SC-400 eDiscovery 4 — Questions and Answers
Question 1: An eDiscovery search returns items from a Microsoft 365 group. Which content sources are searched when a Microsoft 365 group is added as a content location?
- Only the group's SharePoint site
- Only the group's Exchange mailbox
- Both the group's Exchange mailbox and its associated SharePoint site (Correct answer)
- The group's Teams channel and OneDrive only
Correct answer: Both the group's Exchange mailbox and its associated SharePoint site
When a Microsoft 365 group is added as a content location, both its Exchange group mailbox and its associated SharePoint site are included in the search.
Question 2: What does the 'indexing' status of a custodian's content location indicate in eDiscovery Premium?
- The content is being permanently deleted
- Partially indexed items are being reprocessed to make them fully searchable (Correct answer)
- The hold is being applied to the content location
- The export process is running in the background
Correct answer: Partially indexed items are being reprocessed to make them fully searchable
When a custodian is added to a case, eDiscovery Premium triggers advanced indexing to reprocess partially indexed items (like encrypted or damaged files) to make them fully searchable.
Question 3: A search in Microsoft Purview Content Search returns 0 results despite the compliance admin being certain relevant emails exist. What is a likely cause related to permissions?
- The search account lacks the eDiscovery Manager role in the compliance portal (Correct answer)
- The user whose mailbox is being searched has blocked the search
- Sensitivity labels are preventing search from returning results
- The retention policy is interfering with the search query
Correct answer: The search account lacks the eDiscovery Manager role in the compliance portal
Without the eDiscovery Manager or equivalent role in the Microsoft Purview compliance portal, a user cannot perform content searches and would receive no results.
Question 4: In eDiscovery Premium, what is the purpose of tagging documents in a review set?
- Applying sensitivity labels to restrict access to the documents
- Categorizing documents as responsive, non-responsive, privileged, etc. to organize the review workflow (Correct answer)
- Permanently deleting non-relevant documents from the review set
- Automatically exporting tagged documents to external counsel
Correct answer: Categorizing documents as responsive, non-responsive, privileged, etc. to organize the review workflow
Tagging in review sets allows legal teams to classify documents by responsiveness, privilege status, or custom categories to manage the review workflow efficiently.
Question 5: Which eDiscovery search condition would you use to find all documents modified in the last 30 days that contain the word 'merger'?
- Use keyword 'merger' with a Date Modified condition set to the last 30 days (Correct answer)
- Use keyword 'merger' with a Date Received condition only
- Use a retention label condition combined with the keyword
- Use the File Type condition set to 'recent' combined with the keyword
Correct answer: Use keyword 'merger' with a Date Modified condition set to the last 30 days
Combining a keyword condition ('merger') with a Date Modified date range condition accurately targets recently modified documents containing the specified term.
Question 6: An organization receives a court order requiring data to be held for litigation. The IT team wants to ensure the hold is not accidentally removed. What is the recommended approach in Microsoft Purview?
- Use a retention policy with delete-blocking instead of an eDiscovery hold
- Apply an eDiscovery hold through a case and restrict case access to authorized personnel only (Correct answer)
- Store copies of the data in an external archive immediately
- Configure a DLP policy to prevent deletion
Correct answer: Apply an eDiscovery hold through a case and restrict case access to authorized personnel only
Creating an eDiscovery hold within a case and limiting case membership to authorized personnel ensures the hold can only be modified by those with explicit case access.
Question 7: When using eDiscovery in Microsoft Purview, which statement correctly describes the difference between eDiscovery (Standard) and eDiscovery (Premium)?
- Standard supports review sets; Premium does not
- Premium includes custodian management, advanced analytics, and predictive coding; Standard does not (Correct answer)
- Standard includes machine learning relevance scoring; Premium requires manual tagging only
- There is no functional difference; only the licensing cost differs
Correct answer: Premium includes custodian management, advanced analytics, and predictive coding; Standard does not
eDiscovery Premium adds custodian management, advanced indexing, review sets with analytics (threading, near-dupe, predictive coding) that are not available in eDiscovery Standard.
SC-400 eDiscovery 4
An eDiscovery search returns items from a Microsoft 365 group.
Which content sources are searched when a Microsoft 365 group is added as a content location?