Question 930 Staff can manually label a document as a Contract, but other SharePoint content must be held for a statutory term even when nobody applies a label. What complementary feature is useful? A dashboard report listing available contract labels A Cloud Discovery risk score for SharePoint A location-scoped retention policy for the content that must be preserved independently of manual labeling A client update channel assignment for legal staff Explanation Correct Answer C:Policy-based coverage can enforce baseline preservation without a user classification action. Incorrect Answers A:Reporting label choices does not preserve unlabeled files. B:SaaS vendor risk does not enforce document preservation. D:Office versions are not a content retention rule.
Question 931 A file owner removes a Confidential sensitivity label and claims it was required for external collaboration. What evidence helps compliance evaluate the action? Only the current file size in kilobytes Label audit/activity events, the recorded downgrade justification where configured, and approved business context Check only tenant-wide label publication counts instead of the user's specific label-change audit event Only whether the organization's default language is English Explanation Correct Answer B:The review needs both action evidence and an accountable reason. Incorrect Answers A:Size cannot explain the classification decision. C:Policy distribution metrics do not demonstrate who removed a particular sensitivity label or what justification was supplied. D:Display language does not establish a compliant downgrade.
Question 932 An administrator has excluded external contractors from a sensitivity label publishing policy, but old files created by them still display that label. What must be distinguished? Publishing scope always scrubs the label from every existing file immediately A tenant account cannot ever be removed from a publishing policy Availability of a label to users versus labels already embedded in existing protected content Only changing the tenant default domain can remove an applied label Explanation Correct Answer C:Removing a publishing assignment does not necessarily erase historical file protection. Incorrect Answers A:Policy targeting is not a universal content unlabeling job. B:Assignments can be managed independently of existing file labels. D:Identity suffix management does not rewrite file classification.
Question 933 A research unit requires a specialized classification label that general staff must not see when creating documents. Which administrative decision addresses availability? Publish that label to the intended research group through an appropriate label policy Publish the specialized label to all users then rely on training to keep it out of ordinary menus Apply a group-based device compliance policy instead Include the label in an organization-wide policy for everyone Explanation Correct Answer A:Policy audience can restrict which labels appear to which users. Incorrect Answers B:A label visible to all users does not meet the requirement to restrict its availability to the intended research group. C:Device posture cannot publish Purview sensitivity labels. D:Publishing tenant-wide defeats the requested audience separation.
Question 934 An automatic labeling policy was activated this morning, but reports show few labeled documents. What should be evaluated before judging adoption failure? Delete any policies with no events in the first hour Processing cadence, supported content eligibility, policy scope and reporting delay Assume every unlabeled file proves the policy configuration has failed Rename the policy to force immediate labeling on all sites Explanation Correct Answer B:At-rest scanning and telemetry publication may not be instantaneous. Incorrect Answers A:Premature removal prevents proper deployment validation. C:Some content may be outside scope or processing may be pending. D:A display-name change does not inherently accelerate processing.
Question 935 A business owner requests that encrypted Highly Confidential files be accessible to all external guests. What approval consideration is essential? Enable tenant-wide anonymous sharing links without verifying each document's label encryption rights Approve the request because encryption guarantees all recipients are trusted Replace all sensitivity labels with a single Public value Validate legitimate recipient needs, label encryption rights, and the risk of overbroad guest permissions before changing policy Explanation Correct Answer D:Protected content must still follow least privilege and authorized sharing requirements. Incorrect Answers A:SharePoint sharing settings do not automatically authorize decryption for all guest identities and can overexpose confidential content. B:Encryption protects content but broad rights can still expose it. C:Removing classifications sacrifices data-handling distinctions.
Question 936 A retailer wants to stop employees sending unencrypted customer payment-card numbers through Exchange Online. Which control should be configured? Retain payment-related messages for the required records schedule while leaving unencrypted card-number sending permitted A Microsoft Defender phishing policy that blocks spoofed sender domains A sensitivity label policy that merely lists Confidential as an optional choice An Exchange Online DLP policy using the appropriate sensitive information type and a blocking rule Explanation Correct Answer D:DLP can inspect supported outgoing mail content and enforce a match-based action. Incorrect Answers A:Retention preserves content; preventing sensitive data from leaving by mail requires a DLP condition and enforcement action. B:Anti-phishing protects against impersonation rather than this content-based outbound rule. C:An optional label alone does not stop a sensitive message from being sent.
Question 937 A DLP rule blocks sensitive phrases in Teams chats but the same data can still be shared as a document from the Team's site. What coverage should be added? Apply the Teams message rule twice to all chat users A supported SharePoint and OneDrive DLP location policy for the stored documents Replace a sensitivity label's watermark text Disable external meeting attendees in Teams while leaving sensitive document sharing links from OneDrive and SharePoint unrestricted Explanation Correct Answer B:Teams messages and SharePoint-backed files can require distinct location coverage. Incorrect Answers A:Duplicate chat scoping does not necessarily inspect every file stored in SharePoint. C:Watermark formatting does not enforce external file sharing controls. D:Meeting admission controls cannot enforce DLP conditions for files shared from cloud document stores.
Question 938 A SharePoint library includes documents with national identity numbers; external guests should not read matching files. Which policy response best fits? Automatically delete identified documents according to a short retention schedule rather than restrict guests' access to matching sensitive content Make the SharePoint site publicly discoverable but change group names Enable only a label usage report for the library Apply a SharePoint DLP rule with a supported restrict-access action for matching sensitive content Explanation Correct Answer D:DLP can restrict sharing/access to eligible sensitive documents. Incorrect Answers A:Retention deletion cannot replace the immediate SharePoint DLP restrict-access action required for guests. B:Discovery settings do not filter individual sensitive documents. C:Reporting classifications does not block guests accessing content.
Question 939 An employee stores sensitive client spreadsheets in OneDrive and tries to generate anonymous links. Which policy location needs inclusion? Only the Microsoft 365 tenant's organization profile Scope the DLP rule only to Exchange mailboxes while omitting the OneDrive account sharing location OneDrive accounts in the applicable Microsoft Purview DLP policy Only a Teams meeting chat location Explanation Correct Answer C:OneDrive is a supported data location and should be explicitly included for the scoped users. Incorrect Answers A:Organization metadata does not inspect file content. B:An email-only location does not inspect or restrict external links generated from a user's OneDrive files. D:Meeting messages are not the storage path for the OneDrive spreadsheet.
Question 940 A financial analyst exports a Power BI report containing restricted records for an external recipient. Which governance question should be reviewed? Whether a SharePoint site uses a short retention period Rely solely on Exchange mail DLP while omitting supported Power BI DLP coverage Whether supported Purview DLP policies for Power BI and relevant report sensitivity labels govern this workflow Inspect managed laptop antivirus posture instead of verifying DLP coverage for supported Power BI report export or sensitivity labels Explanation Correct Answer C:Power BI content and export controls require workload-appropriate policy coverage. Incorrect Answers A:Site retention alone cannot govern all Power BI report exports. B:Email enforcement cannot be assumed to inspect actions involving sensitive Power BI reports. D:Device malware signatures are independent of report-level content sensitivity and applicable Purview policy actions.
