Explanation:
A screenshot of a questionnaire AI-generated content may be incorrect.

The goal is to automatically label documents in Site1 that contain credit card numbers. To achieve this, we need a sensitivity label with an auto-labeling policy based on a sensitive info type that detects credit card numbers.
Step 1: Create a Sensitive Info Type
# A sensitive info type is needed to detect credit card numbers in documents.
# Microsoft Purview includes built-in sensitive info types for credit card numbers, but we can also create a custom one if necessary.
Step 2: Create a Sensitivity Label
# A sensitivity label is required to classify and protect documents containing sensitive information.
# This label can apply encryption, watermarking, or access controls to credit card data.
Step 3: Create an Auto-Labeling Policy
# An auto-labeling policy ensures that the sensitivity label is applied automatically when credit card numbers are detected in Site1.
# This policy is configured to scan files and automatically apply the correct sensitivity label.
Topic 1, Contoso, Ltd Case Study 1
Instructions
This is a case study. Case studies are not timed separately from other exam sections. You can use as much exam time as you would like to complete each case study. However, there might be additional case studies or other exam sections. Manage your time to ensure that you can complete all the exam sections in the time provided. Pay attention to the Exam Progress at the top of the screen so you have sufficient time to complete any exam sections that follow this case study.
To answer the case study questions, you will need to reference information that is provided in the case. Case studies and associated questions might contain exhibits or other resources that provide more information about the scenario described in the case. Information provided in an individual question does not apply to the other questions in the case study.
A Review Screen will appear at the end of this case study. From the Review Screen, you can review and change your answers before you move to the next exam section. After you leave this case study, you will NOT be able to return to it.
To start the case study
To display the first question in this case study, select the "Next" button. To the left of the question, a menu provides links to information such as business requirements, the existing environment, and problem statements. Please read through all this information before answering any questions. When you are ready to answer a question, select the "Question" button to return to the question.
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and three branch offices in Seattle, Boston, and Johannesburg.
Existing Environment
Microsoft 365 Environment
Contoso has a Microsoft 365 E5 tenant. The tenant contains the administrative user accounts shown in the following table.

Users store data in the following locations:
# SharePoint sites
# OneDrive accounts
# Exchange email
# Exchange public folders
# Teams chats
# Teams channel messages
When users in the research department create documents, they must add a 10-digit project code to each document. Project codes that start with the digits 999 are confidential.
SharePoint Online Environment
Contoso has four Microsoft SharePoint Online sites named Site1, Site2, Site3, and Site4.
Site2 contains the files shown in the following table.

Two users named User1 and User2 are assigned roles for Site2 as shown in the following table.

Site3 stores documents related to the company's projects. The documents are organized in a folder hierarchy based on the project.
Site4 has the following two retention policies applied:
# Name: Site4RetentionPolicy1
# Locations to apply the policy: Site4
# Delete items older than: 2 years
# Delete content based on: When items were created
# Name: Site4RetentionPolicy2
# Locations to apply the policy: Site4
# Retain items for a specific period: 4 years
# Start the retention period based on: When items were created
# At the end of the retention period: Do nothing
Problem Statements
Management at Contoso is concerned about data leaks. On several occasions, confidential research department documents were leaked.
Requirements
Planned Changes
Contoso plans to create the following data loss prevention (DLP) policy:
# Name: DLPpolicy1
# Locations to apply the policy: Site2
# Conditions:
# Content contains any of these sensitive info types: SWIFT Code
# Instance count: 2 to any
# Actions: Restrict access to the content
Technical Requirements
Contoso must meet the following technical requirements:
# All administrative users must be able to review DLP reports.
# Whenever possible, the principle of least privilege must be used.
# For all users, all Microsoft 365 data must be retained for at least one year.
# Confidential documents must be detected and protected by using Microsoft 365.
# Site1 documents that include credit card numbers must be labeled automatically.
# All administrative users must be able to create Microsoft 365 sensitivity labels.
# After a project is complete, the documents in Site3 that relate to the project must be retained for 10 years.

The sensitivity label Label1 assigns permissions (User1 = Co-Author, User2 = Reviewer, User3 = Viewer) and enables Double Key Encryption (DKE). Microsoft 365 Copilot can summarize content only when the service can access the file using the user's permissions. Content protected with Double Key Encryption is not accessible to Microsoft cloud services (including Copilot); as a result, Copilot cannot open or process DKE- protected files for any user, even if they can open the file themselves in Office apps.
Therefore, no user can use Microsoft 365 Copilot to summarize File1.
Reference: Microsoft Purview Double Key Encryption-service access limitations for Microsoft cloud services, including Copilot and search indexing.

Explanation:

Step 1 - Understanding the requirement
The task is about applying Microsoft Purview Information Protection sensitivity labels to sensitive images and documents using the Azure Information Protection (AIP) unified labeling client.
Sensitivity labels in Purview can be applied in Microsoft 365 apps (Word, Excel, Outlook, PowerPoint), but to label non-Office files like images, PDFs, and other documents, users must use the AIP unified labeling client.
With the AIP client installed, labels can be applied directly in File Explorer by right-clicking the file.
Step 2 - Device compatibility
The AIP unified labeling client runs on Windows devices only.
In the question's context (based on the provided dropdowns), all listed devices (Device1, Device2, Device3) are compatible Windows endpoints.
Therefore, the AIP client can be deployed to all three devices.
Step 3 - How users apply labels
For Office documents # labels can be applied from the ribbon inside Word, Excel, PowerPoint.
For other file types (images, PDFs, text files, etc.) # labels must be applied using File Explorer via the AIP client.
# Reference:
Install and use the Azure Information Protection unified labeling client Apply sensitivity labels to files and emails in Microsoft Purview

Explanation:
Box 1: The action will be blocked.
The paste action will be blocked in Microsoft Edge, and the user will receive a notification. If the user attempts to bypass this by using Google Chrome, the browser itself will be completely blocked from accessing the site (or pasting will be natively blocked if the Microsoft Purview Extension is installed).
Device 1 (Windows 11 - Onboarded)
Because Device1 is onboarded via Microsoft Defender for Endpoint, it actively pulls and enforces Microsoft Purview Endpoint DLP rules at the operating system and application level.
Microsoft Edge: Edge features native integration with Microsoft Purview. When the user attempts to paste text flagged with the Confidential SIT into an unapproved AI domain, Edge intercepts the clipboard action natively and blocks the paste, triggering a user notification pop-up.
Google Chrome: Because D evice11 is a managed Windows endpoint, Endpoint DLP settings will actively monitor browser activity. If the Microsoft Purview Extension for Chrome is present, the paste will be blocked inline exactly like Edge. If the extension is missing, Purview's network/browser restrictions will block access to the targeted URL entirely within Chrome to prevent policy circumvention.
Box 2: There will be no action.
The policy will fail to evaluate or enforce any restrictions, allowing the text to be pasted freely in both Firefox and Google Chrome.
Device 2 (MacOS - Not Onboarded)
The "Devices" location in Microsoft Purview DLP policies relies entirely on local OS telemetry and compliance hooks.
No Enforcement: Because Device 2 is not onboarded into Microsoft Defender for Endpoint (or Microsoft Purview device management), the device does not download the organizational DLP policy binaries or rules.
Browser Behavior: Neither Firefox nor Google Chrome on MacOS has a native mechanism to communicate with your tenant's Purview configuration without an onboarded base OS layer.
Result: The policy engine remains completely blind to Device2's clipboard and network activity, resulting in no block and no user notification.
Reference:
https://learn.microsoft.com/en-us/purview/endpoint-dlp-getting-started

Retention policy tags (MRM) for Exchange Online are applied by the Managed Folder Assistant (MFA). To apply a newly created Exchange retention policy to mailbox items immediately, you manually invoke MFA with Start-ManagedFolderAssistant for the mailbox or set of mailboxes. Creating DLP policies or label policies in Purview does not accelerate MRM processing.