Explanation:
Box 1: Test it out first
To configure the policy that blocks elevated risk users from uploading or pasting sensitive data to AI websites, you will configure the policy in "Test" mode within the Microsoft Purview portal to begin with, and then change it to a block-with-override mode to enforce protection on risky users for the relevant web browsers.
Box 2: Devices only
* Devices - Yes
Policies within Microsoft Purview's Data Security Posture Management for AI (DSPM for AI) can apply to user devices, specifically through Endpoint data loss prevention (DLP), which monitors and can block sensitive data from being pasted or uploaded to third-party AI sites accessed via browsers on those devices. This is achieved by onboarding Windows computers to Microsoft Purview and configuring Endpoint DLP policies to detect and prevent sharing sensitive information through the browser.
Reference:
https://learn.microsoft.com/en-us/purview/dspm-for-ai-considerations

Stage 1: Create an adaptive scope
Step 1: Sign into Microsoft Purview compliance portal using credentials for an admin account in your Microsoft 365 organization.
Step 2: In the compliance portal, select Roles and Scopes.
Step 3: Select Adaptive scopes, and then + Create scope.
Step 4: Follow the prompts in the configuration where you'll first be asked to assign an administrative unit. If your account has been assigned administrative units, you must select one administrative unit that will restrict the scope membership. (Does not apply here) If you don't want to restrict the adaptive scope by using administrative units, or your organization hasn't configured administrative units, keep the default of Full directory. (Applies here) Step 5: Select the type of scope, and then select the attributes or properties you want to use to build the dynamic membership, and type in the attribute or property values. Select Add attribute (for users and groups).
For example, to configure an adaptive scope that will be used to identify users in Europe, first select Users as the scope type, and then select the Country or region attribute, and type in Europe:
Step 6: For User Attributes select: Department, is equal to, Sales
Stage 2: Create and configure retention policies
Step 1: From the Microsoft Purview compliance portal, select Data lifecycle management > Microsoft 365 > Retention Policies.
Step 2: Select New retention policy to start the Create retention policy configuration, and name your new retention policy.
Step 3: For the Assign admin units page (skip)
Step 4: For the Choose the type of retention policy to create page, select Adaptive or Static.
Select Adaptive.
We need Adaptive scopes.
Step 5: On the Choose adaptive policy scopes and locations page, select Add scopes and select the one you created in Stage 1.

Step 6: Then, select one or more locations. The locations that you can select depend on the scope types added. For example, if you only added a scope type of User, you'll be able to select Teams chats but not Teams channel messages.
Select: Teams chat and Teams channel
Step 7: For Decide if you want to retain content, delete it:
Select: On the Decide if you want to retain content, delete it, or both page, select Retain items for a specific period, specify the retention period [specify 5 years], and then for At end of the retention period select Delete items automatically.
Note: We need to retains item for five years from the date they are created, and then deletes them.
Reference:
https://learn.microsoft.com/en-us/purview/purview-adaptive-scopes
https://learn.microsoft.com/en-us/purview/create-retention-policies
https://learn.microsoft.com/en-us/purview/retention-settings#settings-for-retaining-and-deleting- content

Assign sensitivity labels to Microsoft 365 groups in Microsoft Entra ID Microsoft Entra ID supports applying sensitivity labels published by the Microsoft Purview compliance portal to Microsoft 365 groups. Sensitivity labels apply to groups across services like Outlook, Microsoft Teams, and SharePoint.
Assign a label to an existing group in the Microsoft Entra admin center Step 1: Sign in to the Microsoft Entra admin center as at least a Global Administrator.
Step 2: Select Microsoft Entra ID.
Step 3: Select Groups
Step 4: From the All groups page, select the group that you want to label.
Step 5: On the selected group's page, select Properties and select a sensitivity label from the list.
Select the Confidential - Finance label

Step 6: Select Save to save your changes.
Reference:
https://learn.microsoft.com/en-us/entra/identity/users/groups-assign-sensitivity-labels

To create a sensitive information type that matches all words in a keyword list, you can use the
"All" condition instead of the default "Any" condition. Here are the steps to create such a sensitive information type:
Step 1: Go to the Microsoft 365 compliance center and navigate to the "Sensitive information types" page.
Step 2: Click on "Create a sensitive information type".
Step 3: Choose "Keyword dictionary" as the type of sensitive information you want to create.
Step 4: Enter a name and description for the sensitive information type.
Step 5: In the "Keywords" section, enter all the words you want to match separated by com-mas.
Here we enter: Tailspin, Litware, Falcon
Step 6: Click on "Add condition" and choose "Any" as the condition type.
Step 7: Click on "Create" to create the sensitive information type.
Step 8: Click on "Create" to create the sensitive information type.
With this configuration, the DLP policy will only detect the sensitive information if any the words in the keyword list are present in the content being scanned.
Reference:
https://learn.microsoft.com/en-us/answers/questions/1419105/how-to-create-sensitive- information-types-to-match

Explanation:

Statement 1 - No. The sensitivity label includes content marking (watermark: INTERNAL), but it only applies to documents where the label is manually or automatically applied, not to all documents by default.
Statement 2 - No. The sensitivity label only specifies a watermark, not a header. If a header marking was configured, it would explicitly appear in the label settings.
Statement 3 - No. There is no indication that auto-labeling is configured to apply the label only to documents with the word "rebranding". Auto-labeling is an optional setting that needs explicit configuration.