Question 850
During a technology refresh at a professional services partnership, the incident responder records this concrete requirement: An organization must keep qualifying content for a defined period across supported locations. The solution must address this requirement directly, without replacing unrelated controls. The team implements the following response: Configure Microsoft Purview retention policies with the correct locations and duration. Which evidence BEST verifies that the action met its stated purpose?
- Inspect hold scope and confirm representative items remain preserved under the intended policy.
- Inspect policy scope and test retention or deletion behavior according to the configured period.
- Compare score and completed improvement actions while documenting remaining gaps.
- Review the data-processing terms, configured data handling settings, and customer obligations.
Explanation
Correct Answer
B:Inspect policy scope and test retention or deletion behavior according to the configured period. Retention policies govern preservation and deletion lifecycle rather than deciding who can sign in.
Incorrect Answers
A:Inspect hold scope and confirm representative items remain preserved under the intended policy. This would test evidence preservation, whereas the required evidence is: Inspect policy scope and test retention or deletion behavior according to the configured period.
C:Compare score and completed improvement actions while documenting remaining gaps. This would test compliance score, whereas the required evidence is: Inspect policy scope and test retention or deletion behavior according to the configured period.
D:Review the data-processing terms, configured data handling settings, and customer obligations. This would test data protection responsibilities, whereas the required evidence is: Inspect policy scope and test retention or deletion behavior according to the configured period.
Question 851
Following an external assurance discussion at a customer support provider, the security architect has to defend a design against oversimplified assumptions. The requirement is: An organization must keep qualifying content for a defined period across supported locations. The review is limited to the control and concept described by this requirement. Which security, identity, or compliance principle MOST directly explains the appropriate approach?
- Service Trust Portal supplies Microsoft compliance and assurance documentation, not customer audit sign-off.
- Provider privacy commitments and customer legal duties are related but not interchangeable.
- Retention policies govern preservation and deletion lifecycle rather than deciding who can sign in.
- Audit data availability depends on recording and retention configuration and entitlement.
Explanation
Correct Answer
C:Retention policies govern preservation and deletion lifecycle rather than deciding who can sign in. It explains why the selected measure—Configure Microsoft Purview retention policies with the correct locations and duration—fits the specific requirement. It should be verified by checking: Inspect policy scope and test retention or deletion behavior according to the configured period.
Incorrect Answers
A:Service Trust Portal supplies Microsoft compliance and assurance documentation, not customer audit sign-off. This describes service trust portal; the governing concept here is: Retention policies govern preservation and deletion lifecycle rather than deciding who can sign in.
B:Provider privacy commitments and customer legal duties are related but not interchangeable. This describes data protection responsibilities; the governing concept here is: Retention policies govern preservation and deletion lifecycle rather than deciding who can sign in.
D:Audit data availability depends on recording and retention configuration and entitlement. This describes audit retention limits; the governing concept here is: Retention policies govern preservation and deletion lifecycle rather than deciding who can sign in.
Question 852
Following an external assurance discussion at a customer support provider, the security architect has to defend a design against oversimplified assumptions. The requirement is: An organization must keep qualifying content for a defined period across supported locations. The review is limited to the control and concept described by this requirement. Which unsupported assumption would MOST directly undermine this requirement?
- Assuming an assurance report for one service automatically covers unrelated customer workloads.
- Assuming creating a Compliance Manager assessment proves every control is implemented.
- Assuming the audit portal can reconstruct events that were never retained.
- Assuming deleting a file from the visible user interface always bypasses an active retention hold.
Explanation
Correct Answer
D:Assuming deleting a file from the visible user interface always bypasses an active retention hold. This belief conflicts with this control principle: Retention policies govern preservation and deletion lifecycle rather than deciding who can sign in. The appropriate response instead is: Configure Microsoft Purview retention policies with the correct locations and duration.
Incorrect Answers
A:Assuming an assurance report for one service automatically covers unrelated customer workloads. That caution concerns third-party assurance reports; the specific misconception here is: Assuming deleting a file from the visible user interface always bypasses an active retention hold.
B:Assuming creating a Compliance Manager assessment proves every control is implemented. That caution concerns compliance manager; the specific misconception here is: Assuming deleting a file from the visible user interface always bypasses an active retention hold.
C:Assuming the audit portal can reconstruct events that were never retained. That caution concerns audit retention limits; the specific misconception here is: Assuming deleting a file from the visible user interface always bypasses an active retention hold.
Question 853
During a production cutover at a wholesale distributor, the identity administrator records this concrete requirement: A records team must apply item-level lifecycle instructions to selected content. The solution must address this requirement directly, without replacing unrelated controls. Which primary response BEST meets the requirement?
- Track the relevant Compliance Manager improvement action with an owner and evidence.
- Create and apply appropriate Purview retention labels, including records settings when relevant.
- Use Microsoft Purview Compliance Manager with relevant assessments and improvement actions.
- Use the Microsoft Purview portal to discover and administer supported compliance capabilities.
Explanation
Correct Answer
B:Create and apply appropriate Purview retention labels, including records settings when relevant. Retention labels associate lifecycle settings with individual items, whereas broad policies can target locations. To verify, inspect item labels and verify retained or disposition behavior on test content.
Incorrect Answers
A:Track the relevant Compliance Manager improvement action with an owner and evidence. That addresses a different task: a team must assign evidence and accountability for a specific compliance control gap. The present requirement concerns retention labels.
C:Use Microsoft Purview Compliance Manager with relevant assessments and improvement actions. That addresses a different task: a compliance officer needs structured assessments and improvement actions against a control framework. The present requirement concerns retention labels.
D:Use the Microsoft Purview portal to discover and administer supported compliance capabilities. That addresses a different task: compliance specialists need a central starting point for supported Purview data governance and compliance solutions. The present requirement concerns retention labels.
Question 854
During a production cutover at a wholesale distributor, the identity administrator records this concrete requirement: A records team must apply item-level lifecycle instructions to selected content. The solution must address this requirement directly, without replacing unrelated controls. The team implements the following response: Create and apply appropriate Purview retention labels, including records settings when relevant. Which evidence BEST verifies that the action met its stated purpose?
- Confirm the downloaded resource's service, scope, date, and relevance to the assessment.
- Map service privacy statements, choices, and contractual commitments to the use case.
- Inspect item labels and verify retained or disposition behavior on test content.
- Review policy scope, anonymization or privacy settings where available, and documented analyst actions.
Explanation
Correct Answer
C:Inspect item labels and verify retained or disposition behavior on test content. Retention labels associate lifecycle settings with individual items, whereas broad policies can target locations.
Incorrect Answers
A:Confirm the downloaded resource's service, scope, date, and relevance to the assessment. This would test service trust portal, whereas the required evidence is: Inspect item labels and verify retained or disposition behavior on test content.
B:Map service privacy statements, choices, and contractual commitments to the use case. This would test microsoft privacy principles, whereas the required evidence is: Inspect item labels and verify retained or disposition behavior on test content.
D:Review policy scope, anonymization or privacy settings where available, and documented analyst actions. This would test insider risk privacy safeguards, whereas the required evidence is: Inspect item labels and verify retained or disposition behavior on test content.
Question 855
Following a post-incident review at a healthcare cooperative, the compliance analyst has to defend a design against oversimplified assumptions. The requirement is: A records team must apply item-level lifecycle instructions to selected content. The review is limited to the control and concept described by this requirement. Which security, identity, or compliance principle MOST directly explains the appropriate approach?
- Audit answers what recorded activity occurred; eDiscovery addresses content preservation and legal search.
- Compliance Manager helps organize and track compliance work; it does not legally certify compliance.
- Compliance score reflects evaluated improvement-action progress rather than legal approval.
- Retention labels associate lifecycle settings with individual items, whereas broad policies can target locations.
