Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Exchange 2016 MCSE 70-345 > Compliance, Archiving, eDiscovery, Auditing > Flashcards

Compliance, Archiving, eDiscovery, Auditing Flashcards

1
Q

What is DLP?

A

Data Loss Prevention

  • A Compliance Management feature.
  • A premium feature that requires an Enterprise CAL.
  • The goal is to prevent the intentional or accidental exposure of sensitive information.
  • Uses content analysis to examine email messages and attachments in transit (as they move through the transport pipeline).
  • It looks for multiple pieces of evidence to determine a confidence level, and takes action based on confidence.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a DLP Policy?

A

It is a collection of Transport Rules that can be managed together as a single policy.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a DLP Policy Rule?

A

It is simply a Transport Rule that has been added to a DLP Policy.

(Through the DLP interface, you can combine multiple Transport Rules to manage as a single policy, and add additional DLP-specific options.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are examples of sensitive information that DLP can watch for?

A
  • Credit card details
  • SSNs
  • Passport numbers
  • Bank Account Numbers
  • Custom information types, such as “document fingerprints.”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a Policy Tip?

A
  • Policy Tips are displayed to users when an email is being composed that will breach a DLP Policy.
  • Available in Outlook and Outlook on the Web
  • Not available for non-Outlook clients or mobile apps.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are possible Policy Tip Actions?

A
  • Notify sender, but allow them to send regardless
  • Notify sender, and block if sent.
  • Notify sender, block if sent, but allow user to override and send by indicating it is a false positive
  • Notify sender, block if sent, but allow user to override and send (no reason required)
  • Notify sender, block if sent message, but allow user to override and send by providing a buisiness justifcation explanation.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What “modes” can a DLP policy be set to?

A
  • Enforce
  • Audit (Tests DLP policy without Policy Tips)
  • AuditAndNotify (Tests DLP policy with Policy Tips)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How do you implement DLP?

A

• Create a DLP policy
– Can create using either a built-in template, custom policy, or import a third-party policy

  • Create or modify rules as needed
  • Set Mode to be “Enforced”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What configurations can be made to a DLP policy rule?

A
  • Enable or disable any individual rule of a policy
  • Change the scope of the rule
  • Modify thresholds for triggering (minimum and maximum counts)
  • Modify thresholds for confidence levels (minimum and maximum)
  • Send an incident report to an email recipient
  • Can take essentially any additional action that normal Transport Rules can take
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Document Fingerprinting?

A
  • A part of DLP, used to detect specific documents, forms, or templates.
  • Documents are be uploaded to Exchange for analysis and “fingerprinting.”
  • DLP will then detect documents based on that template, AS LONG AS ALL ORIGNAL TEXT is all retained. (for example, a form the requires the user to overwrite fields will NOT trigger detection).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is MRM?

A
  • Message Records Management
  • Part of Compliance Management
  • The overarching term for features that manage mailbox data retention.
  • Retention management includes both:

– keeping data as long as it is needed,

– and removing data when should no longer be kept.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is MRM used to accomplish?

A
  • To meet business and regulatory requirements
  • To help users manage mailbox data
  • To manage storage utilization of email
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Retention Tags?

A

• Retention tags are used to apply retention settings to mailbox folders and items.

• Each Retention Tag is made up of two settings:
– a Retention Action
– a Retention Period

• Retention policies are made up of retention tags.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is this?

DPT

A

Default Policy Tag

A type of Retention Tag

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is this?

RPT

A

Retention Policy Tag

A type of Retention Tag

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What types of Retention Tags are there?

A
  • Default Policy Tags (DPT)
  • Retention Policy Tags (RPT)
  • Personal Tags
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Describe how this type of Retention Tag works:

DPT

A
  • Are assigned to any folders or items that don’t have another tag.
  • Sub-folders and items inherit the DPT of the parent folder
  • Users can apply a Personal Tag to folders or items to override the DPT
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Describe how this type of Retention Tag works:

RPT

A
  • Are assigned to default mailbox folders, such as Inbox or Deleted Items
  • Sub-folders and items inherit the RPT of the parent folder
  • Users cannot override an RPT on a folder; however, they CAN assign Personal Tags to items within that folder to override the inheritance.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How can users override RPTs with their own retention settings?

A

Users can add Personal Tags on mail items and folders.

They cannot override an RPT on a folder; however, they CAN assign Personal Tags to items within that folder.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a Retention Action?

A
  • A setting of a Retention Tag

* It defines the action that should be taken on the folder or item that the tag is assigned to.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are possible Retention Actions for each Retention Tag type?

