Describe Insider Risk, eDiscovery, and Audit Capabilities in Microsoft Purview SC-900 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company's security team needs to investigate a potential security incident. They want to know who accessed a specific file in SharePoint and when. They have Microsoft 365 E5 licenses. What should they use?

   • AUse Insider Risk Management to review the user's risk score.
   • BCheck the SharePoint site's built-in usage reports.
   • CSearch the unified audit log in Microsoft Purview for the file access events.
   • DRun a Content Search for the file name in all SharePoint sites.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following can you specify when performing an audit log search in Microsoft Purview?

   • AA date range to filter activities
   • BA data loss prevention policy to enforce
   • CA sensitivity label to encrypt results
   • DA retention label to apply to results
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary purpose of eDiscovery in Microsoft Purview?

   • ATo manage user access permissions for compliance
   • BTo automatically delete sensitive data across the organization
   • CTo search for and export content from Microsoft 365 for legal investigations
   • DTo monitor user activities for security threats
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   An organization is involved in a legal dispute and needs to find all communications about a specific contract. The legal team wants to search across Exchange Online, SharePoint Online, and OneDrive for Business. They also need to preserve the results for potential litigation. What should they do?

   • ACreate a retention policy for all Exchange, SharePoint, and OneDrive content.
   • BUse Audit Log Search to find all activities related to the contract.
   • CRun a Content Search and export the results to a PST file for the legal team.
   • DCreate an eDiscovery case, run a Content Search across all the required locations, and place a hold on the sources that contain relevant items.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A legal team is handling a case that requires collecting data from multiple custodians, including email, documents, and Teams messages. They need to perform iterative searches to narrow down relevant content and then review and tag documents for relevance. The case is expected to be complex and long-running. What should they use in Microsoft Purview?

   • AeDiscovery (Premium) with custodian management, holds, review sets, and tagging.
   • BContent Search with export to a local folder for manual review.
   • CeDiscovery (Standard) with custodian management and holds.
   • DInsider Risk Management to monitor the custodians' activities during the investigation.
   Reveal Solution Discussion Select an answer first