Microsoft SC-401 Information Protection Client Scanner And Message Encryption Practice Test

 

Skill 1.3 • 50 original questions

This Microsoft SC-401 practice test focuses on information protection client scanner and message encryption through original scenario-based questions aligned to the active July 28, 2026 Microsoft Learn blueprint. Use the complete ExamSnap SC-401 collection for practice across information protection, DLP and retention, insider risk, investigations, and AI data security. For broader exam preparation, review the Microsoft SC-401 Exam Dumps page.

Instructions: Select the best answer for each question. Review the explanation after answering; every option includes a reason it is or is not the best fit.

Question 1

The governance board at A. Datum approves a control for Teams collaboration content on the condition that administrators can apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner. What should the team do to use the narrowest effective control? The organization wants to avoid granting broader permissions than the task requires. A regulatory assessment requires the organization to show both the technical control and evidence that administrators can review later. The security architect wants the implementation to remain understandable to operations staff after the project team leaves. The design review compares outcomes for 90 representative samples before production enablement.

1. Create a Microsoft Sentinel analytics rule for the activity.
2. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
3. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.
4. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
5. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Correct answer: E

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

B: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 2

Consolidated Messenger expects the volume of cloud application files to increase significantly. The control must scale while allowing the team to apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner. Which action best supports that objective and helps support investigation evidence? The design should not depend on users remembering an optional manual step. The organization is consolidating several pilot configurations and wants one supported pattern before retiring the temporary controls. The organization also requires separation of duties between policy authors and investigators wherever the product supports it. The rollout plan requires a measurable checkpoint after 127 protected items have been processed.

1. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
2. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
3. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
4. Change the Microsoft Entra Conditional Access policy for all users.
5. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Correct answer: E

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

E: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 3

A change request from Graphic Design Institute’s data governance department affects support tickets. The stated objective is to design and implement Microsoft Purview Message Encryption. Which administrative action is the strongest fit if the team must minimize administrative overhead? The security lead wants the configuration to align with the supported Microsoft workflow. A recent internal audit found that the documented control exists on paper but is not consistently implemented in the tenant. The governance board has rejected broad tenant-wide changes when a narrower supported scope can meet the same requirement. The rollout plan requires a measurable checkpoint after 164 protected items have been processed.

1. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
2. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
3. Use a broad tenant-wide retention policy to keep every item for the same period.
4. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.
5. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Correct answer: E

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

D: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 4

Wingtip Toys is replacing a manual process used by the finance team for support tickets. The replacement must design and implement Microsoft Purview Advanced Message Encryption. Which choice provides the most direct implementation while helping preserve least privilege? The implementation will be reviewed by both security and compliance stakeholders. A regional migration moved legacy records into Microsoft 365 and exposed inconsistent handling between teams. The rollout plan calls for simulation or observation first whenever the feature provides a supported way to do so. The first phase affects 20 users across two business units and must preserve normal collaboration.

1. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
2. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
3. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
4. Create a Microsoft Sentinel analytics rule for the activity.
5. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Correct answer: A

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

B: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

E: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 5

Graphic Design Institute’s risk management team is updating controls for email messages. The requirement is to apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner. The solution must also support investigation evidence. Which action should the administrator take? The organization wants to avoid granting broader permissions than the task requires. A regional migration moved legacy records into Microsoft 365 and exposed inconsistent handling between teams. Only the users and workloads named in the requirement should be affected during the first production phase. The design review compares outcomes for 57 representative samples before production enablement.

1. Change the Microsoft Entra Conditional Access policy for all users.
2. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
3. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
4. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
5. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.

Correct answer: D

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

B: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

E: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 6

At Humongous Insurance, a review of financial workbooks found a gap. The administrator must design and implement Microsoft Purview Advanced Message Encryption, while the project team wants to reduce false positives. What is the best next step? The security lead wants the configuration to align with the supported Microsoft workflow. An executive review asks the security team to reduce risk without blocking ordinary work that has a documented business purpose. The control owner will compare pilot telemetry with baseline activity before deciding whether to expand scope. The change is tracked under control batch SC401-3-006 and will be reviewed after the first week.

1. Use a broad tenant-wide retention policy to keep every item for the same period.
2. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
3. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
4. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
5. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.

Correct answer: B

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

B: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

C: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 7

A compliance exception at Proseware can be closed only after the tenant can manage files by using the Microsoft Purview Information Protection client for scanned forms. What should the administrator implement if the goal is to avoid unnecessary user disruption? The control must work with the organization’s existing Microsoft 365 governance model. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. The security architect wants the implementation to remain understandable to operations staff after the project team leaves. The control owner must document the result for governance record SC401-3-007 before widening scope.

1. Use Exact Data Match with a schema and hashed source data when policy decisions must match exact values from an authoritative data set rather than generic patterns.
2. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
3. Create a Microsoft Sentinel analytics rule for the activity.
4. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
5. Grant the least-privileged Purview information-protection role or role group needed to create and manage sensitivity labels instead of assigning broad tenant administrator rights.

Correct answer: D

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: EDM reduces false positives for known records by matching protected content against hashed values from a defined source table and schema instead of relying only on pattern recognition. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

D: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

E: Purview uses role-based access control; dedicated information-protection roles let administrators manage labels while preserving least privilege. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 8

The sales team at Wide World Importers has two competing proposals for scanned forms. Only one directly enables the tenant to manage files by using the Microsoft Purview Information Protection client. Which proposal should be chosen to avoid changing unrelated workloads? The control must work with the organization’s existing Microsoft 365 governance model. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. The support team needs clear evidence of what matched, which control acted, and what the user experienced. A support team will observe the first 168 policy evaluations to confirm expected behavior.

1. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
2. Create a custom sensitive information type with the required pattern, supporting evidence, confidence levels, and test data, then validate it before broad policy use.
3. Change the Microsoft Entra Conditional Access policy for all users.
4. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
5. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Correct answer: E

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: A reliable custom sensitive information type combines the primary match logic with supporting evidence and confidence settings so false positives can be controlled and the definition can be tested before enforcement. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

D: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 9

At Adventure Works, a review of email messages found a gap. The administrator must design and implement Microsoft Purview Message Encryption, while the project team wants to avoid changing unrelated workloads. What is the best next step? The pilot population is small today but the configuration must support a broader rollout. A pilot group uses a mixture of Office files, browser workflows, and collaboration sites, which makes a generic one-size-fits-all control unsuitable. The control owner will compare pilot telemetry with baseline activity before deciding whether to expand scope. The implementation will be tested against 24 representative files or events before sign-off.

1. Use Data Explorer for aggregated classification and labeling trends, and use Content Explorer with the required viewer permissions when item-level inspection is needed.
2. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
3. Use a broad tenant-wide retention policy to keep every item for the same period.
4. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
5. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.

Correct answer: D

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Data Explorer summarizes detected sensitive information and labels, while Content Explorer provides item-level visibility subject to additional content-viewing permissions. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

D: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

E: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 10

An incident review at Alpine Ski House shows that the current process for financial workbooks is incomplete. The team now needs to design and implement Microsoft Purview Message Encryption. Which action most directly addresses that need while helping minimize administrative overhead? Administrators need evidence they can review after deployment. A cloud-adoption project is moving a manual compliance process into Purview and needs a control that can be operated by delegated administrators. The organization also requires separation of duties between policy authors and investigators wherever the product supports it. The initial scope covers 61 managed objects and must remain measurable during rollout.

1. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
2. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
3. Create a Microsoft Sentinel analytics rule for the activity.
4. Grant the least-privileged Purview information-protection role or role group needed to create and manage sensitivity labels instead of assigning broad tenant administrator rights.
5. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.

Correct answer: A

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

B: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

D: Purview uses role-based access control; dedicated information-protection roles let administrators manage labels while preserving least privilege. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 11

At Woodgrove Bank, a review of employee files found a gap. The administrator must design and implement Microsoft Purview Message Encryption, while the project team wants to keep the design auditable. What is the best next step? The pilot population is small today but the configuration must support a broader rollout. A business acquisition introduced a second set of collaboration sites with different permissions and data-handling habits. The change window is limited, so the team prefers a native Purview capability over a custom automation layer. The first phase affects 98 users across two business units and must preserve normal collaboration.

1. Change the Microsoft Entra Conditional Access policy for all users.
2. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
3. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
4. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
5. Create a custom sensitive information type with the required pattern, supporting evidence, confidence levels, and test data, then validate it before broad policy use.

Correct answer: B

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

B: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

C: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: A reliable custom sensitive information type combines the primary match logic with supporting evidence and confidence settings so false positives can be controlled and the definition can be tested before enforcement. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 12

Wingtip Toys’s IT operations team is updating controls for engineering designs. The requirement is to plan and implement the Microsoft Purview Information Protection client. The solution must also preserve least privilege. Which action should the administrator take? The security lead wants the configuration to align with the supported Microsoft workflow. The incident response team wants future events to include enough telemetry to distinguish a true policy violation from normal business activity. The support team needs clear evidence of what matched, which control acted, and what the user experienced. The rollout plan requires a measurable checkpoint after 135 protected items have been processed.

1. Inventory the data, its locations, business sensitivity, and regulatory requirements before choosing a classifier or protection control.
2. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
3. Use a broad tenant-wide retention policy to keep every item for the same period.
4. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
5. Enable the Purview information-protection integration in Defender for Cloud Apps and use an appropriate file policy or governance action to apply a published sensitivity label to supported cloud files.

Correct answer: B

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Classification design starts with what data exists, where it resides, who uses it, and which legal or business rules make it sensitive; controls are selected only after those requirements are understood. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

C: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

D: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Defender for Cloud Apps can inspect connected cloud files and apply Purview sensitivity labels as governance actions when the integration, app connection, and label prerequisites are satisfied. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 13

1. Datum’s engineering team is updating controls for support tickets. The requirement is to design and implement Microsoft Purview Message Encryption. The solution must also support a phased rollout. Which action should the administrator take? The implementation will be reviewed by both security and compliance stakeholders. Security testing found that the current design produces too many manual escalations and gives investigators little useful context. Only the users and workloads named in the requirement should be affected during the first production phase. The design review compares outcomes for 172 representative samples before production enablement.
2. Create a Microsoft Sentinel analytics rule for the activity.
3. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
4. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
5. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
6. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.

Correct answer: C

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

B: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

D: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 14

During an audit at Woodgrove Bank, reviewers ask how the tenant will manage files by using the Microsoft Purview Information Protection client. The implementation should minimize administrative overhead. Which choice is most appropriate? The organization wants to avoid granting broader permissions than the task requires. A business acquisition introduced a second set of collaboration sites with different permissions and data-handling habits. The final design will be reviewed against least-privilege and data-minimization principles before broad enablement. The change is tracked under control batch SC401-3-014 and will be reviewed after the first week.

1. Use a trainable classifier for content that is best recognized by its semantic meaning, and train it with representative positive and negative examples before publishing it for policy use.
2. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
3. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
4. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
5. Change the Microsoft Entra Conditional Access policy for all users.

Correct answer: B

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: Trainable classifiers are suited to categories such as contracts or source code where meaning and context matter more than a fixed identifier pattern; representative examples improve the classifier. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

C: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 15

A proof of concept at Margie’s Travel will be accepted only if it can apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner for contract documents. The architect also wants to keep policy behavior predictable. Which option should be selected? Administrators need evidence they can review after deployment. Security testing found that the current design produces too many manual escalations and gives investigators little useful context. Only the users and workloads named in the requirement should be affected during the first production phase. The design review compares outcomes for 65 representative samples before production enablement.

1. Publish the required labels to the intended users or groups with a sensitivity label policy, and configure policy settings such as default labeling or mandatory labeling as needed.
2. Use a trainable classifier for content that is best recognized by its semantic meaning, and train it with representative positive and negative examples before publishing it for policy use.
3. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
4. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
5. Use a broad tenant-wide retention policy to keep every item for the same period.