A

• All 3 types of retention tags have these actions:

– Delete and allow recovery

– Permanently delete

• Only DPTs and Personal Tags have this action:

– Move to user’s archive mailbox

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is this Retention Action:

Move to archive

A
  • Moves the folder or item to the user’s archive mailbox, if they have one.
  • If they do not have one, the item will not be moved (no action will be taken).
  • Only DPTs and Personal Tags can perform this action.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is this Retention Action:

Delete and allow recovery

A
  • Moves the item to recoverable deleted items, where it will be subject to the Deleted Item Retention Period for the mailbox database (14 days by default).
  • Exception: If the mailbox or the items in question are currently under Litigation Hold or In-Place Hold, then the deleted items will remain in the Recoverable Deleted Items until the Hold is removed, or the Hold period lapses.
  • All 3 Retention Tag types can perform this action.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is this Retention Action:

Permanently delete

A
  • Skips the Recoverable Items folder, and purges the item from the mailbox database
  • Exception: If the mailbox or the items in question are currently under Litigation Hold or In-Place Hold, then the deleted items will remain in the Recoverable Deleted Items until the Hold period is removed, or the Hold lapses.
  • All 3 Retention Tag types can perform this action.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is a Retention Period?

A
  • A setting of a Retention Tag
  • Defines the number of days after which the retention action should be applied.
  • Examples:

– 30 days

– 365 days (1 year)

– Never

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the cmdlet to create a Retention Tag?

A

New-RetentionPolicyTag

This is confusing because “Retention Policy Tag” is one of the three types of Retention Tags, but this cmdlet is used to create all three types of tags, not just RPTs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Provide an example command for creating:

A new DPT to delete items after one year and allow recovery.

A

New-RetentionPolicyTag

-Name
whatever-you-want

-Type
All

-AgeLimitForRetention
365

-RetentionAction
DeleteAndAllowRecovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Provide an example command for creating:

A new RPT to permanently delete items in the Junk Email folder after 30 days.

A

New-RetentionPolicyTag

-Name
whatever-you-want

-Type
“Junk Email”

-AgeLimitForRetention
30

-RetentionAction
PermanentlyDelete

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

In the context of Retention, what is unique about the “Voicemail” message class?

A

They are the only message class that can have their own unique tag created for them.

A DPT can be created for them independently of the DPTs that are configured for the mailbox.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a Retention Policy?

A
  • A collection of Retention Tags

* Assigned to mailboxes to manage archiving or deletion of data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What effect does adding a Personal Tag to a Retention Policy have?

A

Mailbox users get access to the Personal Tags that are included in the Retention Policy that is assigned to their mailbox.

Users can manually add these Personal Tags to any folder or item, except for any folder that already has an RPT assigned to it (however, they can assign Personal Tags to items within that folder).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is MFA?

A

Managed Folder Assistant

  • A background process that constantly runs on an Exchange server
  • Processes mailboxes that have Retention Policies assigned to them, to:

– stamp folders and items with retention tags

– perform retention actions when retention period has passed

• The MFA process is throttled so it doesn’t compete for resources with more important processes, thus actions are not necessarily always processed immediately upon reaching their period.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What happens when you remove a Retention Tag from a Retention Policy?

A
  • MFA will not stamp that tag to any more mailbox items
  • Folders and items that were receiving that tag through inheritence will inherit a new tag
  • Folders and items that had already been directly assigned the tag will RETAIN the tag (because the tag still exists as a tag definition in AD, even though it’s no longer in the policy).
34
Q

What happens when you Delete a Retention Tag?

A
  • The Tag definition no longer exists in AD
  • Items that were previously tagged are reprocessed by MFA and a new tag is stamped on them (usually by inheriting the parent folder tag).
35
Q

How is Retention Age determined for different item types?

A
  • For most items (including email messages), retention age is based on delivery date or creation date.
  • For Recurring Calendar and Task items, retention age is based on their end date.
  • (For items with no end to their recurrence, retention period never expires.)
36
Q

What is a Retention Hold?

A
  • A Retention Hold will put a hold on any retention actions from being executed even after the retention period has passed.
  • It is set on a per-mailbox basis.
  • Once the End Date is reached, the MFA will start taking action on expired items.
  • The hold can either be removed manually, or be configured with an automatic End Date.
37
Q

What are a couple example use-cases for configuring a Retention Hold?

A

It is useful for:

  • Testing Retention Policies (to see how MFA will stamp items, without actually taking actions)
  • Periods of prolonged absence such as maternity leave or sabbatical, so a user’s unread items won’t be archived while they are away.
38
Q

What is Exchange Online Archiving?

A

• Works the same as on-premises Archiving, except the Archive Mailboxes are hosted in Office 365

39
Q

What is a Remote Archive?

A
  • A mailbox archive that is hosted in Office 365 instead of on-prem Exchange
  • Essentially, a synonym for the feature of Exchange Online Archiving.
40
Q

What are the pre-requisites for Exchange Online Archiving to work?

