Question 870 A Defender XDR incident and Cloud Apps policy alert reference the same user, file hash and period. How should investigators avoid duplicating response? Treat every alert source as a separate compromise and reset all tenant identities Close the Cloud Apps alert as harmless without examining the incident Correlate the shared evidence and manage the related activity within the incident workflow while preserving each signal Delete underlying raw activity after correlating the alerts Explanation Correct Answer C:Linked signals may describe one attack sequence, not unrelated incidents. Incorrect Answers A:Duplicate telemetry does not necessarily indicate independent breaches. B:An overlapping alert can add relevant cloud access context. D:Preserving evidence supports containment and retrospective analysis.
Question 871 An insurer needs to detect policy IDs composed of three letters, a dash, and nine digits in documents, with supporting keywords nearby. Which Purview configuration is appropriate? A sensitivity label that contains a single visible policy name A retention label that permanently preserves every document A custom sensitive information type with a regex pattern and supporting keyword evidence A label publishing policy scoped only to the insurance team Explanation Correct Answer C:Custom SITs can match structured identifiers with contextual elements. Incorrect Answers A:A label classification is not itself an expression for matching policy ID patterns. B:Retention controls lifecycle rather than detection syntax. D:Publishing makes labels available but does not define how to detect the identifier.
Question 872 A payment-card pattern matches randomly generated test data in thousands of engineering documents. What should improve precision before automated protection? Reduce the numeric pattern to any sequence of four digits Adjust supporting evidence, proximity, and match confidence using verified representative samples Apply a tenant-wide retention policy to all engineering files Assume every regex match is a real card number without validation Explanation Correct Answer B:Context near a candidate number helps distinguish actual payment data from coincidental strings. Incorrect Answers A:A broader pattern typically increases unwanted matches. C:Retention does not refine identification precision. D:Matching a format alone is insufficient proof of sensitive meaning.
Question 873 A new custom sensitive information type matches a sample customer ID but misses identifiers in production emails. What should the author examine? Widen the identifier expression to any alphanumeric run without testing false positives Actual message text, detection scope, regex boundaries, and proximity to required supporting elements Remove the supporting keyword condition for every rule without reviewing sample misses Publish the related sensitivity label to more users without changing the detector Explanation Correct Answer B:Pattern and context constraints may exclude legitimate variants. Incorrect Answers A:A broader expression can increase false positives while leaving the missing contextual requirement unresolved. C:Dropping context indiscriminately may cause many unrelated identifiers to match. D:Label visibility does not correct the sensitive information type pattern or its proximity rules.
Question 874 A research institute maintains several thousand proprietary project terms that should be detected consistently in documents. Which Purview data element is designed for a reusable large word list? The Microsoft 365 admin center's default domain list A keyword dictionary used by a custom sensitive information type A single retention policy covering the SharePoint tenant A sensitivity label display name containing all the terms Explanation Correct Answer B:The dictionary can provide curated vocabulary matching without hard-coding every word into a separate rule. Incorrect Answers A:Identity domains are not content classification terms. C:Retention does not maintain a vocabulary-based detector. D:A label title is not a scalable keyword matching engine.
Question 875 A bank wants detection of its real customer account numbers without flagging similar-looking numbers belonging to other banks. What classification strategy best fits supported data? Use an exact data match sensitive information type based on a securely managed reference dataset Turn off inspection in locations where false positives are common Use a generic nine-digit regex without supporting context Create one universal sensitivity label and apply it to every file Explanation Correct Answer A:EDM improves specificity by matching known sensitive values rather than every format-compatible number. Incorrect Answers B:Disabling detection prevents useful coverage instead of improving precision. C:A format-only detector can flag unrelated values. D:Applying a label is not equivalent to matching real customer identifiers.
Question 876 An administrator is preparing reference values for exact data match detection. What security consideration is fundamental? Store every reference value in a public SharePoint library for easy import Replace the dataset with random values unrelated to the protected records Email an unencrypted spreadsheet of live customer identifiers to the whole help desk Follow supported hashing, schema and privileged upload handling so raw sensitive reference data is not unnecessarily exposed Explanation Correct Answer D:An EDM setup must protect the source values used for matching. Incorrect Answers A:Public access contradicts the purpose of sensitive matching. B:Unrelated reference data would not detect actual customer values. C:Broad distribution unnecessarily exposes protected data.
Question 877 A compliance team needs to identify contracts with variable wording and layouts rather than a fixed identifier pattern. Which classification approach should be evaluated? Use one generic contract-related keyword as a required sensitive information pattern Use manual retention labeling alone as the automatic document-type detector A supported trainable classifier with representative positive and negative examples A single literal keyword guaranteed to appear in every contract Explanation Correct Answer C:Document-type recognition can use learned content signals when simple regex patterns are inadequate. Incorrect Answers A:Variable contract language makes a single broad keyword insufficiently precise for semantic classification. B:Human-applied lifecycle labels do not provide the requested content-recognition classifier. D:Variable layouts may not contain that one term.
Question 878 A Purview detector tags many harmless meeting notes as customer contracts. What review is most useful? Inspect matched content and classification evidence, then refine representative examples or rules Change the document library's site title only Shorten the retention period for every meeting note Delete the custom domain verification TXT record Explanation Correct Answer A:Reviewing concrete false positives targets the actual source of misclassification. Incorrect Answers B:A name change does not improve matched content semantics. C:Content lifecycle does not correct a document-type classifier. D:DNS ownership records are unrelated to content classification.
Question 879 The legal team needs protected files to retain confidentiality controls when shared outside the organization. Which Purview element should be configured? An Exchange accepted-domain list An organization-wide file retention policy without encryption A sensitivity label with appropriate encryption and usage rights for the intended recipients A Defender XDR endpoint vulnerability recommendation Explanation Correct Answer C:Labels can apply persistent protection to supported documents and email. Incorrect Answers A:SMTP domain recognition does not protect document content. B:Retention may preserve data but does not grant or restrict recipient usage rights. D:Endpoint posture guidance cannot enforce file recipient rights.
Question 880 A newly created sensitivity label is visible to compliance administrators but does not appear in Word for the intended staff. What should be checked? Whether the file has an unrelated retention policy Publish the sensitivity label to an administrators-only policy while expecting it to appear for department users in Word Whether the tenant's default browser is Edge The label publishing policy's included users/groups and completion of policy distribution Explanation Correct Answer D:Creating a label does not automatically publish it to every user. Incorrect Answers A:Retention does not make a sensitivity label visible in Office apps. B:A label must be published to its intended client/user audience; DNS mail routing has no role in label distribution. C:Browser selection is not the main determinant of label policy audience.
