SC-100 Certification Practice Question #26

Question

You have a Microsoft 365 E5 subscription that uses Microsoft Purview, SharePoint Online, and OneDrive for Business.

You need to recommend a ransomware protection solution that meets the following requirements:

•	Mitigates attacks that make copies of files, encrypt the copies, and then delete the original files
•	Mitigates attacks that encrypt files in place
•	Minimizes administrative effort

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

MS Learn maps each requirement directly. "Make a copy, encrypt the copy, delete the original" is the recycle-bin scenario — the deleted original sits unencrypted in the recycle bin for 93 days. "Encrypt files in place" is an edit, so version history lets you roll back to a clean previous version. Both are built-in and require minimal admin effort, satisfying the third requirement; DLP is a prevention control (not recovery) and is the most admin-intensive option, so it loses on both counts. The mention of Purview tempts some commenters toward DLP, but the highest-voted answers (jasscomp 23, sbnpj 10) and the official ransomware-protection doc both land on Recycle Bin + Versioning. Confidence is held at 85 because there is a real community split pulling Row 1 toward DLP, but MS Learn's wording resolves it clearly.

More SC-100 practice questions