Correct answer: C

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: Creating a label does not make it available to users by itself; a publishing policy targets the labels and policy behavior to the appropriate population. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Trainable classifiers are suited to categories such as contracts or source code where meaning and context matter more than a fixed identifier pattern; representative examples improve the classifier. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

D: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 16

An incident review at Blue Yonder Airlines shows that the current process for financial workbooks is incomplete. The team now needs to plan and implement the Microsoft Purview Information Protection client. Which action most directly addresses that need while helping keep policy behavior predictable? The control must work with the organization’s existing Microsoft 365 governance model. The organization is preparing for an external audit and must demonstrate that the selected feature matches the specific risk rather than an adjacent capability. The selected approach must preserve existing collaboration behavior unless the stated risk condition is actually present. The team has 102 historical events available for validation before enabling broader enforcement.

1. Use Data Explorer for aggregated classification and labeling trends, and use Content Explorer with the required viewer permissions when item-level inspection is needed.
2. Create a Microsoft Sentinel analytics rule for the activity.
3. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
4. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
5. Use Exact Data Match with a schema and hashed source data when policy decisions must match exact values from an authoritative data set rather than generic patterns.

Correct answer: C

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Data Explorer summarizes detected sensitive information and labels, while Content Explorer provides item-level visibility subject to additional content-viewing permissions. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

C: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

D: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: EDM reduces false positives for known records by matching protected content against hashed values from a defined source table and schema instead of relying only on pattern recognition. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 17

Northwind Traders expects the volume of employee files to increase significantly. The control must scale while allowing the team to manage files by using the Microsoft Purview Information Protection client. Which action best supports that objective and helps minimize administrative overhead? The control must work with the organization’s existing Microsoft 365 governance model. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. Only the users and workloads named in the requirement should be affected during the first production phase. The pilot starts with 139 users and expands only after the security team signs off.

1. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
2. Inventory the data, its locations, business sensitivity, and regulatory requirements before choosing a classifier or protection control.
3. Change the Microsoft Entra Conditional Access policy for all users.
4. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
5. Use a trainable classifier for content that is best recognized by its semantic meaning, and train it with representative positive and negative examples before publishing it for policy use.

Correct answer: D

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Classification design starts with what data exists, where it resides, who uses it, and which legal or business rules make it sensitive; controls are selected only after those requirements are understood. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

D: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

E: Trainable classifiers are suited to categories such as contracts or source code where meaning and context matter more than a fixed identifier pattern; representative examples improve the classifier. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 18

A Microsoft 365 administrator at Humongous Insurance is asked to improve protection of engineering designs. The success criterion is to plan and implement the Microsoft Purview Information Protection client. What should be done if the implementation must support investigation evidence? The control must work with the organization’s existing Microsoft 365 governance model. A pilot group uses a mixture of Office files, browser workflows, and collaboration sites, which makes a generic one-size-fits-all control unsuitable. The rollout plan calls for simulation or observation first whenever the feature provides a supported way to do so. The pilot starts with 176 users and expands only after the security team signs off.

1. Inventory the data, its locations, business sensitivity, and regulatory requirements before choosing a classifier or protection control.
2. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
3. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
4. Use a broad tenant-wide retention policy to keep every item for the same period.
5. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Correct answer: E

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Classification design starts with what data exists, where it resides, who uses it, and which legal or business rules make it sensitive; controls are selected only after those requirements are understood. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

E: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 19

A compliance exception at Humongous Insurance can be closed only after the tenant can design and implement Microsoft Purview Advanced Message Encryption for SharePoint documents. What should the administrator implement if the goal is to support a phased rollout? The security lead wants the configuration to align with the supported Microsoft workflow. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. The rollout plan calls for simulation or observation first whenever the feature provides a supported way to do so. The change is tracked under control batch SC401-3-019 and will be reviewed after the first week.

1. Use Data Explorer for aggregated classification and labeling trends, and use Content Explorer with the required viewer permissions when item-level inspection is needed.
2. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
3. Publish the required labels to the intended users or groups with a sensitivity label policy, and configure policy settings such as default labeling or mandatory labeling as needed.
4. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
5. Create a Microsoft Sentinel analytics rule for the activity.

Correct answer: D

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: Data Explorer summarizes detected sensitive information and labels, while Content Explorer provides item-level visibility subject to additional content-viewing permissions. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Creating a label does not make it available to users by itself; a publishing policy targets the labels and policy behavior to the appropriate population. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

E: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 20

For a new Microsoft 365 deployment at Blue Yonder Airlines, the collaboration services team is responsible for employee files. They are required to apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner. Which implementation is correct if they also want to use the narrowest effective control? The control must work with the organization’s existing Microsoft 365 governance model. A pilot group uses a mixture of Office files, browser workflows, and collaboration sites, which makes a generic one-size-fits-all control unsuitable. The control owner will compare pilot telemetry with baseline activity before deciding whether to expand scope. The rollout plan requires a measurable checkpoint after 69 protected items have been processed.

1. Enable the Purview information-protection integration in Defender for Cloud Apps and use an appropriate file policy or governance action to apply a published sensitivity label to supported cloud files.
2. Use Data Explorer for aggregated classification and labeling trends, and use Content Explorer with the required viewer permissions when item-level inspection is needed.
3. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
4. Change the Microsoft Entra Conditional Access policy for all users.
5. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Correct answer: E

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: Defender for Cloud Apps can inspect connected cloud files and apply Purview sensitivity labels as governance actions when the integration, app connection, and label prerequisites are satisfied. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Data Explorer summarizes detected sensitive information and labels, while Content Explorer provides item-level visibility subject to additional content-viewing permissions. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

E: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 21

At Consolidated Messenger, a review of scanned forms found a gap. The administrator must apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner, while the project team wants to avoid unnecessary user disruption. What is the best next step? The team wants the change to be reversible during pilot testing. A regional migration moved legacy records into Microsoft 365 and exposed inconsistent handling between teams. The team needs a configuration that can be justified from Microsoft-supported product behavior rather than an undocumented workaround. The change is tracked under control batch SC401-3-021 and will be reviewed after the first week.

1. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
2. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
3. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
4. Grant the least-privileged Purview information-protection role or role group needed to create and manage sensitivity labels instead of assigning broad tenant administrator rights.
5. Use a broad tenant-wide retention policy to keep every item for the same period.

Correct answer: A

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

B: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Purview uses role-based access control; dedicated information-protection roles let administrators manage labels while preserving least privilege. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 22

Woodgrove Bank’s sales team is updating controls for regulated case records. The requirement is to manage files by using the Microsoft Purview Information Protection client. The solution must also reduce false positives. Which action should the administrator take? The organization wants to avoid granting broader permissions than the task requires. A regulatory assessment requires the organization to show both the technical control and evidence that administrators can review later. Only the users and workloads named in the requirement should be affected during the first production phase. The team has 143 historical events available for validation before enabling broader enforcement.

1. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
2. Grant the least-privileged Purview information-protection role or role group needed to create and manage sensitivity labels instead of assigning broad tenant administrator rights.
3. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
4. Enable the Purview information-protection integration in Defender for Cloud Apps and use an appropriate file policy or governance action to apply a published sensitivity label to supported cloud files.
5. Create a Microsoft Sentinel analytics rule for the activity.

Correct answer: A

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

B: Purview uses role-based access control; dedicated information-protection roles let administrators manage labels while preserving least privilege. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Defender for Cloud Apps can inspect connected cloud files and apply Purview sensitivity labels as governance actions when the integration, app connection, and label prerequisites are satisfied. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 23

An incident review at Wide World Importers shows that the current process for regulated case records is incomplete. The team now needs to apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner. Which action most directly addresses that need while helping avoid changing unrelated workloads? Administrators need evidence they can review after deployment. A privacy review requires the security team to minimize unnecessary exposure of item-level content while still proving the control works. The support team needs clear evidence of what matched, which control acted, and what the user experienced. The team has 180 historical events available for validation before enabling broader enforcement.

1. Enable and scope OCR so Purview can extract text from supported images or scanned content and evaluate that extracted text with sensitive information types.
2. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
3. Use a trainable classifier for content that is best recognized by its semantic meaning, and train it with representative positive and negative examples before publishing it for policy use.
4. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
5. Change the Microsoft Entra Conditional Access policy for all users.

Correct answer: D

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: OCR extends classification beyond machine-readable text by extracting text from supported image content before sensitive information type evaluation. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Trainable classifiers are suited to categories such as contracts or source code where meaning and context matter more than a fixed identifier pattern; representative examples improve the classifier. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

E: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 24

A change request from Wingtip Toys’s finance department affects regulated case records. The stated objective is to plan and implement the Microsoft Purview Information Protection client. Which administrative action is the strongest fit if the team must support investigation evidence? The control must work with the organization’s existing Microsoft 365 governance model. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. The team needs a configuration that can be justified from Microsoft-supported product behavior rather than an undocumented workaround. The design review compares outcomes for 36 representative samples before production enablement.

1. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
2. Use a broad tenant-wide retention policy to keep every item for the same period.
3. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
4. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
5. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.

Correct answer: C

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

C: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

D: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 25

The governance board at Woodgrove Bank approves a control for customer records on the condition that administrators can plan and implement the Microsoft Purview Information Protection client. What should the team do to minimize administrative overhead? The organization wants to avoid granting broader permissions than the task requires. The organization is preparing for an external audit and must demonstrate that the selected feature matches the specific risk rather than an adjacent capability. The support team needs clear evidence of what matched, which control acted, and what the user experienced. The implementation will be tested against 73 representative files or events before sign-off.

1. Use a trainable classifier for content that is best recognized by its semantic meaning, and train it with representative positive and negative examples before publishing it for policy use.
2. Create a Microsoft Sentinel analytics rule for the activity.
3. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
4. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
5. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.

Correct answer: C

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Trainable classifiers are suited to categories such as contracts or source code where meaning and context matter more than a fixed identifier pattern; representative examples improve the classifier. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

C: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

D: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 26

For a new Microsoft 365 deployment at Fabrikam, the sales team is responsible for customer records. They are required to apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner. Which implementation is correct if they also want to keep the design auditable? The implementation will be reviewed by both security and compliance stakeholders. A pilot group uses a mixture of Office files, browser workflows, and collaboration sites, which makes a generic one-size-fits-all control unsuitable. The change window is limited, so the team prefers a native Purview capability over a custom automation layer. The change is tracked under control batch SC401-3-026 and will be reviewed after the first week.

1. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
2. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
3. Use Exact Data Match with a schema and hashed source data when policy decisions must match exact values from an authoritative data set rather than generic patterns.
4. Use a trainable classifier for content that is best recognized by its semantic meaning, and train it with representative positive and negative examples before publishing it for policy use.
5. Change the Microsoft Entra Conditional Access policy for all users.

Correct answer: B

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

C: EDM reduces false positives for known records by matching protected content against hashed values from a defined source table and schema instead of relying only on pattern recognition. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Trainable classifiers are suited to categories such as contracts or source code where meaning and context matter more than a fixed identifier pattern; representative examples improve the classifier. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 27

At Fabrikam, a review of contract documents found a gap. The administrator must design and implement Microsoft Purview Advanced Message Encryption, while the project team wants to reduce false positives. What is the best next step? The team wants the change to be reversible during pilot testing. The organization is consolidating several pilot configurations and wants one supported pattern before retiring the temporary controls. The team needs a configuration that can be justified from Microsoft-supported product behavior rather than an undocumented workaround. The change is tracked under control batch SC401-3-027 and will be reviewed after the first week.

1. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
2. Use a broad tenant-wide retention policy to keep every item for the same period.
3. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
4. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
5. Create a custom sensitive information type with the required pattern, supporting evidence, confidence levels, and test data, then validate it before broad policy use.

