Explanation:
Requirement
Correct selection
Documents containing content that matches a custom regular expression must be classified automatically.
A sensitive info type
Contract documents in a standard format must be classified automatically.
A trainable classifier
The first requirement must use a sensitive info type because Microsoft Purview sensitive information types are pattern-based classifiers. Microsoft states that sensitive information types detect sensitive content by using patterns, and custom sensitive information types can be created when the organization needs its own detection logic. A custom regular expression is exactly this kind of detection pattern, so it belongs in a custom sensitive information type rather than a trainable classifier or EDM schema.
The second requirement must use a trainable classifier . Contract documents in a standard business format are document-category classification problems, not exact-value matching problems. Microsoft Purview trainable classifiers are designed to recognize types of content by evaluating example content and can be used as conditions for auto-labeling Office files with sensitivity labels. Microsoft also provides built-in trainable classifiers for agreement and legal agreement content, including legal agreements, statements of work, leases, employment agreements, contracts, and nondisclosure agreements.
An exact data match schema is wrong here because EDM is used to match structured sensitive records from a data source, not to identify contract document format. A data connector is for ingesting external data into Microsoft Purview, not classifying Office documents.

The correct answer is the Microsoft Defender portal .
Explanation:
* Exposure Score is a security metric provided by Microsoft Defender for Endpoint . It measures an organization's overall security posture by evaluating device configuration, vulnerabilities, and security controls across endpoints.
* Microsoft documentation defines Exposure Score as part of the Microsoft Defender Vulnerability Management experience, which is accessed through the Microsoft Defender portal .
* The Exposure Score helps administrators:
* Understand how vulnerable devices are across the organization
* Track improvements to security posture over time
* Prioritize remediation actions based on risk
* Microsoft explicitly states that Exposure Score is viewed and managed within the Microsoft Defender portal , which serves as the central dashboard for Defender for Endpoint, Defender for Office 365, and related security services.
Why the other options are incorrect
A). the Microsoft Intune admin center
Intune focuses on device management, compliance, and configuration profiles. While it provides device health and compliance reporting, it does not display the Defender Exposure Score.
B). the Microsoft Purview portal
Microsoft Purview is used for data governance, compliance, insider risk, and information protection. It has no functionality related to endpoint exposure scoring.
D). the Microsoft 365 admin center
The Microsoft 365 admin center is designed for tenant-wide administration such as users, licenses, and services. It does not provide detailed endpoint security metrics like Exposure Score.

Microsoft Purview auditing solutions provide an integrated solution to help organizations effectively respond to security events, forensic investigations, internal investigations, and compliance obligations. Thousands of user and admin operations performed in dozens of Microsoft 365 services and solutions are captured, recorded, and retained in your organization's unified audit log. Audit records for these events are searchable by security ops, IT admins, insider risk teams, and compliance and legal investigators in your organization.
This capability provides visibility into the activities performed across your Microsoft 365 organization.
Note: Permissions alert policies
Example: Elevation of Exchange admin privilege
Generates an alert when someone is assigned administrative permissions in your Exchange Online organization. For example, when a user is added to the Organization Management role group in Exchange Online.
Reference:
https://learn.microsoft.com/en-us/microsoft-365/compliance/audit-solutions-overview
https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies