Understand Microsoft Purview AB-900 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company is subject to regulations that require monitoring of employee communications for harassment, but also has strict privacy laws that limit how much employee communication can be reviewed. The company wants to comply with both requirements. What should they do?

   • AMonitor all employee communications without restrictions to ensure full compliance
   • BUse insider risk policies to monitor employee behavior without reviewing communications
   • CUse DLP policies to block all communications that might contain harassment
   • DConfigure communication compliance policies with targeted conditions and role-based access to minimize unnecessary review
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company is deploying a Microsoft 365 Copilot pilot and wants to ensure that sensitive data is not exposed in AI responses. The security team needs visibility into which sensitive data is being used in Copilot interactions and the ability to block access to certain sensitive content. What should they use?

   • AA standard DLP policy for Exchange Online only
   • BA retention policy for SharePoint sites
   • CA communication compliance policy for Teams
   • DMicrosoft Purview Data Security Posture Management (DSPM) for AI
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A company has a DLP policy that blocks sharing of documents containing credit card numbers. However, the policy is also blocking sharing of documents that contain credit card numbers in a test environment, which is not a real risk. The compliance team wants to allow sharing in the test environment while still blocking in production. What should they do?

   • ACreate a separate DLP policy for the test environment with an exception for that site, and keep the production policy unchanged.
   • BChange the DLP policy to only alert, not block, in all environments.
   • CDisable the DLP policy for the test environment and rely on user training.
   • DApply a sensitivity label to all documents with credit card numbers and use that label in the DLP policy.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A multinational company uses Microsoft 365 and has a mix of sensitive data: some is regulated by GDPR and must be retained for 5 years, and some is internal-only and should be deleted after 1 year. The company wants to ensure that GDPR-regulated data is not shared externally, while internal-only data can be shared with partners. They also want to minimize administrative overhead. What should they do?

   • AUse DLP policies only, without labels, to block external sharing of all sensitive data
   • BCreate a single sensitivity label for all data and apply a 5-year retention policy to everything
   • CUse insider risk policies to monitor external sharing and manually review each case
   • DCreate two sensitivity labels: 'GDPR' with encryption and a retention policy for 5 years, and 'Internal' with no encryption and a retention policy for 1 year. Configure DLP to block external sharing of 'GDPR' labeled content.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A financial services company is concerned about employees downloading large volumes of customer records to USB drives before resigning. They want to detect this behavior early and investigate without disrupting normal work. What should the company implement in Microsoft Purview?

   • AAn insider risk management policy that triggers on unusual file downloads and USB device usage
   • BA DLP policy that blocks all USB device usage
   • CA communication compliance policy that monitors email for keywords like 'resign'
   • DA retention policy that preserves all downloaded files for litigation
   Reveal Solution Discussion Select an answer first