Correct answer: A

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

B: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

C: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: A reliable custom sensitive information type combines the primary match logic with supporting evidence and confidence settings so false positives can be controlled and the definition can be tested before enforcement. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 28

Blue Yonder Airlines’s sales team is updating controls for email messages. The requirement is to apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner. The solution must also minimize administrative overhead. Which action should the administrator take? Administrators need evidence they can review after deployment. A business acquisition introduced a second set of collaboration sites with different permissions and data-handling habits. The organization also requires separation of duties between policy authors and investigators wherever the product supports it. The rollout plan requires a measurable checkpoint after 184 protected items have been processed.

1. Create a Microsoft Sentinel analytics rule for the activity.
2. Inventory the data, its locations, business sensitivity, and regulatory requirements before choosing a classifier or protection control.
3. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
4. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.
5. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Correct answer: C

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

B: Classification design starts with what data exists, where it resides, who uses it, and which legal or business rules make it sensitive; controls are selected only after those requirements are understood. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

D: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 29

The compliance team at Margie’s Travel has two competing proposals for scanned forms. Only one directly enables the tenant to manage files by using the Microsoft Purview Information Protection client. Which proposal should be chosen to preserve least privilege? The organization wants to avoid granting broader permissions than the task requires. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. The organization also requires separation of duties between policy authors and investigators wherever the product supports it. The team has 40 historical events available for validation before enabling broader enforcement.

1. Publish the required labels to the intended users or groups with a sensitivity label policy, and configure policy settings such as default labeling or mandatory labeling as needed.
2. Grant the least-privileged Purview information-protection role or role group needed to create and manage sensitivity labels instead of assigning broad tenant administrator rights.
3. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.
4. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
5. Change the Microsoft Entra Conditional Access policy for all users.

Correct answer: D

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: Creating a label does not make it available to users by itself; a publishing policy targets the labels and policy behavior to the appropriate population. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Purview uses role-based access control; dedicated information-protection roles let administrators manage labels while preserving least privilege. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

E: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 30

The data governance team at Northwind Traders has two competing proposals for support tickets. Only one directly enables the tenant to design and implement Microsoft Purview Message Encryption. Which proposal should be chosen to keep the design auditable? The pilot population is small today but the configuration must support a broader rollout. A privacy review requires the security team to minimize unnecessary exposure of item-level content while still proving the control works. The team needs a configuration that can be justified from Microsoft-supported product behavior rather than an undocumented workaround. The change is tracked under control batch SC401-3-030 and will be reviewed after the first week.

1. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
2. Use a broad tenant-wide retention policy to keep every item for the same period.
3. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
4. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
5. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.

Correct answer: C

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

C: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

D: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 31

A Microsoft 365 administrator at Fourth Coffee is asked to improve protection of email messages. The success criterion is to design and implement Microsoft Purview Message Encryption. What should be done if the implementation must preserve least privilege? The team wants the change to be reversible during pilot testing. A privacy review requires the security team to minimize unnecessary exposure of item-level content while still proving the control works. The governance board has rejected broad tenant-wide changes when a narrower supported scope can meet the same requirement. The first phase affects 114 users across two business units and must preserve normal collaboration.

1. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
2. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
3. Publish the required labels to the intended users or groups with a sensitivity label policy, and configure policy settings such as default labeling or mandatory labeling as needed.
4. Create a Microsoft Sentinel analytics rule for the activity.
5. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.

Correct answer: A

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

B: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Creating a label does not make it available to users by itself; a publishing policy targets the labels and policy behavior to the appropriate population. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

E: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 32

The IT operations group at Adventure Works is preparing a production rollout involving financial workbooks. They specifically need to design and implement Microsoft Purview Advanced Message Encryption. What should be configured first to preserve least privilege? The security lead wants the configuration to align with the supported Microsoft workflow. Security testing found that the current design produces too many manual escalations and gives investigators little useful context. The change window is limited, so the team prefers a native Purview capability over a custom automation layer. The rollout plan requires a measurable checkpoint after 151 protected items have been processed.

1. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
2. Use Exact Data Match with a schema and hashed source data when policy decisions must match exact values from an authoritative data set rather than generic patterns.
3. Change the Microsoft Entra Conditional Access policy for all users.
4. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
5. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.

Correct answer: D

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: EDM reduces false positives for known records by matching protected content against hashed values from a defined source table and schema instead of relying only on pattern recognition. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

D: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

E: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 33

A proof of concept at Adventure Works will be accepted only if it can design and implement Microsoft Purview Message Encryption for financial workbooks. The architect also wants to reduce false positives. Which option should be selected? The control must work with the organization’s existing Microsoft 365 governance model. A new data-governance standard requires the configuration to work consistently across departments that have very different content volumes. The final design will be reviewed against least-privilege and data-minimization principles before broad enablement. The change is tracked under control batch SC401-3-033 and will be reviewed after the first week.

1. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
2. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
3. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
4. Use a broad tenant-wide retention policy to keep every item for the same period.
5. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Correct answer: A

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

B: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

E: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 34

Graphic Design Institute’s collaboration services team is updating controls for customer records. The requirement is to plan and implement the Microsoft Purview Information Protection client. The solution must also support a phased rollout. Which action should the administrator take? The design should not depend on users remembering an optional manual step. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. The rollout plan calls for simulation or observation first whenever the feature provides a supported way to do so. The pilot starts with 44 users and expands only after the security team signs off.

1. Create a Microsoft Sentinel analytics rule for the activity.
2. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
3. Publish the required labels to the intended users or groups with a sensitivity label policy, and configure policy settings such as default labeling or mandatory labeling as needed.
4. Enable and scope OCR so Purview can extract text from supported images or scanned content and evaluate that extracted text with sensitive information types.
5. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.

