for compliance and record-keeping, they do not detect or prevent behavioral issues, such as harassment, insider threats, or inappropriate messages exchanged via chat or email. Retention Labels operate passively—they manage how long information exists and when it should be removed—but they do not act on real-time user behavior or flag potential violations for compliance review.
Communication Compliance is the correct solution when the goal is to monitor communications proactively for policy violations. It provides real-time scanning of emails, Teams chats, and other collaboration platforms to detect language or patterns that indicate potential breaches of corporate policy, regulatory requirements, or legal obligations. When a potential violation is detected, Communication Compliance can alert compliance teams, generate detailed reports, and provide evidence for investigation, ensuring that issues are addressed promptly. Unlike Data Loss Prevention (DLP), which focuses on protecting sensitive content from being leaked, Communication Compliance emphasizes user behavior and policy adherence. Unlike Sensitivity Labels, which secure content regardless of how it is used, Communication Compliance actively monitors interactions to identify inappropriate behavior. Unlike Retention Labels, which govern how long content is kept, Communication Compliance operates in real time, enabling immediate response to compliance risks.
By implementing Communication Compliance alongside Sensitivity and Retention Labels, organizations gain a comprehensive approach: content is classified and secured, retention obligations are met, and internal communications are monitored for behavioral violations. This layered strategy ensures that sensitive information is protected, regulatory requirements are fulfilled, and organizational policies are enforced effectively, reducing risk and enhancing accountability across the enterprise.
Question 96:
You want to automatically apply encryption and usage restrictions to all documents containing credit card information stored in OneDrive. Which feature should you implement?
A) Sensitivity Labels
B) Data Loss Prevention
C) Retention Labels
D) Conditional Access
Answer: A
Explanation:
Sensitivity Labels in Microsoft 365 allow organizations to classify and protect documents containing sensitive information, such as credit card numbers. By creating a label for financial data, administrators can automatically apply encryption, restrict access to authorized users, and enforce usage restrictions like preventing printing, copying, or external sharing. These protections are persistent, meaning they remain with the document even when moved or shared within the organization. Integration with OneDrive, SharePoint, Teams, and Exchange ensures comprehensive protection for documents across all Microsoft 365 workloads. Automatic application of labels can be based on detecting specific sensitive information types, keywords, or patterns, providing a consistent and scalable approach to data security.
Data Loss Prevention (DLP) can detect credit card information and block or alert users from sharing it externally, but it does not provide persistent encryption or usage restrictions. DLP primarily reacts to policy violations rather than embedding protection directly in the document.
Retention Labels enforce content preservation or deletion schedules for compliance purposes. They do not encrypt or restrict the usage of documents. Retention focuses on content lifecycle management rather than active security controls.
Conditional Access controls access to applications based on device compliance, user, or location. While important for application access security, it does not protect document content or apply encryption or usage restrictions.
Sensitivity Labels are the correct solution because they provide automatic classification, persistent encryption, access restrictions, and usage controls for sensitive content. Unlike DLP, they protect the content itself rather than reacting to sharing attempts; unlike Retention Labels, they enforce security rather than lifecycle rules; and unlike Conditional Access, they secure content rather than controlling access.
Question 97:
You want to enforce that emails containing personal data cannot be deleted for seven years to comply with privacy regulations. Which Microsoft 365 feature should you configure?
A) Retention Labels
B) Sensitivity Labels
C) Data Loss Prevention
D) Conditional Access
Answer: A
Explanation:
Retention Labels in Microsoft 365 allow organizations to enforce policies that preserve content for a specific period. By creating a retention label for emails containing personal data, administrators can ensure that messages are retained for seven years and cannot be deleted by users. Retention Labels can be applied manually or automatically based on content, keywords, or location. They also support disposition review, auditing, and reporting to demonstrate regulatory compliance. This ensures adherence to privacy regulations, such as GDPR or industry-specific rules, by providing defensible retention of critical information.
Sensitivity Labels protect content using encryption and access restrictions. While important for safeguarding sensitive information, they do not enforce retention periods or prevent deletion. Sensitivity Labels focus on content protection rather than regulatory retention.
