Microsoft MS-102 Exam Dumps, Practice Test Questions

Open Content explorer with the necessary role and inspect sensitive information summaries. is directed at a separate task: A data steward needs to locate repositories containing identified sensitive information types. It does not produce the required configuration outcome: The event shows the relevant actor, time and labeling action.

Define and test the custom sensitive information type in Microsoft Purview with the required regex and evidence. implements a different mechanism for: Compliance needs to detect a proprietary employee identifier that follows a distinct pattern in documents. It does not configure the mechanism needed here: Use labeling activity evidence and appropriate audit history in Microsoft Purview.

Create a DLP policy targeting selected SharePoint locations and sensitive information. is directed at a separate task: Confidential documents uploaded to SharePoint must not be shared to anonymous recipients. It does not produce the required configuration outcome: The event shows the relevant actor, time and labeling action.

An attempted user deletion does not defeat the required retention obligation. would assess a different control. In this case it does not rule out the specific failure: A report shows only current label totals but not who changed an individual label.

Test content matching the intended identifier is detected while unrelated strings are not. is evidence of another system state: Compliance needs to detect a proprietary employee identifier that follows a distinct pattern in documents. The acceptance evidence here instead is: The event shows the relevant actor, time and labeling action.

The policy reports expected matches without immediately interrupting production actions. would assess a different control. In this case it does not rule out the specific failure: A report shows only current label totals but not who changed an individual label.

The protected keyword list was not updated to include the new alias. would fit a different circumstance involving: An organization wants to identify a short list of confidential project code words in stored content. Here the actual symptom is: A report shows only current label totals but not who changed an individual label.

The protected location was not under an effective preservation policy. is a plausible failure in another case: Required records disappear permanently after a user removes a file. It does not explain the current incident: A report shows only current label totals but not who changed an individual label.

The investigator did not distinguish a policy match from confirmed malicious intent. would fit a different circumstance involving: A protected endpoint file transfer produces alerts but the SOC must separate a real data leak from a benign test. Here the actual symptom is: A report shows only current label totals but not who changed an individual label.

Use a sensitive information type with a curated keyword list where appropriate. can be useful when an organization wants to identify a short list of confidential project code words in stored content. However, it does not specifically achieve: New eligible documents receive the default classification when the policy applies.

Use an appropriate retention configuration that preserves content throughout the required period. addresses another administrative need: A policy requires keeping content for seven years even when users try to delete it. This question instead requires the outcome: New eligible documents receive the default classification when the policy applies.

Use supported DLP test or simulation mode before turning on blocking actions. can be useful when a new DLP policy might disrupt legitimate workflows and must be assessed before enforcement. However, it does not specifically achieve: New eligible documents receive the default classification when the policy applies.

Open Content explorer with the necessary role and inspect sensitive information summaries. is directed at a separate task: A data steward needs to locate repositories containing identified sensitive information types. It does not produce the required configuration outcome: New eligible documents receive the default classification when the policy applies.

Apply the supported Purview retention setting for the content location and duration. implements a different mechanism for: A policy requires keeping content for seven years even when users try to delete it. It does not configure the mechanism needed here: Configure the supported default label in the user-targeted sensitivity label policy.

Configure a DLP policy with a supported OneDrive location and required sensitive-content conditions. is directed at a separate task: Employees store sensitive customer files in OneDrive and the organization wants targeted sharing protection. It does not produce the required configuration outcome: New eligible documents receive the default classification when the policy applies.

The steward identifies content locations associated with the defined sensitive information type. would assess a different control. In this case it does not rule out the specific failure: New files in the department remain unlabeled despite an approved default policy.

An attempted user deletion does not defeat the required retention obligation. is evidence of another system state: A policy requires keeping content for seven years even when users try to delete it. The acceptance evidence here instead is: New eligible documents receive the default classification when the policy applies.

The affected employee sees the intended policy explanation during a blocked action. would assess a different control. In this case it does not rule out the specific failure: New files in the department remain unlabeled despite an approved default policy.

The appropriate Content explorer visibility or permission was not available. would fit a different circumstance involving: A data steward needs to locate repositories containing identified sensitive information types. Here the actual symptom is: New files in the department remain unlabeled despite an approved default policy.

The protected keyword list was not updated to include the new alias. is a plausible failure in another case: Documents with a new project alias are not classified as sensitive. It does not explain the current incident: New files in the department remain unlabeled despite an approved default policy.

End-user policy tip notification settings were not enabled or scoped. would fit a different circumstance involving: A DLP policy detects genuine sensitive material but should inform employees why an action was blocked. Here the actual symptom is: New files in the department remain unlabeled despite an approved default policy.

Use Microsoft Purview Endpoint DLP with supported removable storage restrictions. can be useful when a security team must prevent copying regulated files from managed laptops to removable drives. However, it does not specifically achieve: A test external email containing a matching identifier is blocked or warned as intended.

Investigate DLP activity with user, file, destination and rule context. addresses another administrative need: A protected endpoint file transfer produces alerts but the SOC must separate a real data leak from a benign test. This question instead requires the outcome: A test external email containing a matching identifier is blocked or warned as intended.

Choose retention-label settings based on the intended retention trigger. can be useful when a legal group must distinguish a retention period that starts on creation from one based on a later event. However, it does not specifically achieve: A test external email containing a matching identifier is blocked or warned as intended.

Review the Endpoint DLP event details and supporting business context before disposition. is directed at a separate task: A protected endpoint file transfer produces alerts but the SOC must separate a real data leak from a benign test. It does not produce the required configuration outcome: A test external email containing a matching identifier is blocked or warned as intended.

Onboard eligible devices and configure an Endpoint DLP rule for copying protected content to USB. implements a different mechanism for: A security team must prevent copying regulated files from managed laptops to removable drives. It does not configure the mechanism needed here: Configure Purview DLP for Exchange Online with sensitive data conditions and actions.

Open Content explorer with the necessary role and inspect sensitive information summaries. is directed at a separate task: A data steward needs to locate repositories containing identified sensitive information types. It does not produce the required configuration outcome: A test external email containing a matching identifier is blocked or warned as intended.

The affected employee sees the intended policy explanation during a blocked action. would assess a different control. In this case it does not rule out the specific failure: Protected regulated identifiers leave through external email despite a DLP policy.

An eligible Copilot prompt or response scenario triggers the configured DLP protection. is evidence of another system state: An organization enables Copilot but must protect matching sensitive information within supported Microsoft 365 Copilot scenarios. The acceptance evidence here instead is: A test external email containing a matching identifier is blocked or warned as intended.

The report identifies label usage and relevant labeling events. would assess a different control. In this case it does not rule out the specific failure: Protected regulated identifiers leave through external email despite a DLP policy.

Endpoint DLP device onboarding or the removable-media rule is missing. would fit a different circumstance involving: A security team must prevent copying regulated files from managed laptops to removable drives. Here the actual symptom is: Protected regulated identifiers leave through external email despite a DLP policy.

End-user policy tip notification settings were not enabled or scoped. is a plausible failure in another case: Employees experience unexplained DLP restrictions without any configured policy tip. It does not explain the current incident: Protected regulated identifiers leave through external email despite a DLP policy.

Aggregated inventory counts were confused with historical labeling activity events. would fit a different circumstance involving: A data protection officer wants to prove that a label was changed by an employee on a certain day. Here the actual symptom is: Protected regulated identifiers leave through external email despite a DLP policy.