Task 4.3: Describe information protection, data lifecycle management, and data governance capabilities of Microsoft Purview

• ASupporting elements

  Correct

  Supporting elements are corroborating evidence, such as a keyword near the number, that increases confidence in a match.

• BThe primary element

  Incorrect

  The primary element is the main thing the SIT looks for, here the nine-digit pattern itself.

• CThe confidence level

  Incorrect

  The confidence level reflects how much supporting evidence was found; it doesn't hold the evidence.

• DProximity

  Incorrect

  Proximity sets how many characters may separate the supporting element from the primary element.

Every sensitive information type is defined by a primary element (a regular expression, keyword list, keyword dictionary or function), supporting elements that corroborate a match, a confidence level that reflects how much supporting evidence was found, and proximity, the maximum distance in characters between the supporting and primary elements.

• AA custom sensitive information type built on a regular expression

  Incorrect

  Custom SITs rely on patterns such as regular expressions and keywords, which these letters don't have.

• BAn exact data match classifier fed from the firm's client database

  Incorrect

  An exact data match classifier doesn't recognize a kind of document such as these letters.

• CThe pretrained classifier for legal agreements such as engagement letters

  Incorrect

  Pretrained classifiers cover broad categories; they wouldn't single out the firm's own engagement letters among other legal documents.

• DA custom trainable classifier seeded with sample engagement letters

  Correct

  Trainable classifiers learn what an item is from samples, which suits content unique to an organization, and can drive auto-labeling.

Trainable classifiers use AI and machine learning to classify data, which is most useful for content unique to an organization, such as specific kinds of contracts, where pattern matching isn't enough. A custom classifier is seeded with samples that are and aren't in the category, verified and then published; it can be a condition for sensitivity label auto-labeling.

• AContent explorer

  Incorrect

  Content explorer shows a current snapshot of items that have a label or sensitive information, not what users did with them.

• BCompliance Manager

  Incorrect

  Compliance Manager tracks controls and improvement actions for regulations, not user activity on files.

• CAn eDiscovery review set

  Incorrect

  A review set holds collected items for legal review; it doesn't track label changes and file copies.

• DActivity explorer

  Correct

  Activity explorer monitors activities such as label downgrades and copies to removable media, including signals from endpoint DLP.

The Explorers in Microsoft Purview Information Protection offer two views. Content explorer is a snapshot of items with a sensitivity label, a retention label or a sensitive information type. Activity explorer shows what users are doing with that content, such as label changes and downgrades, copies to removable media or network shares, and printing on endpoints.

• AA five-year retention policy on the site, plus a ten-year retention label on the contracts

  Correct

  A policy covers the whole site efficiently, and labels set item-level retention that travels within the tenant.

• BA ten-year retention policy on the whole site

  Incorrect

  This keeps every document ten years, and a policy's settings don't travel with an item that's moved out of the site.

• CA five-year retention label applied by hand to every document, plus a ten-year label on the contracts

  Incorrect

  This works, but labeling every document by hand is more effort than one policy on the site.

• DA sensitivity label on the contracts that encrypts them for ten years

  Incorrect

  Sensitivity labels classify and protect content; keeping and deleting it is what retention settings do.

Retention policies assign the same retention settings to content at a site or mailbox level; items inherit them from their container, and the settings don't travel if an item moves. Retention labels assign settings at the item level and travel with the content within the Microsoft 365 tenant. A site that keeps everything five years and some items ten is best served by a policy plus labels.

• AIt stays in the document's metadata and travels with it

  Correct

  Sensitivity labels are persistent: stored in the content's metadata, they move with it wherever it goes.

• BIt's removed when the document leaves Microsoft 365

  Incorrect

  Labels are persistent and move with the content.

• CIt stays only in the SharePoint library where it was applied

  Incorrect

  The label is stored in the document itself, not in the library.

• DIt's replaced by the recipient organization's default label

  Incorrect

  A labeled item keeps its label when it's shared.

Sensitivity labels in Microsoft Purview Information Protection are customizable, stored in clear text in the content's metadata, and persistent: once applied, the label and its protection settings move with the email or document wherever it goes, and become the basis for applying and enforcing policies.

• AAs many as its sensitive information types

  Incorrect

  Sensitive information types don't each add a label.

• BTwo: one for encryption and one for content marking

  Incorrect

  A single label carries all the protection settings an item gets.

• COnly one

  Correct

  Each item that supports sensitivity labels can have only one label applied at any given time.

• DUp to five, applied in priority order

  Incorrect

  There's no stacking of labels on one item.

Each item that supports sensitivity labels can have only one label applied at any given time, so that one label's settings define all of the item's protection.

• ARetain-only

  Incorrect

  Retain-only keeps content forever or for a period, without deleting it afterward.

• BRetain and then delete

  Correct

  This keeps content for a specified period and then permanently deletes it.

• CDelete-only

  Incorrect

  Delete-only removes content after a period without guaranteeing it's kept until then.

• DA sensitivity label with encryption

  Incorrect

  Encryption protects content; it doesn't keep or delete it.

Data Lifecycle Management combines two actions, retaining and deleting, into three outcomes: retain-only (forever or for a period), delete-only (after a period) and retain and then delete. Retained content stays in place, and a copy is kept in a secure location if people edit or delete it.

• ANothing, because DLP doesn't cover Teams chats

  Incorrect

  DLP extends to Teams chat and channel messages, including private channels.

• BAn email from the compliance team the next day

  Incorrect

  The user sees a policy tip on the message itself.

• CA policy tip explaining why it was blocked, with a link to learn what to do

  Correct

  DLP shows policy tips in Teams so users understand why a policy was triggered.

• DA sensitivity label added to the chat

  Incorrect

  Blocking a message is a DLP action; it doesn't label the chat.

Data loss prevention covers Microsoft Teams chat and channel messages, in messages or files, including private channels. Like in Exchange, SharePoint and OneDrive, DLP policy tips show users why a policy was triggered, for example when a message containing a Social Security number is blocked, with a link to learn more.