SC-400 eDiscovery 5 — Questions and Answers
Question 1: A compliance administrator wants to search for content across all Exchange Online mailboxes in the organization without specifying individual users. How should the content location be configured?
- Add each mailbox individually to the search
- Select 'All mailboxes' to search across all Exchange Online mailboxes at once (Correct answer)
- Use a distribution group as the content location
- Create a separate search for each department
Correct answer: Select 'All mailboxes' to search across all Exchange Online mailboxes at once
Selecting 'All mailboxes' in the content location configuration searches every Exchange Online mailbox in the organization in a single search operation.
Question 2: In Microsoft Purview eDiscovery Premium, what does 'conversation threading' do when applied to Teams data in a review set?
- Deletes off-topic Teams messages from the review set
- Groups individual Teams messages into their logical conversation context for easier review (Correct answer)
- Translates Teams messages from other languages into English
- Converts Teams messages into email format for export as PST
Correct answer: Groups individual Teams messages into their logical conversation context for easier review
Conversation threading reconstructs Teams chat messages into their logical conversation groups so reviewers can read exchanges in proper context rather than as isolated messages.
Question 3: An attorney needs to mark certain documents in a review set as attorney-client privileged and exclude them from production. Which eDiscovery Premium capability supports this?
- Apply a sensitivity label directly from the review set
- Use custom review tags to mark documents as privileged and filter them out during export (Correct answer)
- Run a DLP scan against the review set
- Apply a retention hold to the privileged documents
Correct answer: Use custom review tags to mark documents as privileged and filter them out during export
Custom tags such as 'Privileged' can be applied to documents in the review set, and the export can be configured to exclude documents with that tag.
Question 4: What happens to the data in an eDiscovery case when the case is closed in Microsoft Purview?
- All content under hold is immediately released and can be deleted
- The case and its holds are preserved but no new searches or exports can be performed until the case is reopened (Correct answer)
- The case data is automatically exported to Azure Blob Storage
- The case is permanently deleted after 30 days
Correct answer: The case and its holds are preserved but no new searches or exports can be performed until the case is reopened
Closing a case suspends active operations but preserves all existing holds and collected data; the case can be reopened to resume work.
Question 5: A legal team wants to run eDiscovery searches but the compliance admin notices that many documents are showing as 'partially indexed.' What is the primary cause of partially indexed items in Exchange Online?
- The documents exceed the 150 MB attachment size limit for indexing (Correct answer)
- The items have sensitivity labels that block indexing
- The items are in shared mailboxes which are excluded from indexing
- Items in the Junk Email folder are never indexed
Correct answer: The documents exceed the 150 MB attachment size limit for indexing
Items with attachments exceeding the indexing size limit (150 MB) or in unsupported file formats are classified as partially indexed and may be missed in keyword searches.
Question 6: In Microsoft Purview, which license is required to use eDiscovery Premium features such as custodian management and predictive coding?
- Microsoft 365 E3 or equivalent
- Microsoft 365 E5 or Microsoft 365 E5 Compliance add-on (Correct answer)
- Any Microsoft 365 Business plan
- Microsoft 365 F1 with eDiscovery add-on
Correct answer: Microsoft 365 E5 or Microsoft 365 E5 Compliance add-on
eDiscovery Premium requires Microsoft 365 E5 or the Microsoft 365 E5 Compliance add-on for E3 subscribers to access advanced features.
Question 7: A search query in Microsoft Purview eDiscovery uses the condition 'Subject:Acquisition AND Date:2025-01-01..2025-06-30'. What type of query language does this represent?
- SQL (Structured Query Language)
- KQL (Keyword Query Language) (Correct answer)
- XPath query syntax
- LDAP filter syntax
Correct answer: KQL (Keyword Query Language)
Microsoft Purview eDiscovery uses KQL (Keyword Query Language) for content searches, supporting property:value pairs, Boolean operators, and date ranges.
SC-400 eDiscovery 5
A compliance administrator wants to search for content across all Exchange Online mailboxes in the organization without specifying individual users.
How should the content location be configured?