Evaluate solutions for securing Microsoft 365

Fennimore Retail Group processes card payments and must comply with PCI DSS. Internal auditors found primary account numbers in Teams chats, in email sent to suppliers, in SharePoint spreadsheets, and in files copied to USB drives from Windows laptops that are onboarded to Microsoft Defender for Endpoint. The architect must prevent cardholder data from leaving the organization across all these channels using one policy framework, and the company holds Microsoft 365 E5.

What should you recommend?

1. AA Microsoft Purview sensitivity label with encryption that users apply to documents containing card numbersEncryption controls who can open labeled content but depends on labels being applied and does not detect or block card numbers typed into chats, email, or copied to USB.
2. BA Microsoft Purview data loss prevention policy that uses the Credit Card Number sensitive information type and is scoped to Exchange, SharePoint, OneDrive, Teams, and DevicesA single DLP policy can detect the Credit Card Number sensitive information type across Exchange, SharePoint, OneDrive, Teams chat and channel messages, and Windows endpoints (Endpoint DLP), blocking sharing with external recipients and copying to removable media.
3. CAn Exchange Online mail flow rule that rejects messages containing 16-digit numbersA mail flow rule covers only email, produces false positives on any 16-digit number because it lacks checksum validation, and leaves Teams, SharePoint, and USB channels unprotected.
4. DA Microsoft Defender for Cloud Apps file policy that scans SharePoint and OneDrive for card numbersA file policy covers files stored in connected cloud apps but does not inspect Teams messages, outgoing email, or endpoint actions such as USB copy.

Oakhurst Biopharma, a Microsoft 365 E5 customer, discovered that employees had consented to more than 400 third-party OAuth applications in Microsoft Entra ID. Several unverified apps hold Mail.ReadWrite and Files.ReadWrite.All permissions but have not been used for months. The security architect must continuously identify overprivileged or unused OAuth apps, receive alerts when an app starts accessing unusual volumes of data, and automatically disable apps that meet risk conditions.

Which solution should you recommend?

1. ACloud discovery policies in Microsoft Defender for Cloud Apps based on firewall and endpoint traffic logsCloud discovery identifies unsanctioned SaaS usage from network traffic; it does not inventory the Microsoft Graph permissions of OAuth apps that users consented to or disable them.
2. BThe admin consent workflow in Microsoft Entra IDThe admin consent workflow controls future consent requests; it does not analyze the permissions or data access behavior of apps that were already granted, nor does it alert on anomalous use.
3. CApp governance policies in Microsoft Defender for Cloud Apps that detect overprivileged and unused apps and disable apps that match risk conditionsApp governance provides visibility into OAuth app permissions and data usage, built-in and custom policies for overprivileged or unused apps, anomaly alerts on data access, and automated remediation such as disabling the app.
4. DMicrosoft Entra ID Protection risky sign-in policiesID Protection evaluates user and workload identity sign-in risk; it does not evaluate OAuth app permission scope or the volume of Graph data an app reads.

Hollowell Semiconductor, a Microsoft 365 E5 customer, lost design files when an engineer who had resigned downloaded hundreds of documents from SharePoint and emailed them to a personal address during the final two weeks of employment. The CISO wants to detect this pattern for future departing employees by correlating resignation dates from the Workday HR system with download, exfiltration, and label-downgrade activity, while keeping investigated users pseudonymized until a case is escalated.

Which two actions should you recommend? Each correct answer presents part of the solution.

1. ACreate a Microsoft Purview Insider Risk Management policy based on the Data theft by departing users templateThis template scores sequences of risky activity such as bulk downloads, external sharing, and label downgrades for users whose departure is known, and Insider Risk Management pseudonymizes user names by default until escalation.
2. BConfigure the Microsoft Purview HR data connector to import resignation and termination dates from WorkdayThe HR connector provides the departure dates that trigger the departing-user policy, so activity in the window before and after resignation is scored.
3. CCreate a Microsoft Purview data loss prevention policy that blocks all email to external domainsA blanket external email block disrupts legitimate business, does not correlate activity with HR events, and does not detect the broader pattern of bulk downloads and label changes.
4. DCreate a Microsoft Purview Communication Compliance policy for offensive language in TeamsCommunication Compliance reviews message content for policy violations such as harassment or regulatory language; it does not detect data exfiltration by departing users.
5. EEnable Microsoft Purview Audit (Premium) and search the audit log weekly for file download eventsAudit retains and exposes the raw events, but a manual weekly search does not correlate them with HR departure dates, score risk, or preserve pseudonymity in a managed workflow.

Larkspur Credit Union has Microsoft 365 E3 and has published sensitivity labels that employees apply manually. Regulators now require that existing documents in SharePoint Online and OneDrive that contain member Social Security numbers are classified automatically, without relying on users, and that the classification is applied to the millions of files already at rest. The architect wants the smallest licensing change that meets the requirement.

What should you recommend?

1. AConfigure a default sensitivity label for all SharePoint document librariesA default library label applies the same label to every new or edited file regardless of content; it does not inspect files for Social Security numbers and is not content-based classification.
2. BAdd the Microsoft 365 E5 Compliance add-on and create a service-side auto-labeling policy for SharePoint and OneDrive that matches the U.S. Social Security Number sensitive information typeService-side auto-labeling policies classify files at rest in SharePoint and OneDrive by content, but they require Microsoft 365 E5, E5 Compliance, or E5 Information Protection and Governance licensing, so the add-on is the smallest change that unlocks the capability.
3. CDeploy the Microsoft Purview Information Protection scanner against the SharePoint Online sitesThe scanner discovers and labels files on on-premises file shares and SharePoint Server; it does not scan SharePoint Online or OneDrive.
4. DEnable client-side automatic labeling in Office apps with the existing E3 licensesClient-side auto-labeling also requires E5-level licensing and only labels files while users have them open in Office apps, so it would not classify millions of files already at rest.