Microsoft 365 Mobility and Security (legacy) — Question 112

You have a Microsoft 365 subscription.

All users have their email stored in Microsoft Exchange Online.

In the mailbox of a user named User1, you need to preserve a copy of all the email messages that contain the word ProjectX.

What should you do first?

Answer options

• A. From the Exchange admin center, start a mail flow message trace.
• B. From the Microsoft Purview compliance portal, create an eDiscovery case.
• C. From Microsoft Defender for Cloud Apps, create an activity policy.
• D. From the Microsoft Purview compliance portal, create a data loss prevention (DLP) policy.

Correct answer: B

Explanation

The correct answer is B because creating an eDiscovery case in the Microsoft Purview compliance portal allows you to search and preserve specific email messages based on criteria like keywords. The other options do not provide the functionality needed to preserve emails based on content; for example, a mail flow message trace (A) is for tracking emails, not preserving them, while an activity policy (C) and a DLP policy (D) serve different purposes unrelated to preserving emails based on specific terms.