A
  • Directory synchronization
  • A hybrid configuration
  • Retention tags must be exported to Office 365 tenant, so the cloud MFA can continue to process tags on items in Archives
41
Q

What are the steps to configure a mailbox for Exchange Online Archiving?

A

1) Use directory synchronization to sync the user to Office 365
2) Assign an Exchange Online Archiving license to the user
3) Enable the user’s mailbox for remote archiving
4) Wait for synchronization of the changes (which can take several hours)

42
Q

What is eDiscovery?

A

• A Compliance Management feature.

Provides:

– Tools for searching mailbox contents during investigations and legal cases

– Options for “holding” the results (preserving the data so it can’t be deleted).

– A user-friendly web portal for searches, so they can be performed by non-technical people

43
Q

What is KQL?

A

Keyword Query Language

The query syntax used both in Outlook for searches, and for eDiscovery searches

44
Q

What actions can be taken on items found in eDiscovery searches?

A
  • Preserve data in-place (In-Place Hold)
  • Copy data to another location
  • Export data (e.g. to PST)
  • Remove data from mailboxes
45
Q

What do eDiscovery searches depend on?

A

Healthy and up-to-date Content Indexes.

Any new items that have not been indexed yet will not show up in search results.

46
Q

How are eDiscovery searches performed?

A
  • User must be added to “Discovery Management” role group (which is empty by default) in order to perform eDiscovery searches
  • Searches are performed in EAC
  • Searches use KQL queries
  • Can search one or multiple mailboxes
• Can search, for example, based on:
– Keywords
– Dates
– Senders
– Recipient types
– Message types

• Searches are queued once created. Once status changes to “Estimate Succeeded,” the search results are available.

47
Q

What is a Discovery Mailbox?

A

The results of an eDiscovery search can be exported to a maibox, called a discovery mailbox.

The discovery mailbox will store the search results in a folder with the same name as the Search name.

48
Q

What is a Discovery Search Mailbox?

A

Another term for a Discovery Mailbox.

49
Q

What is a Compliance Search?

A

A search of mailbox items that can REMOVE the content from mailboxes.

50
Q

When items are deleted by a Compliance Search, where do they go?

A

They are sent to the Recoverable Deleted Items folder, where end-users can recover them.

51
Q

What is the cmdlet to perform a Compliance Search?

A

New-ComplianceSearch

a new cmdlet for 2016. Earlier versions used the more limited Search-Mailbox

52
Q

What is an In-Place Hold?

A
  • A premium feature that requires an Enterprise CAL.

* Part of eDiscovery, the results of a search query will be held so they cannot be permanently deleted.

53
Q

What is the goal of a Hold?

A

To preserve mailbox contents, either indefinitely or to a desired date, in a way that is invisible to end users

54
Q

What is the difference between an In-Place Hold and a Litigation Hold?

A

• In-Place Hold:

Based on an eDiscovery search query, and applied to all content that matches the query, no matter where it’s located.

• Litigation Hold:

Applied to an entire mailbox, on a per-mailbox basis.

55
Q

PowerShell command to apply a litigation hold for one year, or indefinitely?

A

• Indefinitely:

Set-Mailbox
user@company.com
-LitigationHoldEnabled
$true

• For one year:

Same as above, but add:

-LitigationHoldDuration
365

56
Q

What are MailTips?

A

Messages displayed in Outlook and OWA to users while they are composing an email message, to alert them to potential mistakes or problems before they send a message.

57
Q

What is this:

Group Metrics

A
  • Part of the MailTips feature
  • A background process on Exchange
  • Calculates the size of a group’s membership, including nested group members
  • Stamps the group object with a msExchGroupMemberCount attribute.
  • Since it’s a background process, it may not always be up-to-date.
58
Q

What are examples of MailTips that may be displayed to a user?

A
  • A Distribution Group contains X number of recipients (when it is over a threshold).
  • A recipient’s mailbox is full
  • A recipient has an Automatic reply set (and displays the reply)
  • A custom MailTip configured on a Mailbox to display a message
59
Q

What are Message Classifications?

A
  • Labels applied (either by Exchange or by users) to messages to describe the intended use or audience of the message.
  • They are set by users by the “Set Permissions” menu.
  • Only internal to the organization; stripped from headers when sent externally.
  • Only visual suggestions; they are not enforced (though Transport Rules can be configured to take action based on them).
60
Q

How are Message Classifications utilized in Outlook?

A

Classification definitions must be configured in Exchange.

Outlook on the Web users will have them available automatically.

Outlook client users will need the definitions manually deployed.

61
Q

How do you deploy Message Classification definitions to Outlook clients?

A

• Export them to an XML file using the Microsoft-provided script:

Export-OutlookClassification.ps1

  • Distribute the XML file (probably through Group Policy)
  • Configure the path to the file in the Registry.
62
Q

What is Journaling?

