Question 920 An employee copies a sensitivity-labeled document to a supported storage location outside its original SharePoint site. What property should be evaluated? All encryption rights are determined solely by the new site's display name Whether the embedded file label and its protection remain effective for the copied content The file automatically becomes Public because the URL changed The document retention period always becomes zero after a copy Explanation Correct Answer B:File-level labels can provide protection beyond the original library location. Incorrect Answers A:Site labels and file encryption are distinct. C:A new location alone does not inherently strip file-level protection. D:A copy operation does not prove the new record has no retention controls.
Question 921 A partner had temporary rights to an encrypted file, but the project ended and access must be removed. What should the owner understand? Renaming the SharePoint library removes granted permissions on existing downloads Remove the partner from the project's SharePoint group but leave any separate sensitivity-label encryption permission intact The encryption authorization or protected access rights must be revoked or changed through supported controls; deleting a sharing link may be insufficient A sharing link deletion always cryptographically revokes every previously downloaded copy Explanation Correct Answer C:Persistent file protection and repository access can differ after a copy leaves the tenant. Incorrect Answers A:A library rename does not modify remote protected files. B:Resource group membership removal may not revoke independently granted rights to encrypted content; review access rights and key controls. D:Previously distributed encrypted files may retain the rights granted under protection.
Question 922 An organization applies an encrypting label successfully, but several approved staff cannot open the file. Which evidence is most relevant? A list of Exchange accepted domains without user identities The document author's preferred display language The label's configured rights, recipient identities, tenant configuration and effective client support The number of security incidents in Defender XDR that week Explanation Correct Answer C:File delivery alone does not ensure each recipient has decrypt access. Incorrect Answers A:Mail domain acceptance does not prove content rights. B:Language choice does not grant file decryption. D:Unrelated incident counts do not explain encryption authorization.
Question 923 A labeling requirement specifies an on-page Confidential watermark and a protected file, but the current label encrypts without adding markings. What should be added? The label's supported visual content-marking settings in addition to its encryption options A mailbox junk-mail rule to flag messages from the author A SharePoint recycle-bin policy that preserves older files A tenant-wide DNS CNAME named Confidential Explanation Correct Answer A:Visible marking and encryption are separately configurable label capabilities. Incorrect Answers B:Spam rules do not watermark documents. C:Retention of deleted items does not add visual classification text. D:DNS aliases cannot mark Office content.
Question 924 A compliance program wants Microsoft Purview sensitivity labels on supported Power BI assets as well as documents. What prerequisite deserves validation? Publish the sensitivity label only through Office desktop policy and assume supported Power BI assets automatically receive labeling Every Power BI dashboard automatically receives an Exchange mailbox label The Power BI sensitivity labeling integration, tenant settings, permissions and supported item types A SharePoint-only retention label applies to every data model Explanation Correct Answer C:Label support and governance differ by workload, so Office publishing alone may be insufficient. Incorrect Answers A:Power BI labeling may require its own tenant settings, supported item types, and appropriate rights for users and service connections. B:Mailbox settings do not label BI items. D:SharePoint records schedules cannot label all BI assets.
Question 925 Financial statements emailed outside the tenant need automatic confidentiality protection when detectors match, but ordinary internal status updates do not. What should be configured? A published label with no automatic conditions and no user action A supported Exchange auto-labeling policy with specific content conditions, location and exceptions Configure an outgoing transport disclaimer for detected financial documents, treating the footer as equivalent to enforcing encryption A blanket retain-forever rule for all Exchange messages Explanation Correct Answer B:Targeted conditions avoid broad encryption of unrelated messages. Incorrect Answers A:Creation alone does not apply labels automatically to matching mail. C:A disclaimer may warn recipients but does not apply the confidentiality rights and encryption required for matching content. D:Preservation does not apply confidentiality protection based on content.
Question 926 A compliance team recognizes complex legal documents using a trainable classifier but wants authors to decide final confidentiality level. Which approach fits? Silently impose the highest encryption label on all documents regardless of results Use the classifier as a supported recommendation or classification signal while preserving an authorized confirmation step Use only document file extensions to infer contractual sensitivity Publish a retention policy alone and assume it recommends labels in Word Explanation Correct Answer B:Recognizing document type and choosing final protection can be separated. Incorrect Answers A:A blanket automatic action ignores document variation and approval requirements. C:Extensions cannot reliably represent document content. D:Retention policy publication does not substitute for classification guidance.
Question 927 A partner has access to a labeled SharePoint site and downloads a document whose file-level protection is blank. What security gap may remain? File-level rights can be inferred from the site's URL suffix alone The file may lack persistent sensitivity protection outside the site's access boundary The site label automatically encrypts every historic file stored on the site All external sharing is automatically blocked by every site sensitivity label Explanation Correct Answer B:Site governance can restrict workspace access without embedding encryption in every file. Incorrect Answers A:A URL does not specify encryption permissions. C:Container settings do not imply file-level encryption for all files. D:Container label effects depend on selected settings.
Question 928 A compliance scan misses certain protected files that require specialized decryption rights. Which check should precede changing the detector? Confirm workload support, scanner access to protected content and any required protected-file inspection permissions Change the tenant's Teams meeting policy Delete all existing sensitivity labels to simplify the scan Assume the custom regex is wrong whenever encrypted content is not inspected Explanation Correct Answer A:Inaccessible file bytes can prevent accurate inspection even if the detection pattern is correct. Incorrect Answers B:Meeting configuration does not grant file content inspection permissions. C:Removing protection is unsafe and does not validate scanning authorization. D:Lack of visibility is distinct from a bad expression.
Question 929 A records officer discovers an HR termination date was entered incorrectly after event-based retention began. What should be reassessed? Inspect the affected user's mail-authentication records instead of the event-date metadata Change every HR retention label's duration instead of verifying the triggering event date for affected records The count of devices onboarded to Defender for Endpoint The triggering business event record and its effect on the affected labeled items' retention schedule Explanation Correct Answer D:Incorrect event timing can change legally required disposal dates. Incorrect Answers A:Email authentication records cannot establish whether event-based content retention began on an incorrect business event date. B:Broad retention-policy edits are inappropriate when the suspected error is an event date applied to particular labeled items. C:Endpoint count does not establish document retention start dates.
Question 930 Staff can manually label a document as a Contract, but other SharePoint content must be held for a statutory term even when nobody applies a label. What complementary feature is useful? A dashboard report listing available contract labels A Cloud Discovery risk score for SharePoint A location-scoped retention policy for the content that must be preserved independently of manual labeling A client update channel assignment for legal staff Explanation Correct Answer C:Policy-based coverage can enforce baseline preservation without a user classification action. Incorrect Answers A:Reporting label choices does not preserve unlabeled files. B:SaaS vendor risk does not enforce document preservation. D:Office versions are not a content retention rule.