Correct answer: B

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

B: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

C: Creating a label does not make it available to users by itself; a publishing policy targets the labels and policy behavior to the appropriate population. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: OCR extends classification beyond machine-readable text by extracting text from supported image content before sensitive information type evaluation. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 35

During an audit at A. Datum, reviewers ask how the tenant will manage files by using the Microsoft Purview Information Protection client. The implementation should keep the design auditable. Which choice is most appropriate? The pilot population is small today but the configuration must support a broader rollout. A privacy review requires the security team to minimize unnecessary exposure of item-level content while still proving the control works. The organization also requires separation of duties between policy authors and investigators wherever the product supports it. The implementation will be tested against 81 representative files or events before sign-off.

1. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
2. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
3. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.
4. Change the Microsoft Entra Conditional Access policy for all users.
5. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.

Correct answer: A

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

B: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

E: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 36

Following a policy review, Fourth Coffee changes how customer records is governed. The new requirement is to design and implement Microsoft Purview Advanced Message Encryption. Which action is the best fit and will help keep policy behavior predictable? Administrators need evidence they can review after deployment. An executive review asks the security team to reduce risk without blocking ordinary work that has a documented business purpose. The team needs a configuration that can be justified from Microsoft-supported product behavior rather than an undocumented workaround. The first phase affects 118 users across two business units and must preserve normal collaboration.

1. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
2. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
3. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
4. Use a broad tenant-wide retention policy to keep every item for the same period.
5. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Correct answer: C

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

D: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

E: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 37

A proof of concept at Margie’s Travel will be accepted only if it can apply bulk classification to on-premises data by using the Microsoft Purview Information Protection scanner for engineering designs. The architect also wants to avoid unnecessary user disruption. Which option should be selected? The design should not depend on users remembering an optional manual step. Security testing found that the current design produces too many manual escalations and gives investigators little useful context. The change window is limited, so the team prefers a native Purview capability over a custom automation layer. The control owner must document the result for governance record SC401-3-037 before widening scope.

1. Use a trainable classifier for content that is best recognized by its semantic meaning, and train it with representative positive and negative examples before publishing it for policy use.
2. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
3. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
4. Grant the least-privileged Purview information-protection role or role group needed to create and manage sensitivity labels instead of assigning broad tenant administrator rights.
5. Create a Microsoft Sentinel analytics rule for the activity.

Correct answer: C

Why: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

Option review:

A: Trainable classifiers are suited to categories such as contracts or source code where meaning and context matter more than a fixed identifier pattern; representative examples improve the classifier. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This directly matches the requirement in the scenario.

D: Purview uses role-based access control; dedicated information-protection roles let administrators manage labels while preserving least privilege. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

Learning point: Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.

Question 38

A compliance exception at Humongous Insurance can be closed only after the tenant can plan and implement the Microsoft Purview Information Protection client for support tickets. What should the administrator implement if the goal is to keep the design auditable? The requirement applies to production data rather than a one-time demonstration. A business acquisition introduced a second set of collaboration sites with different permissions and data-handling habits. The governance board has rejected broad tenant-wide changes when a narrower supported scope can meet the same requirement. The change is tracked under control batch SC401-3-038 and will be reviewed after the first week.

1. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.
2. Enable the Purview information-protection integration in Defender for Cloud Apps and use an appropriate file policy or governance action to apply a published sensitivity label to supported cloud files.
3. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
4. Change the Microsoft Entra Conditional Access policy for all users.
5. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Correct answer: E

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Defender for Cloud Apps can inspect connected cloud files and apply Purview sensitivity labels as governance actions when the integration, app connection, and label prerequisites are satisfied. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

E: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 39

An incident review at Litware shows that the current process for contract documents is incomplete. The team now needs to design and implement Microsoft Purview Advanced Message Encryption. Which action most directly addresses that need while helping use the narrowest effective control? The control must work with the organization’s existing Microsoft 365 governance model. A cloud-adoption project is moving a manual compliance process into Purview and needs a control that can be operated by delegated administrators. The team needs a configuration that can be justified from Microsoft-supported product behavior rather than an undocumented workaround. The design review compares outcomes for 48 representative samples before production enablement.

1. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
2. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.
3. Use a broad tenant-wide retention policy to keep every item for the same period.
4. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
5. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.

Correct answer: A

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

B: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

D: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 40

A proof of concept at Fourth Coffee will be accepted only if it can manage files by using the Microsoft Purview Information Protection client for SharePoint documents. The architect also wants to reduce false positives. Which option should be selected? The design should not depend on users remembering an optional manual step. A pilot group uses a mixture of Office files, browser workflows, and collaboration sites, which makes a generic one-size-fits-all control unsuitable. The final design will be reviewed against least-privilege and data-minimization principles before broad enablement. The pilot starts with 85 users and expands only after the security team signs off.

1. Create a Microsoft Sentinel analytics rule for the activity.
2. Create sensitivity labels with the correct scope for files and emails, containers, or supported data assets so the label exposes settings that match the object being protected.
3. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.
4. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
5. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Correct answer: E

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

B: Label scope determines which settings are available: item labels can drive content protection, while container labels govern supported settings for Teams, groups, sites, and other scoped assets. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 41

A Microsoft 365 administrator at Contoso is asked to improve protection of regulated case records. The success criterion is to manage files by using the Microsoft Purview Information Protection client. What should be done if the implementation must minimize administrative overhead? The control must work with the organization’s existing Microsoft 365 governance model. The organization is consolidating several pilot configurations and wants one supported pattern before retiring the temporary controls. The governance board has rejected broad tenant-wide changes when a narrower supported scope can meet the same requirement. The team has 122 historical events available for validation before enabling broader enforcement.

1. Change the Microsoft Entra Conditional Access policy for all users.
2. Inventory the data, its locations, business sensitivity, and regulatory requirements before choosing a classifier or protection control.
3. Use Data Explorer for aggregated classification and labeling trends, and use Content Explorer with the required viewer permissions when item-level inspection is needed.
4. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
5. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.

Correct answer: D

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

B: Classification design starts with what data exists, where it resides, who uses it, and which legal or business rules make it sensitive; controls are selected only after those requirements are understood. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Data Explorer summarizes detected sensitive information and labels, while Content Explorer provides item-level visibility subject to additional content-viewing permissions. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

E: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.