Retention Labels provide organizations with a structured, enforceable method for managing the entire lifecycle of data across email systems, document repositories, and collaboration platforms. They are designed to ensure that information is kept for the legally required duration and disposed of responsibly at the end of that period. This capability is essential for regulatory compliance frameworks such as GDPR, HIPAA, SOX, FINRA, and various governmental or industry-specific mandates. Retention Labels also allow organizations to apply rules automatically based on content type, location, pattern recognition, or user actions, reducing manual workload and minimizing human error. By enforcing retention and deletion actions directly through policy, organizations strengthen their compliance posture and reduce risks associated with improper data handling.
Another advantage of Retention Labels is their ability to preserve content even if users attempt deletion. When a label is applied that requires retention, the item cannot be permanently deleted until the retention period has expired. This safeguards critical information needed for investigations, audits, eDiscovery, legal hold processes, and regulatory reviews. Even if a user deletes an email or document, the system retains a copy in a secure location where only authorized personnel can access it. This ensures accountability, traceability, and defensibility during legal proceedings. Retention Labels also support disposition reviews, enabling compliance officers to approve or deny deletion after retention requirements are met.
Unlike other controls, Retention Labels provide granular control, allowing different rules for different data classifications. For instance, financial records may require seven-year retention, while HR files may require three years, and project documentation may require indefinite storage. These distinctions ensure that organizations comply with diverse legal and contractual obligations without over-retaining unnecessary data, which could increase litigation risk or storage costs. Retention Labels create predictable and auditable workflows for managing information, significantly reducing regulatory exposure.
Overall, Retention Labels stand out because they align organizational data management practices with legal and compliance requirements, enforce mandatory retention, prevent accidental or intentional deletion, and support defensible disposition. They provide capabilities that Sensitivity Labels, Data Loss Prevention, and Conditional Access cannot achieve, making them the most appropriate solution for ensuring proper retention and regulatory compliance.
Question 98:
You want to detect and respond to users attempting to exfiltrate confidential data to personal cloud storage. Which Microsoft 365 feature should you implement?
A) Insider Risk Management
B) Data Loss Prevention
C) Sensitivity Labels
D) Retention Labels
Answer: A
Explanation:
Insider Risk Management in Microsoft 365 monitors user activities to detect and respond to risky behavior that could result in data exfiltration. This includes detecting attempts to upload confidential documents to personal cloud accounts or send sensitive information via email or Teams to external addresses. Using machine learning and behavioral analytics, Insider Risk Management identifies deviations from normal user behavior and assigns risk scores to individuals. Alerts are generated for compliance teams, who can investigate incidents, engage with users, or take corrective action. The feature provides visibility into patterns of risky behavior rather than simply reacting to individual policy violations, allowing organizations to proactively mitigate insider threats. Integration across Microsoft 365 workloads ensures comprehensive monitoring across OneDrive, SharePoint, Teams, and Exchange.
Data Loss Prevention enforces policies to prevent the sharing of sensitive content, but it does not analyze patterns of behavior across multiple actions or assign risk scores. DLP reacts to specific violations rather than proactively monitoring user activity.
Sensitivity Labels classify and protect content by applying encryption and access restrictions. While they prevent unauthorized access, they do not detect insider threats or monitor user behavior. Labels focus on protecting the content itself rather than monitoring actions.
Retention Labels enforce content preservation or deletion schedules. They do not monitor user behavior or prevent exfiltration. Retention is focused on the content lifecycle rather than security monitoring.
Insider Risk Management is the correct solution because it detects risky patterns, assigns risk scores, generates alerts, and allows intervention to prevent exfiltration. Unlike DLP, it monitors behavior rather than only content; unlike Sensitivity Labels, it focuses on activity rather than protection; and unlike Retention Labels, it acts proactively rather than managing lifecycle.
Question 99:
You want to block access to Microsoft 365 apps from unmanaged or non-compliant devices. Which feature should you configure?
A) Conditional Access
B) Data Loss Prevention
C) Sensitivity Labels
D) Retention Labels
Answer: A
Explanation:
Conditional Access in Microsoft 365 allows organizations to enforce policies that block or restrict access to apps from devices that are not compliant or managed. Compliance checks can include operating system versions, installed security updates, encryption status, or antivirus presence. Conditional Access policies can require multi-factor authentication (MFA), block risky locations, or enforce access only from approved devices. Integration with Microsoft Intune enables real-time device compliance evaluation before granting access to apps such as Exchange, SharePoint, Teams, or OneDrive. This ensures only secure, managed devices can access corporate resources, aligning with zero-trust principles and reducing the risk of unauthorized access or data leakage.
Data Loss Prevention monitors content for sensitive information and prevents inappropriate sharing. It does not block application access based on device compliance. DLP focuses on content rather than device security.
Sensitivity Labels classify and protect content by applying encryption, watermarking, or access restrictions. They ensure that documents and emails remain secure, even when shared outside the organization. For example, an HR report labeled as «Confidential» can prevent unauthorized users from opening it or applying edits. Sensitivity Labels are highly effective for controlling the security of the content itself, but they do not govern how users access applications or whether devices meet organizational security standards. A user could still open Microsoft 365 apps on an unmanaged device, and the content protection applied by Sensitivity Labels would not prevent this access scenario from occurring. Labels focus on protecting the data, not the environment in which it is accessed.
Retention Labels serve a different purpose by enforcing content preservation or deletion schedules to ensure compliance with regulatory or legal requirements. They are critical for records management, helping organizations meet obligations to retain or dispose of information at the appropriate time. However, Retention Labels do not provide real-time access control, nor do they evaluate whether a device is secure or compliant with organizational policies. Their function is limited to the lifecycle management of data, not access or device security.
Conditional Access is the correct solution when the objective is to ensure secure and compliant access to Microsoft 365 applications. It evaluates factors such as device compliance, user location, risk signals, and authentication strength before granting access. Conditional Access can integrate with endpoint management solutions to verify that only managed and secure devices are allowed to connect to corporate resources. It can enforce multifactor authentication, block access from high-risk locations, and restrict access for non-compliant devices. Unlike Data Loss Prevention (DLP), which focuses on protecting content after access, Conditional Access prevents access altogether if security conditions are not met. Unlike Sensitivity Labels, it governs access based on device and user context rather than protecting the document itself. Unlike Retention Labels, it operates in real time, ensuring that access is immediately restricted in response to non-compliance or risk.
By implementing Conditional Access alongside Sensitivity and Retention Labels, organizations create a layered security model: content is protected, lifecycle requirements are met, and access is continuously evaluated to prevent unauthorized or risky connections, ensuring comprehensive security for Microsoft 365 environments.
Question 100:
You want to enforce that users must provide a justification before sending emails containing confidential intellectual property to external recipients. Which Microsoft 365 feature should you implement?
A) Data Loss Prevention with Policy Tips
B) Sensitivity Labels
C) Retention Labels
D) Conditional Access
Answer: A
Explanation:
Data Loss Prevention (DLP) with Policy Tips allows organizations to monitor emails for confidential intellectual property and enforce policies that require users to provide a business justification before sending them externally. DLP policies can detect specific sensitive information types, keywords, or patterns in documents and emails. When a user attempts to send restricted content outside the organization, a Policy Tip appears in Outlook or Teams, warning the user and prompting for a justification. This helps prevent accidental or intentional leaks while providing a controlled mechanism for legitimate business communication. Alerts are also generated for compliance teams, who can review justifications and actions to ensure regulatory adherence and mitigate risks. Integration with Exchange Online, SharePoint, OneDrive, and Teams ensures comprehensive coverage across Microsoft 365 workloads.
Sensitivity Labels protect content through encryption and access restrictions. While they prevent unauthorized access or sharing, they do not provide real-time warnings or require users to provide justifications. Labels focus on persistent protection rather than behavioral compliance.
Retention Labels enforce preservation or deletion schedules. They do not prevent external sharing or require justifications. Retention focuses on lifecycle management rather than policy enforcement at the point of use.
Conditional Access controls access to applications based on device, user, or location. It does not monitor content or require user justifications before sending emails.
DLP with Policy Tips is the correct solution because it detects sensitive content, enforces justification for external sharing, provides real-time user guidance, and generates alerts for compliance teams. Unlike Sensitivity Labels, it emphasizes user behavior; unlike Retention Labels, it protects content in use rather than managing lifecycle; and unlike Conditional Access, it governs content sharing rather than access.
Question 101:
You want to automatically classify and encrypt documents that contain sensitive employee information stored in SharePoint and OneDrive. Which feature should you implement?
