exam questions

Exam MS-101 All Questions

View all questions & answers for the MS-101 exam

Exam MS-101 topic 3 question 18 discussion

Actual exam question from Microsoft's MS-101
Question #: 18
Topic #: 3
[All MS-101 Questions]

You have a Microsoft 365 subscription.
All users have their email stored in Microsoft Exchange Online.
In the mailbox of a user named User1, you need to preserve a copy of all the email messages that contain the word ProjectX.
What should you do?

  • A. From the Security & Compliance admin center, create an eDiscovery case.
  • B. From the Exchange admin center, create a mail flow rule.
  • C. From the Security & Compliance admin center, start a message trace.
  • D. From Microsoft Defender for Cloud Apps, create an access policy.
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️
References:
https://docs.microsoft.com/en-us/office365/securitycompliance/ediscovery-cases#step-2-create-a-new-case

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
TonySuccess
Highly Voted 4 years, 11 months ago
Yes, let's not over complicate things, eDiscovery is correct when looking at the GIVEN answers. As Sonia33 said, eDiscovery cases can search content in all mailboxes and detect Keywords. Once you have created a case, perform a new search and specify the key words.
upvoted 23 times
VTHAR
4 years, 8 months ago
eDiscovery is correct because you need to preserve a "COPY". If it is as such "you need to preserve all the email messages that contain the word ProjectX", retention policy would be best answer.
upvoted 10 times
ARYMBS
2 years, 9 months ago
I agree that this question is poorly written. Still it is THE best answer from the given ones...
upvoted 1 times
...
...
...
Sonia33
Highly Voted 5 years ago
An eDiscovery case would be also correct, right? I mean, you can create a label policy to automatically detect a keyword, but an eDiscovery case can search content in all mailboxes using keywords (https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-content-in-core-ediscovery?view=o365-worldwide)
upvoted 10 times
Sonia33
5 years ago
https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies?view=o365-worldwide
upvoted 1 times
...
Logitech
4 years, 5 months ago
Yes eDiscovery is the right tool for this, with label i can label contet whit this word, but dont get a copy of it. With retantion label i can get a copy of deleted content thats all i found so far.
upvoted 1 times
...
...
Amir1909
Most Recent 1 year, 4 months ago
A is correct
upvoted 1 times
...
Contactfornitish
2 years, 10 months ago
On exam on 13 aug'22
upvoted 3 times
...
us3r
3 years, 7 months ago
E. From the Security & Compliance admin center, create a label and a label policy.
upvoted 3 times
...
Jake1
4 years, 1 month ago
As VTHAR said, this is only for "current" messages, not future messages so this does not require any policy to be created. An eDis case will do the trick here.
upvoted 1 times
...
potpal
4 years, 1 month ago
On test taken 5.10.21 but no eDiscovery Option, closest I picked was related to labeling
upvoted 5 times
Domza
3 years, 10 months ago
feedback :)
upvoted 3 times
Csed
3 years, 5 months ago
Yes there are two versions of this question, each uses the other as the solution (Label or Ediscovery), this is the Ediscovery version as both accomplish the same task.
upvoted 1 times
...
...
...
Tumbrik
4 years, 2 months ago
The key point in this question is that you need a COPY of ALL emails contains specific word in User1 mailbox. You CAN do this with a mail flow rule and you CANNOT do this with an eDiscovery Case. With an eDiscovery Case you can only place results on hold and export it.
upvoted 2 times
Tumbrik
4 years, 2 months ago
No I was wrong. My bad. By a "Copy" they mean a "Copy" in a special place that you can do with an eDiscovery Legal Hold. "A." is the right answer.
upvoted 1 times
...
...
Alvaroll
4 years, 8 months ago
You can create a eDiscovery hold case https://docs.microsoft.com/en-us/microsoft-365/compliance/create-ediscovery-holds?view=o365-worldwide
upvoted 1 times
...
Alvaroll
4 years, 8 months ago
Similar to MS-100 Topic4-30 https://www.examtopics.com/exams/microsoft/ms-100/view/28/
upvoted 3 times
...
Tweety1972
4 years, 9 months ago
At the moment there are 4 different answers for exact the same question. You have a Microsoft 365 subscription. All users have their email stored in Microsoft Exchange Online. In the mailbox of a user named User1, you need to preserve a copy of all the email messages that contain the word ProjectX. What should you do? In version A is “From the Security & Compliance admin center, create a label and a label policy.” the answer. But why not “From the Security & Compliance admin center, create a data loss prevention (DLP) policy.”? In version B is “From the Security & Compliance admin center, create a data loss prevention (DLP) policy.” the answer. But why not answer “From the Security & Compliance admin center, create an eDiscovery case.”? Can anyone explain this to me please?
upvoted 3 times
...
examuser123
5 years ago
A retention label is the best policy but based on the answers available the only option is an ediscovery case
upvoted 3 times
...
MCSA11
5 years, 2 months ago
A. From the Security & Compliance admin center, create a label and label policy.
upvoted 7 times
...
zeeess99
5 years, 3 months ago
The actual answer to this question isn't properly mentioned.
upvoted 2 times
zeeess99
5 years, 3 months ago
The correct answer to this question is: From the Security & Compliance admin center, create a label and a label policy.
upvoted 6 times
ginsahec
5 years, 2 months ago
This is an answer for other question with the same statement.
upvoted 2 times
...
...
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...