Q01 - Question
A healthcare organization stores large volumes of data in Microsoft 365. Leadership is concerned about data leaks, noncompliance with HIPAA and GDPR, and internal misuse of sensitive information. They want one unified solution for data governance, information protection, and compliance management across Microsoft 365 and beyond. Which solution should you recommend?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. Microsoft Graph
- B. Microsoft Purview
- C. SharePoint Admin Center
- D. Microsoft 365 Copilot
B is correct.
Explanation: Microsoft Purview is Microsoft's unified solution for data governance, information protection, and compliance management across Microsoft 365 and beyond. It addresses risks such as data leaks, regulatory noncompliance, and internal misuse of sensitive information.
A is incorrect: Microsoft Graph is the centralized data-access layer for Microsoft 365. It enforces access-control checks on queries, but it isn't the governance and compliance solution.
C is incorrect: SharePoint Admin Center provides sharing reports for SharePoint content. It doesn't provide unified governance and compliance management across Microsoft 365 and beyond.
D is incorrect: Microsoft 365 Copilot helps users work with content stored across Microsoft 365 services. It inherits the user's access controls and isn't a governance solution.
Q02 - Question
Your organization adopted hybrid work, cloud storage, and AI-enabled workplace tools. The security team wants to evaluate the Microsoft Purview capabilities that support compliance, data protection, and insider risk in Microsoft 365. Which set of capabilities should the team evaluate?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. Microsoft Graph, PowerShell, and SharePoint Admin Center sharing reports
- B. Microsoft 365 Copilot, Microsoft Graph, and Microsoft 365 Admin Center
- C. Insider Risk Management, Data Loss Prevention (DLP), Communication Compliance, and Activity Explorer
- D. SharePoint Admin Center, Microsoft 365 Admin Center, and Microsoft Graph API
C is correct.
Explanation: Within Microsoft 365, Microsoft Purview provides a unified platform for compliance, data protection, and insider risk. It includes Insider Risk Management, Data Loss Prevention (DLP), Communication Compliance, and Activity Explorer.
A is incorrect: Microsoft Graph, PowerShell, and SharePoint sharing reports help audit and report on access. They aren't the Purview capabilities for insider risk and data protection.
B is incorrect: Microsoft 365 Copilot is a productivity tool that inherits user permissions. Microsoft Graph is a data-access layer. Neither is a Purview insider risk capability.
D is incorrect: The admin centers and Microsoft Graph API support sharing reports and access audits. They don't make up the Purview set for compliance, data protection, and insider risk.
Q03 - Question
A compliance officer must report the organization's posture against a specific regulation. The officer needs a structured assessment that separates Microsoft-managed and customer-managed controls, lists improvement actions, and shows a score. Which Microsoft Purview tool should the officer use?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. Data Explorer
- B. eDiscovery Standard
- C. Data Security Posture Management for AI
- D. Compliance Manager
D is correct.
Explanation: Compliance Manager provides structured assessments tailored to regulations. These assessments include Microsoft-managed and customer-managed controls, improvement actions, and a Compliance Score.
A is incorrect: Data Explorer helps you discover, visualize, filter, and analyze sensitive information across locations. It doesn't provide regulation-based assessments or a Compliance Score.
B is incorrect: eDiscovery Standard provides search, export, and legal holds for legal requests and investigations. It doesn't measure compliance posture against a regulation.
C is incorrect: Data Security Posture Management for AI provides visibility into AI interactions and shadow AI usage. It doesn't provide regulation-based assessments with improvement actions.
Q04 - Question
An admin needs to find where sensitive information is stored across SharePoint, Teams, and OneDrive. The admin wants to visualize the results, filter by location, and analyze the findings before planning protection controls. Which Microsoft Purview tool should the admin use?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. Data Explorer
- B. Compliance Manager
- C. eDiscovery Premium
- D. Content Search
A is correct.
Explanation: Data Explorer helps admins discover, visualize, filter, and analyze sensitive information across locations such as SharePoint, Teams, and OneDrive.
B is incorrect: Compliance Manager assesses compliance posture with regulation-based controls, improvement actions, and a Compliance Score. It doesn't map sensitive information across locations.
C is incorrect: eDiscovery Premium adds case management, review sets, analytics, and redaction for legal investigations. Use it for legal matters, not for general sensitive data discovery.
D is incorrect: Content Search locates and preserves information for legal requests, audits, and investigations. It isn't the tool for visualizing and analyzing sensitive information across locations.
Q05 - Question
Employees use several AI tools at work, and some of these tools aren't approved by IT. The data security team needs visibility into AI interactions, a way to identify shadow AI usage, and controls that protect sensitive data in AI scenarios. Which Microsoft Purview capability should the team use?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. Compliance Manager
- B. eDiscovery Standard
- C. Data Security Posture Management for AI
- D. Data Explorer
C is correct.
Explanation: Microsoft Purview Data Security Posture Management for AI provides visibility into AI interactions. It helps identify shadow AI usage and supports controls that protect sensitive data in AI scenarios.
A is incorrect: Compliance Manager provides regulation-based assessments and a Compliance Score. It doesn't identify shadow AI usage.