Explanation
Correct Answer
D:Retention labels associate lifecycle settings with individual items, whereas broad policies can target locations. It explains why the selected measure—Create and apply appropriate Purview retention labels, including records settings when relevant—fits the specific requirement. It should be verified by checking: Inspect item labels and verify retained or disposition behavior on test content.
Incorrect Answers
A:Audit answers what recorded activity occurred; eDiscovery addresses content preservation and legal search. This describes audit versus ediscovery; the governing concept here is: Retention labels associate lifecycle settings with individual items, whereas broad policies can target locations.
B:Compliance Manager helps organize and track compliance work; it does not legally certify compliance. This describes compliance manager; the governing concept here is: Retention labels associate lifecycle settings with individual items, whereas broad policies can target locations.
C:Compliance score reflects evaluated improvement-action progress rather than legal approval. This describes compliance score; the governing concept here is: Retention labels associate lifecycle settings with individual items, whereas broad policies can target locations.
Question 856
Following a post-incident review at a healthcare cooperative, the compliance analyst has to defend a design against oversimplified assumptions. The requirement is: A records team must apply item-level lifecycle instructions to selected content. The review is limited to the control and concept described by this requirement. Which unsupported assumption would MOST directly undermine this requirement?
- Assuming a retention label is exactly the same mechanism as a sensitivity encryption label.
- Assuming a Purview audit event itself contains every full document required for litigation review.
- Assuming an assurance report for one service automatically covers unrelated customer workloads.
- Assuming moving personal data to a provider eliminates all customer privacy responsibilities.
Explanation
Correct Answer
A:Assuming a retention label is exactly the same mechanism as a sensitivity encryption label. This belief conflicts with this control principle: Retention labels associate lifecycle settings with individual items, whereas broad policies can target locations. The appropriate response instead is: Create and apply appropriate Purview retention labels, including records settings when relevant.
Incorrect Answers
B:Assuming a Purview audit event itself contains every full document required for litigation review. That caution concerns audit versus ediscovery; the specific misconception here is: Assuming a retention label is exactly the same mechanism as a sensitivity encryption label.
C:Assuming an assurance report for one service automatically covers unrelated customer workloads. That caution concerns third-party assurance reports; the specific misconception here is: Assuming a retention label is exactly the same mechanism as a sensitivity encryption label.
D:Assuming moving personal data to a provider eliminates all customer privacy responsibilities. That caution concerns data protection responsibilities; the specific misconception here is: Assuming a retention label is exactly the same mechanism as a sensitivity encryption label.
Question 857
During a pilot deployment at an investment advisory office, the SOC lead records this concrete requirement: A government office needs controlled record retention and eventual disposition review. The solution must address this requirement directly, without replacing unrelated controls. Which primary response BEST meets the requirement?
- Use the Microsoft Purview portal to discover and administer supported compliance capabilities.
- Use Microsoft Purview Insider Risk Management with lawful, configured indicators and review workflows.
- Use appropriate Microsoft Purview records management capabilities and configured labels.
- Access the Microsoft Service Trust Portal to retrieve available service trust and audit materials.
Explanation
Correct Answer
C:Use appropriate Microsoft Purview records management capabilities and configured labels. Records management supports defensible handling of formal records over their lifecycle. To verify, review record declaration, retention requirements, and disposition evidence where available.
Incorrect Answers
A:Use the Microsoft Purview portal to discover and administer supported compliance capabilities. That addresses a different task: compliance specialists need a central starting point for supported Purview data governance and compliance solutions. The present requirement concerns records management.
B:Use Microsoft Purview Insider Risk Management with lawful, configured indicators and review workflows. That addresses a different task: an organization wants to identify policy-defined patterns that could indicate risky employee data handling. The present requirement concerns records management.
D:Access the Microsoft Service Trust Portal to retrieve available service trust and audit materials. That addresses a different task: an assessor wants Microsoft service audit reports and compliance resources for cloud offerings. The present requirement concerns records management.
Question 858
During a pilot deployment at an investment advisory office, the SOC lead records this concrete requirement: A government office needs controlled record retention and eventual disposition review. The solution must address this requirement directly, without replacing unrelated controls. The team implements the following response: Use appropriate Microsoft Purview records management capabilities and configured labels. Which evidence BEST verifies that the action met its stated purpose?