Question 42

A security design workshop at Blue Yonder Airlines focuses on email messages. One mandatory capability is to plan and implement the Microsoft Purview Information Protection client. Which answer best aligns with Microsoft Purview while helping support investigation evidence? The pilot population is small today but the configuration must support a broader rollout. A cloud-adoption project is moving a manual compliance process into Purview and needs a control that can be operated by delegated administrators. The support team needs clear evidence of what matched, which control acted, and what the user experienced. The initial scope covers 159 managed objects and must remain measurable during rollout.

1. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
2. Create a custom sensitive information type with the required pattern, supporting evidence, confidence levels, and test data, then validate it before broad policy use.
3. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
4. Enable and scope OCR so Purview can extract text from supported images or scanned content and evaluate that extracted text with sensitive information types.
5. Use a broad tenant-wide retention policy to keep every item for the same period.

Correct answer: C

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: A reliable custom sensitive information type combines the primary match logic with supporting evidence and confidence settings so false positives can be controlled and the definition can be tested before enforcement. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

D: OCR extends classification beyond machine-readable text by extracting text from supported image content before sensitive information type evaluation. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 43

During an audit at Humongous Insurance, reviewers ask how the tenant will plan and implement the Microsoft Purview Information Protection client. The implementation should avoid unnecessary user disruption. Which choice is most appropriate? The requirement applies to production data rather than a one-time demonstration. The organization is preparing for an external audit and must demonstrate that the selected feature matches the specific risk rather than an adjacent capability. The security architect wants the implementation to remain understandable to operations staff after the project team leaves. The rollout plan requires a measurable checkpoint after 196 protected items have been processed.

1. Enable the Purview information-protection integration in Defender for Cloud Apps and use an appropriate file policy or governance action to apply a published sensitivity label to supported cloud files.
2. Map each requirement to a built-in sensitive information type when it fits, and use a custom sensitive information type when the built-in definitions do not represent the required pattern.
3. Create a Microsoft Sentinel analytics rule for the activity.
4. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
5. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.

Correct answer: D

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Defender for Cloud Apps can inspect connected cloud files and apply Purview sensitivity labels as governance actions when the integration, app connection, and label prerequisites are satisfied. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Built-in sensitive information types reduce custom maintenance, while custom types are appropriate when the organization has identifiers or evidence rules that Microsoft does not provide out of the box. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

D: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

E: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 44

A proof of concept at Northwind Traders will be accepted only if it can design and implement Microsoft Purview Advanced Message Encryption for support tickets. The architect also wants to keep policy behavior predictable. Which option should be selected? Administrators need evidence they can review after deployment. The incident response team wants future events to include enough telemetry to distinguish a true policy violation from normal business activity. The security architect wants the implementation to remain understandable to operations staff after the project team leaves. The initial scope covers 52 managed objects and must remain measurable during rollout.

1. Use Exact Data Match with a schema and hashed source data when policy decisions must match exact values from an authoritative data set rather than generic patterns.
2. Change the Microsoft Entra Conditional Access policy for all users.
3. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.
4. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
5. Use a container-scoped sensitivity label to enforce the supported governance settings for Teams, Microsoft 365 Groups, SharePoint sites, or Power BI items instead of relying on a file-only label.

Correct answer: D

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: EDM reduces false positives for known records by matching protected content against hashed values from a defined source table and schema instead of relying only on pattern recognition. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

C: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

E: Container-aware labels are designed to govern collaboration containers and supported service assets; their scope and settings differ from labels that protect the content of individual files and emails. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 45

Wingtip Toys’s sales team is updating controls for contract documents. The requirement is to design and implement Microsoft Purview Message Encryption. The solution must also keep the design auditable. Which action should the administrator take? Administrators need evidence they can review after deployment. A regional migration moved legacy records into Microsoft 365 and exposed inconsistent handling between teams. The support team needs clear evidence of what matched, which control acted, and what the user experienced. The control owner must document the result for governance record SC401-3-045 before widening scope.

1. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
2. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
3. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
4. Use a broad tenant-wide retention policy to keep every item for the same period.
5. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Correct answer: E

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

E: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 46

An incident review at Margie’s Travel shows that the current process for SharePoint documents is incomplete. The team now needs to design and implement Microsoft Purview Advanced Message Encryption. Which action most directly addresses that need while helping reduce false positives? The control must work with the organization’s existing Microsoft 365 governance model. The tenant has accumulated several overlapping policies, so the next change must have an unambiguous purpose and measurable outcome. The change window is limited, so the team prefers a native Purview capability over a custom automation layer. The control owner must document the result for governance record SC401-3-046 before widening scope.

1. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
2. Use Exact Data Match with a schema and hashed source data when policy decisions must match exact values from an authoritative data set rather than generic patterns.
3. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
4. Create an auto-labeling policy with the required content conditions, run it in simulation to review matches, and enable automatic application only after the results are acceptable.
5. Create a Microsoft Sentinel analytics rule for the activity.

Correct answer: C

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: EDM reduces false positives for known records by matching protected content against hashed values from a defined source table and schema instead of relying only on pattern recognition. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

D: Simulation provides a safer way to validate auto-labeling conditions and estimated impact before labels are automatically applied at scale. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 47

The legal team at Proseware has two competing proposals for Teams collaboration content. Only one directly enables the tenant to design and implement Microsoft Purview Advanced Message Encryption. Which proposal should be chosen to minimize administrative overhead? The team must be able to explain why the selected control addresses the stated risk. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. The security architect wants the implementation to remain understandable to operations staff after the project team leaves. The pilot starts with 163 users and expands only after the security team signs off.

1. Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.
2. Change the Microsoft Entra Conditional Access policy for all users.
3. Use Exact Data Match with a schema and hashed source data when policy decisions must match exact values from an authoritative data set rather than generic patterns.
4. Enable and scope OCR so Purview can extract text from supported images or scanned content and evaluate that extracted text with sensitive information types.
5. Create a custom sensitive information type with the required pattern, supporting evidence, confidence levels, and test data, then validate it before broad policy use.