A) Sensitivity Labels
B) Data Loss Prevention
C) Retention Labels
D) Conditional Access
Answer: A
Explanation:
Sensitivity Labels in Microsoft 365 enable organizations to automatically classify and protect documents containing sensitive information, such as employee data. Administrators can configure rules to detect specific information types, keywords, or patterns, triggering automatic application of labels. Once applied, these labels enforce encryption, restrict access to authorized users, and prevent actions like printing, copying, or sharing externally. This ensures that sensitive employee information remains protected, regardless of where it is stored or how it is shared internally. Integration with SharePoint, OneDrive, Teams, and Exchange guarantees consistent enforcement of these policies across all Microsoft 365 workloads. Automatic labeling reduces human error, ensures compliance with data privacy regulations, and provides visibility into document usage for auditing purposes.
Data Loss Prevention (DLP) monitors content for sensitive information and can block or alert on unauthorized sharing, but it does not provide persistent encryption or automatically classify content. DLP is reactive and focuses on preventing leaks rather than embedding protection within the document.
Retention Labels enforce retention and deletion schedules for compliance purposes. While they manage lifecycle, they do not secure content with encryption or prevent unauthorized actions. Retention focuses on regulatory requirements rather than actively protecting sensitive data.
Conditional Access manages access to applications based on device compliance, user, or location. It does not protect or classify the content stored within applications.
Sensitivity Labels are the correct solution because they automatically classify content, enforce persistent protection, encrypt sensitive information, and control access and usage. Unlike DLP, they secure content rather than simply monitor it; unlike Retention Labels, they actively protect sensitive data rather than managing lifecycle; and unlike Conditional Access, they secure content rather than controlling access.
Question 102:
You need to prevent users from deleting Teams messages and emails that are relevant to a legal investigation. Which feature should you implement?
A) eDiscovery Legal Hold
B) Retention Labels
C) Data Loss Prevention
D) Communication Compliance
Answer: A
Explanation:
eDiscovery Legal Hold in Microsoft 365 ensures that content such as Teams messages, emails, SharePoint documents, and OneDrive files is preserved for legal or regulatory investigations. Once a Legal Hold is applied, users cannot delete content, maintaining the integrity of evidence. The system also tracks all actions performed on preserved items, including access or modification, which provides an audit trail required for compliance and legal reporting. Legal Hold can target specific users, groups, or content locations, allowing precise preservation of relevant data without affecting unrelated information. Integration across Microsoft 365 workloads ensures comprehensive coverage for emails, Teams chats, and documents. This solution is critical for organizations dealing with ongoing investigations or litigation, providing defensible preservation and making it easy for compliance or legal teams to review and export necessary content.
Retention Labels enforce general retention or deletion policies for compliance purposes, but are not specific to legal investigations. They cannot selectively preserve content for a case while preventing deletion.
Data Loss Prevention monitors sensitive information sharing and prevents unauthorized external sharing, but it does not preserve content for legal investigations. DLP focuses on protecting data rather than preserving evidence.
Communication Compliance monitors communications for harassment, offensive language, or policy violations, but does not preserve content or prevent deletion. It is focused on behavior monitoring rather than evidence preservation.
eDiscovery Legal Hold is the correct solution because it preserves emails and Teams messages, prevents user deletion, maintains detailed audit trails, and supports regulatory and legal investigations. Unlike Retention Labels, it is case-specific; unlike DLP, it focuses on preservation rather than prevention; and unlike Communication Compliance, it preserves content rather than monitoring behavior.
Question 103:
You want to block access to Microsoft 365 apps for users signing in from risky locations or devices. Which feature should you configure?
A) Conditional Access
B) Data Loss Prevention
C) Sensitivity Labels
D) Retention Labels
Answer: A
Explanation:
Conditional Access in Microsoft 365 allows organizations to enforce access policies based on user, device, location, or risk signals. By configuring policies to block access from risky locations or devices, administrators can prevent potential breaches from unmanaged or compromised endpoints. Conditional Access can require multi-factor authentication (MFA), ensure device compliance, and enforce session controls such as limiting downloads or blocking printing. Integration with Azure AD and Intune enables evaluation of real-time device compliance and contextual access decisions. This approach aligns with zero-trust principles, ensuring that only trusted users and devices gain access to corporate resources such as Exchange, SharePoint, Teams, or OneDrive.
Data Loss Prevention monitors content for sensitive information and prevents unauthorized sharing, but does not control access to applications based on location or device. DLP focuses on protecting content rather than controlling application access.
Sensitivity Labels classify and protect documents or emails through encryption or access restrictions. They secure content but do not enforce application access policies or evaluate device or user risk.
Retention Labels enforce content retention or deletion schedules for compliance. They do not manage access based on location or device compliance and are focused on lifecycle management rather than security controls.
Conditional Access is the correct solution because it evaluates risk, enforces secure access based on device and location, and prevents unauthorized access to Microsoft 365 apps. Unlike DLP, it controls access rather than monitoring content; unlike Sensitivity Labels, it governs access rather than protecting content; and unlike Retention Labels, it enforces real-time security rather than content lifecycle.
Question 104:
You need to monitor internal Teams messages and emails for offensive language, harassment, or policy violations. Which feature should you configure?
A) Communication Compliance
B) Data Loss Prevention
C) Sensitivity Labels
D) Retention Labels
Answer: A
Explanation:
Communication Compliance in Microsoft 365 enables organizations to proactively monitor internal communications for compliance risks such as harassment, offensive language, or discriminatory behavior. Using machine learning and pattern matching, Communication Compliance detects policy violations and generates alerts for compliance officers to review. Teams messages, emails, and Yammer posts can all be monitored, ensuring organizations maintain a safe and professional communication environment. Integration with eDiscovery enables organizations to preserve and export communications for further investigation if necessary. This feature supports regulatory requirements, workplace standards, and internal investigations by providing visibility into risky communications and a structured response workflow.
Data Loss Prevention focuses on protecting sensitive information from being shared outside the organization. While important for data security, DLP does not monitor behavioral or communication policy violations.
Sensitivity Labels classify and protect content with encryption and access restrictions. They secure documents and emails but do not provide behavior monitoring or detect policy violations in communications.
Retention Labels enforce content preservation or deletion schedules. They are not designed to monitor communications or flag offensive language. Retention focuses on lifecycle management rather than behavioral compliance.
Communication Compliance is the correct solution because it monitors internal communications, detects policy violations, alerts compliance teams, and provides investigation capabilities. Unlike DLP, it focuses on behavior rather than data protection; unlike Sensitivity Labels, it monitors communication rather than securing content; and unlike Retention Labels, it acts in real time rather than managing lifecycle.
Question 105:
You want to ensure that emails containing financial reports are retained for 10 years and cannot be deleted by users. Which feature should you implement?
A) Retention Labels
B) Sensitivity Labels
C) Data Loss Prevention
D) Conditional Access
Answer: A
Explanation:
Retention Labels in Microsoft 365 allow organizations to enforce long-term retention of emails, ensuring that critical business records such as financial reports are preserved for regulatory or internal compliance purposes. By applying a label, administrators can prevent users from deleting emails and enforce a 10-year retention period. Labels can be applied manually or automatically based on content, keywords, or mailbox location. Retention Labels also support auditing and reporting, allowing organizations to demonstrate compliance with financial regulations, such as Sarbanes-Oxley (SOX) or other industry-specific requirements. This helps organizations maintain a defensible retention strategy and ensures that important data remains accessible for audits or investigations.
Sensitivity Labels protect content using encryption and access restrictions. While they secure sensitive content, they do not enforce retention periods or prevent deletion. Sensitivity Labels focus on protecting content rather than managing its lifecycle.
Data Loss Prevention monitors sensitive content to prevent leaks, but does not retain emails for a specified period. DLP is primarily focused on preventing unauthorized sharing rather than ensuring long-term preservation.
Conditional Access controls access to Microsoft 365 applications based on device, location, or risk. It does not manage content retention or prevent deletion. Conditional Access focuses on access control rather than compliance retention.
Retention Labels are the correct solution because they enforce retention periods, prevent deletion, and ensure compliance with financial regulations. Unlike Sensitivity Labels, they focus on lifecycle management; unlike DLP, they preserve content rather than prevent leaks; and unlike Conditional Access, they enforce retention rather than controlling access.