- Verify access to the intended Purview solution and the associated permission scope.
- Validate the retained time range and actual presence of needed events in the audit search.
- Map service privacy statements, choices, and contractual commitments to the use case.
- Review record declaration, retention requirements, and disposition evidence where available.
Explanation
Correct Answer
D:Review record declaration, retention requirements, and disposition evidence where available. Records management supports defensible handling of formal records over their lifecycle.
Incorrect Answers
A:Verify access to the intended Purview solution and the associated permission scope. This would test microsoft purview portal, whereas the required evidence is: Review record declaration, retention requirements, and disposition evidence where available.
B:Validate the retained time range and actual presence of needed events in the audit search. This would test audit retention limits, whereas the required evidence is: Review record declaration, retention requirements, and disposition evidence where available.
C:Map service privacy statements, choices, and contractual commitments to the use case. This would test microsoft privacy principles, whereas the required evidence is: Review record declaration, retention requirements, and disposition evidence where available.
Question 859
Following a security operations retrospective at a research institute, the risk manager has to defend a design against oversimplified assumptions. The requirement is: A government office needs controlled record retention and eventual disposition review. The review is limited to the control and concept described by this requirement. Which security, identity, or compliance principle MOST directly explains the appropriate approach?
- Records management supports defensible handling of formal records over their lifecycle.
- Preservation controls guard evidence against ordinary deletion during a defined matter.
- Audit data availability depends on recording and retention configuration and entitlement.
- External assurance reports describe assessed provider controls during specified periods.
Explanation
Correct Answer
A:Records management supports defensible handling of formal records over their lifecycle. It explains why the selected measure—Use appropriate Microsoft Purview records management capabilities and configured labels—fits the specific requirement. It should be verified by checking: Review record declaration, retention requirements, and disposition evidence where available.
Incorrect Answers
B:Preservation controls guard evidence against ordinary deletion during a defined matter. This describes evidence preservation; the governing concept here is: Records management supports defensible handling of formal records over their lifecycle.
C:Audit data availability depends on recording and retention configuration and entitlement. This describes audit retention limits; the governing concept here is: Records management supports defensible handling of formal records over their lifecycle.
D:External assurance reports describe assessed provider controls during specified periods. This describes third-party assurance reports; the governing concept here is: Records management supports defensible handling of formal records over their lifecycle.
Question 860
Following a security operations retrospective at a research institute, the risk manager has to defend a design against oversimplified assumptions. The requirement is: A government office needs controlled record retention and eventual disposition review. The review is limited to the control and concept described by this requirement. Which unsupported assumption would MOST directly undermine this requirement?
- Assuming a general file search automatically preserves evidence from alteration or deletion.
- Assuming record status means the item can be freely changed or destroyed without governance.
- Assuming security encryption by itself answers every privacy transparency and data processing concern.
- Assuming exporting a copy once automatically enforces retention on every original source item.
Explanation
Correct Answer
B:Assuming record status means the item can be freely changed or destroyed without governance. This belief conflicts with this control principle: Records management supports defensible handling of formal records over their lifecycle. The appropriate response instead is: Use appropriate Microsoft Purview records management capabilities and configured labels.
Incorrect Answers
A:Assuming a general file search automatically preserves evidence from alteration or deletion. That caution concerns microsoft purview ediscovery; the specific misconception here is: Assuming record status means the item can be freely changed or destroyed without governance.
C:Assuming security encryption by itself answers every privacy transparency and data processing concern. That caution concerns microsoft privacy principles; the specific misconception here is: Assuming record status means the item can be freely changed or destroyed without governance.
D:Assuming exporting a copy once automatically enforces retention on every original source item. That caution concerns evidence preservation; the specific misconception here is: Assuming record status means the item can be freely changed or destroyed without governance.
Microsoft Security, Compliance, and Identity Fundamentals (SC-900) Practice Tests