A

Makes a copy of sent or received emails to another mailbox or external address.

You can have an internal journaling mailbox, or use an external, third-party journaling service.

63
Q

What is a Journal Report?

A
  • Journaled messages are stored in a special message format, known as a journal report.
  • It contains metadata about the message, and a copy of the original message is attached to it.
64
Q

What types of journaling are there?

A
  • Standard Journaling

* Premium Journaling

65
Q

What is Standard Journaling?

A
  • Set at the mailbox database level

* All messages sent or received by mailboxes hosted on that database will be journaled

66
Q

What is Premium Journaling?

A
  • A Compliance Management feature.
  • A premium feature that requires an Enterprise CAL.
  • Configured as a series of rules, similar to Transport rules
  • Can specify or target what types of messages/recipients/etc. will be journaled
67
Q

Mario is a member of the Distribution Group named “Sales.”

Luigi is NOT a member of that group.

A Journaling rule is in place that journals all messages “If the message is sent to or received from a specific user or group,” with the group “Sales” selected.

Mario sends an e-mail addressed to Luigi.

Luigi sends an e-mail addressed to Mario.

Of these two messages, which will be caught by this Journaling rule?

A
  • Both.
  • Journaling rules that target groups will capture all messages involving members of that group, even if the group address is not used. It doesn’t need to be the group itself that is receiving the message.
68
Q

If two employess are communicating via a mailbox they both have access to, by writing draft emails and never sending them, how could those messages be caught for review by an admin?

A

Litigation hold would catch them.

Journaling would not.

69
Q

What happens if a journal mailbox becomes unavailable?

A
  • If no Alternate Journal Mailbox has been configured, Journal reports will start to queue on servers.
  • If an Alternate journal mailbox has been configured:

– journal reports will be sent to it instead.

– But if the Alternate journal mailbox is also unavailable, journal reports will NOT be queued, they will be lost.

70
Q

What is Exchange Auditing?

A
  • A Compliance Management feature.

* Provides capabilities to track what mailbox users and admins are doing in the Exchange organization.

71
Q

What types of Auditing are there?

A
  • Mailbox Audit Logging

* Administrator Audit Logging

72
Q

What is Mailbox Audit Logging?

A
  • A type of Exchange Auditing.
  • Logs actions taken by mailbox owners and delegates on the contents of mailboxes.
  • Disabled by default.
73
Q

What is Administrator Audit Logging?

A
  • A type of Exchange Auditing.
  • Tracks changes made by Administrators while they are managing the Exchange environment.
  • Tracks Exchange management tool usage, such as eDiscovery, Compliance Searches, etc.
  • Enabled by default, at a level of: None.
74
Q

What are Admin Audit Log Levels?

A

Set the amount of info that is logged.

There are two levels:

  • None
  • Verbose
  • (Note: “None” is not the same as disabling Admin Audit Logging)
75
Q

Admin Audit Logging is set to: None

When a command is run, what is logged?

A
  • The Cmdlet that was run
  • The Parameters used
  • Who ran the command
  • What object was modified
  • Note: Only cmdlets that make changes are logged (not cmdlets that only retrieve info)
76
Q

Where are Admin Audit Logs stored, and how long are they retained?

A
  • Retained 90 days, by default.

* Stored in one of the Arbitration Mailboxes, which are system mailboxes.

77
Q

When a command is run, what is logged when Admin Audit Logging is set to: Verbose

A
  • All info that “None” would also have logged, plus:
  • The Old Values, before the command was run
  • The New Values, after the command was run
78
Q

What will Mailbox Audit Logging record by default?

A
  • It is disabled by default, so it will record nothing.
  • When enabled, the default actions it will record are:

– AuditOwner: nothing.

– AuditDelegate: Update, SoftDelete, HardDelete, SendAs, Create

– AuditAdmins: Same as delegates, and also:
Move, MoveToDeletedItems, FolderBind, SendOnBehalf

79
Q

How long will Mailbox Audit logs be retained?

A

Controlled by the Audit Log Age Limit, which is set on a per-mailbox basis.

It is set to 90 days by default.

80
Q

What is an Audit Bypass?

A

A setting that will allow actions taken by a specified account to not be record by Audit Log settings.

Useful if a service account is in place that would generate a lot of unwanted logs.

81
Q

What are the steps required to create a DLP rule using Document Fingerprinting, based on a form template?

A

1) Import the document into a variable.
2) Create a new Document Fingerprint, using the variable from 1), and store it as a new variable.
3) Create a new data classification rule using the New-DataClassification command, using the variable from 2).
4) You will now see the new Data Classification Rule when building the transport rule for your DLP policy.

Exchange 2016 MCSE 70-345 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions