Question 90
An auditor must review which users applied labels without being allowed to edit protection policy. Which response most directly addresses the stated need?
Explanation
Correct Answer
Investigation and policy-authoring permissions are separately delegated capabilities. It directly meets the case's requirement to permit label investigation without policy editing.
Incorrect Answers
Label publishing is separately controlled and can be targeted to selected users. That would delegate audience-scoped label publication; the question instead requires a way to permit label investigation without policy editing.
Content investigation does not require the authority to create or change protection policies. That would maintain role separation for labels; the question instead requires a way to permit label investigation without policy editing.
Purview role groups can delegate label configuration without global administrator privileges. That would delegate label creation safely; the question instead requires a way to permit label investigation without policy editing.





Administering Information Security in Microsoft 365 (SC-401) Practice Tests