B is incorrect: eDiscovery Standard provides search, export, and legal holds for investigations. It doesn't provide visibility into AI interactions.
D is incorrect: Data Explorer discovers and analyzes sensitive information across locations such as SharePoint, Teams, and OneDrive. It isn't focused on AI interactions or shadow AI.
Q06 - Question
A legal team responds to a complex litigation request. Search, export, and legal holds aren't enough. The team also needs case management, review sets, analytics, and redaction of sensitive content before production. Which option should you recommend?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. eDiscovery Standard
- B. eDiscovery Premium
- C. Compliance Manager
- D. Data Explorer
B is correct.
Explanation: eDiscovery Premium adds case management, review sets, analytics, and redaction to the search, export, and legal hold capabilities of eDiscovery Standard.
A is incorrect: eDiscovery Standard provides search, export, and legal holds. It doesn't include review sets, analytics, or redaction.
C is incorrect: Compliance Manager assesses compliance posture against regulations. It doesn't manage legal cases or redact content.
D is incorrect: Data Explorer discovers and analyzes sensitive information across locations. It doesn't provide case management or review sets for litigation.
Q07 - Question
A SharePoint Online admin reviews sharing activity for a finance site. Which two findings should the admin flag as oversharing? Each correct answer presents a complete solution.
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Multiple choice
- A. A project file is shared with view-only access to the three colleagues who need to read it.
- B. A budget workbook is shared by using an Anyone with the link sharing link.
- C. A site is restricted to members of the finance team who need to edit its content.
- D. Users have edit access to a policy document when view-only access is sufficient.
B and D are correct.
Explanation: Oversharing occurs when users grant broader access to SharePoint content than is appropriate or intended. Examples include sharing with Anyone with the link and granting edit access when view-only access is sufficient.
A is incorrect: View-only access for the specific colleagues who need to read the file matches the intended access. It doesn't grant broader access than required.
C is incorrect: Restricting the site to finance team members who need edit access limits access to the intended audience. This isn't oversharing.
Q08 - Question
Your organization has thousands of SharePoint Online sites. The governance team wants to audit access programmatically across all sites to find risky sharing at scale. Which approach should you recommend?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. Use PowerShell and the Microsoft Graph API to audit access.
- B. Create a Compliance Manager assessment and review improvement actions.
- C. Place all sites on an eDiscovery Standard legal hold.
- D. Ask users to prompt Microsoft 365 Copilot to list the files they can access.
A is correct.
Explanation: PowerShell and the Microsoft Graph API can audit SharePoint access at scale. The Microsoft 365 Admin Center and SharePoint Admin Center also provide sharing reports.
B is incorrect: Compliance Manager assesses compliance posture against regulations. It doesn't audit sharing permissions across SharePoint sites.
C is incorrect: eDiscovery Standard legal holds preserve content for legal requests and investigations. A hold doesn't audit or remediate risky sharing.
D is incorrect: Copilot only sees what each signed-in user can already access. User prompts don't provide an organization-wide access audit.
Q09 - Question
A user asks Microsoft 365 Copilot to summarize a document stored in a SharePoint site. The user doesn't have permission to access that site. How does Copilot handle the document?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. Copilot retrieves the document because it operates within Microsoft Purview compliance boundaries.
- B. Copilot retrieves the document by using a tenant-wide service identity.
- C. Copilot retrieves the document because Microsoft Graph indexes all Microsoft 365 content.
- D. Copilot can't use the document because it accesses data with the signed-in user's identity and permissions.
D is correct.
Explanation: Copilot accesses data through Microsoft Graph by using the signed-in user's identity and permissions. It can only see information the user is already allowed to see and can't bypass existing file permissions.
A is incorrect: Copilot operates within Microsoft Purview compliance boundaries. These boundaries don't grant access to content the user can't already access.
B is incorrect: Copilot inherits the access controls of the authenticated user. It doesn't use a separate identity to bypass those controls.
C is incorrect: Microsoft Graph enforces access-control checks at every query. A user without permission to the document doesn't get access to it through Graph.
Q10 - Question
A security architect is reviewing a Microsoft 365 Copilot deployment. The architect needs to identify the layer that Copilot uses to retrieve Microsoft 365 data and that enforces access-control checks at every query. Which layer should the architect identify?
Domain: Understand data protection and governance tasks for Microsoft 365 and Copilot (35–40%) Type: Single choice
- A. Microsoft Graph
- B. Compliance Manager
- C. Data Explorer
- D. SharePoint Admin Center sharing reports
A is correct.
Explanation: Copilot's data retrieval operates through Microsoft Graph. Microsoft Graph is the centralized data-access layer for Microsoft 365 and enforces access-control checks at every query.
B is incorrect: Compliance Manager provides regulation-based assessments and a Compliance Score. It isn't the data-access layer that Copilot uses.
C is incorrect: Data Explorer helps admins discover and analyze sensitive information. It doesn't enforce access checks on Copilot queries.
D is incorrect: SharePoint Admin Center sharing reports help admins review sharing. They don't retrieve data for Copilot or enforce per-query access checks.