Correct answer: A

Why: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

Option review:

A: Advanced Message Encryption adds flexible controls for externally shared encrypted email, including multiple branding templates and portal-based expiration or revocation for supported messages. This directly matches the requirement in the scenario.

B: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

C: EDM reduces false positives for known records by matching protected content against hashed values from a defined source table and schema instead of relying only on pattern recognition. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: OCR extends classification beyond machine-readable text by extracting text from supported image content before sensitive information type evaluation. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: A reliable custom sensitive information type combines the primary match logic with supporting evidence and confidence settings so false positives can be controlled and the definition can be tested before enforcement. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Use Advanced Message Encryption when external encrypted mail needs controls such as custom branding, portal access tracking, expiration, or administrator revocation.

Question 48

A pilot at A. Datum involves regulated case records. The security lead asks for a configuration that will design and implement Microsoft Purview Message Encryption. Which approach best satisfies the requirement and helps avoid unnecessary user disruption? The pilot population is small today but the configuration must support a broader rollout. A privacy review requires the security team to minimize unnecessary exposure of item-level content while still proving the control works. The organization also requires separation of duties between policy authors and investigators wherever the product supports it. The initial scope covers 200 managed objects and must remain measurable during rollout.

1. Enable the Purview information-protection integration in Defender for Cloud Apps and use an appropriate file policy or governance action to apply a published sensitivity label to supported cloud files.
2. Configure the label with the required encryption permissions and any headers, footers, or watermarks so protection and user-visible marking are applied consistently.
3. Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.
4. Deploy and configure the Purview Information Protection scanner, define repositories and a content scan job, and use the scanner to discover and classify supported on-premises files at scale.
5. Use a broad tenant-wide retention policy to keep every item for the same period.

Correct answer: C

Why: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

Option review:

A: Defender for Cloud Apps can inspect connected cloud files and apply Purview sensitivity labels as governance actions when the integration, app connection, and label prerequisites are satisfied. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: Sensitivity labels can combine encryption with content marking; the settings should reflect the required access controls and the organization’s visual handling requirements. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: Purview Message Encryption can be invoked through labeling and mail-flow conditions so sensitive mail is encrypted before delivery while authorized recipients can access it through supported experiences. This directly matches the requirement in the scenario.

D: The scanner is the appropriate bulk mechanism for supported on-premises repositories because it can inspect configured locations and apply classification or protection centrally. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Retention does not classify sensitive information or configure information-protection behavior; it addresses lifecycle requirements instead.

Learning point: Use sensitivity-label encryption or Exchange mail-flow rules with Microsoft Purview Message Encryption to protect messages that meet the organization’s external-sharing requirements.

Question 49

The risk management team at Fourth Coffee has two competing proposals for employee files. Only one directly enables the tenant to plan and implement the Microsoft Purview Information Protection client. Which proposal should be chosen to preserve least privilege? The organization wants to avoid granting broader permissions than the task requires. The service desk reports repeated user confusion about which protection step should occur before content leaves its normal workspace. The organization also requires separation of duties between policy authors and investigators wherever the product supports it. A support team will observe the first 56 policy evaluations to confirm expected behavior.

1. Use Data Explorer for aggregated classification and labeling trends, and use Content Explorer with the required viewer permissions when item-level inspection is needed.
2. Create a Microsoft Sentinel analytics rule for the activity.
3. Create a document fingerprint from the standard form or template so Purview can recognize completed documents that preserve the template structure.
4. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
5. Publish the required labels to the intended users or groups with a sensitivity label policy, and configure policy settings such as default labeling or mandatory labeling as needed.

Correct answer: D

Why: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

Option review:

A: Data Explorer summarizes detected sensitive information and labels, while Content Explorer provides item-level visibility subject to additional content-viewing permissions. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: A Sentinel analytics rule is a security detection control and does not implement the Purview information-protection requirement in this scenario.

C: Document fingerprinting is designed for forms and standardized templates; Purview derives a fingerprint from the template and detects documents that contain the same characteristic structure. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

D: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This directly matches the requirement in the scenario.

E: Creating a label does not make it available to users by itself; a publishing policy targets the labels and policy behavior to the appropriate population. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

Learning point: Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.

Question 50

An incident review at Wide World Importers shows that the current process for customer records is incomplete. The team now needs to manage files by using the Microsoft Purview Information Protection client. Which action most directly addresses that need while helping avoid changing unrelated workloads? The team wants the change to be reversible during pilot testing. A privacy review requires the security team to minimize unnecessary exposure of item-level content while still proving the control works. The organization also requires separation of duties between policy authors and investigators wherever the product supports it. The team has 93 historical events available for validation before enabling broader enforcement.

1. Grant the least-privileged Purview information-protection role or role group needed to create and manage sensitivity labels instead of assigning broad tenant administrator rights.
2. Deploy the Microsoft Purview Information Protection client to supported Windows endpoints that need File Explorer labeling or protection capabilities and configure it for the organization’s information-protection workflow.
3. Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.
4. Use Data Explorer for aggregated classification and labeling trends, and use Content Explorer with the required viewer permissions when item-level inspection is needed.
5. Change the Microsoft Entra Conditional Access policy for all users.

Correct answer: C

Why: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

Option review:

A: Purview uses role-based access control; dedicated information-protection roles let administrators manage labels while preserving least privilege. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

B: The client extends information-protection actions to supported Windows and file-management scenarios that require local classification and protection experiences. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

C: The client exposes file-level information-protection actions in supported Windows scenarios, allowing authorized users or administrators to apply and manage labels and protection. This directly matches the requirement in the scenario.

D: Data Explorer summarizes detected sensitive information and labels, while Content Explorer provides item-level visibility subject to additional content-viewing permissions. This is a valid Purview-related action, but it addresses a different objective than the one the scenario requires.

E: Conditional Access controls sign-in and session access but does not implement the requested Purview classification, labeling, or encryption function.

Learning point: Use the Purview Information Protection client to classify, label, protect, or inspect supported files according to the user’s rights and the organization’s label configuration.