Describe the data compliance solutions of Microsoft Purview Flashcards
(83 cards)
An employee is suspected of sending sensitive infos to a key competitor.
You need to preserve the evidence of the activity.
What should you do?
A legal hold in the mailbox
In Purview, eDiscovery has an hold feature.
It can apply to a mailbox and will retain all changes, including deletions.
For what a Data Loss Prevention (DLP) Policy can be used?
A DLP Policy can be used to identify sensitive info used in M365 apps and it can be set up to prevent that info from being shared.
Define Digital signature
Digital signatures ensure that unauthorized data modifications can be detected.
It uses digital certificates in outlook: if the email has been modified in transit, the signature will be invalid
BUT
* it doesn’t encrypt data in email (that’s S/MIME protocol)
* it doesn’t ensure data can be recovered if accidentally deleted
——–helps customers with compliance by displaying controls for a given standard, starting with templates.
However it doesn’t guarantee compliance
Compliance Manager
What does Microsoft Purview Insider Risk Management correlate to identify potential risks?
Various signals to identify potential malicious or inadvertent insider risks such as IP theft, data leakage, and security violations.
Insider risks can be both intentional and unintentional actions that compromise security.
What does insider risk management enable customers to create?
Policies to manage security and compliance.
These policies help organizations tailor their risk management strategies.
What is a key design principle of Microsoft Purview Insider Risk Management?
Built with privacy by design.
This means that privacy considerations are integrated into the system from the outset.
How are users treated in Microsoft Purview Insider Risk Management regarding privacy?
Users are pseudonymized by default.
Pseudonymization helps protect user identities while managing risks.
What access controls are in place to ensure user-level privacy?
Role-based access controls and audit logs.
These measures help restrict data access and track user interactions.
What is the primary function of Microsoft Purview Insider Risk Management?
To help minimize internal risks by detecting, investigating, and acting on malicious and inadvertent activities.
This involves monitoring user behavior to identify potential threats.
What do insider risk policies allow organizations to define?
The types of risks to identify and detect in their organization.
This customization is crucial for addressing specific organizational needs.
What can be done with cases identified by insider risk policies?
Acting on cases and escalating cases to Microsoft eDiscovery (Premium) if needed.
Escalation ensures that serious cases receive appropriate attention.
When you create a new insider risk policy with the policy workflow, what are the policy templates available?
- Data theft by departing users: works with indicators and info from HR connector
- Data leaks
- Data leaks by risky users: to detect when a potentially stressed user has unadvertenly or maliciously contravened security protocols. Works with combined indicators from Defender for endpoint with HR connector
- Security policy violations: to determine when a user has installed malware or disabled security feature on its device. Leverages MS Defender for endpoint to determine
What does eDiscovery allow you to search for?
Content stored in Exchange mailboxes, OneDrive accounts, SharePoint sites, Microsoft Teams, Microsoft 365 Groups, and Viva Engage Teams
What is the purpose of exporting search results in eDiscovery?
To copy items from their original content location and package them for download to a local computer
What does placing content locations on hold accomplish?
Preserves content relevant to an investigation and secures it from deletion
What is a review set in eDiscovery?
A secure Azure Storage location in the Microsoft cloud for collecting and analyzing data
What can you do with the items in a review set?
Search, filter, tag, analyze, and predict relevancy using predictive coding models
What functionality does Optical Character Recognition (OCR) provide in a review set?
Extracts text from images and includes it with the content added to a review set
What is the benefit of conversation threading in eDiscovery?
Allows collection of entire conversation threads for context during review
True or False: eDiscovery allows for the deletion of content during an investigation.
False
Fill in the blank: A review set provides a _______ set of content that can be analyzed.
[static, known]
What is Microsoft Purview Data Lifecycle Management?
(formerly Microsoft Information Governance)
tools and capabilities to retain the content that you need to keep, and delete the content that you don’t.
What are Microsoft Purview Data Lifecycle Management features?
Retention policies are the cornerstone for data lifecycle management. Use these policies for Microsoft 365 workloads that include Exchange, SharePoint, OneDrive, Teams, and Viva Engage.
- Configure whether content for these services needs to be retained indefinitely, or for a specific period if users edit or delete it.
- Or you can configure the policy to automatically permanently delete the content after a specified period if it’s not already deleted.
- You can also combine these two actions for retain and then delete, which is a very typical configuration. For example, retain email for three years and then delete it.
When you configure a retention policy, you can target all instances in your organization (such as all mailboxes and all SharePoint sites), or individual instances (such as only the mailboxes for specific departments or regions, or just selected SharePoint sites).
If you need exceptions for individual emails or documents, such as a longer retention period for legal documents, you do this with retention labels that you publish to apps so that users can apply them, or automatically apply them by inspecting the content.
Retention labels are also used with Adaptive Protection, if you’re using this solution with insider risk management. In this case, the retention label and auto-apply policy is automatically created for you.
Other data lifecycle management capabilities to help you keep what you need and delete what you don’t:
* Mailbox archiving to provide users with additional mailbox storage space, and auto-expanding archiving for mailboxes that need more than 100 GB storage. A default archiving policy automatically moves email to the archive mailbox, and if required, you can customize this policy.
* Inactive mailboxes that retain mailbox content after employees leave the organization.
