Information protection scanner: Scans on-premises data, unrelated to forensic evidence.
Claim capacity: Required to enable forensic evidence collection in Insider Risk Management because forensic evidence consumes special storage (capacity units).
Adaptive Protection: Assigns policies dynamically, unrelated to forensic evidence.
Priority user groups: Helps scope users but not the prerequisite step for forensic capture.
Reference: Forensic evidence in Insider Risk Management]

Explanation:

Let's analyze each scenario based on the given retention policies and Microsoft 365 documentation.
# Policies Recap
Policy1
Teams channel messages # All Teams # Retain 7 years # Delete automatically.
Teams chats # User1 # Retain 7 years # Delete automatically.
Policy2
Teams channel messages # Team1 # Retain 5 years # Delete automatically.
Teams chats # User2 # Retain 5 years # Delete automatically.
# Reference: Retention policies in Microsoft Teams
# Statement 1: The message edited by User1 will be deleted after five years.
Location = Team1 channel.
Policy1 applies (7 years for all Teams).
Policy2 applies (5 years for Team1).
Conflict rule: For retention, the longest duration wins.
Therefore, the message stays 7 years, not 5.
# answer: NO
# Statement 2: User1 can see the message sent by User2 for up to seven years.
Location = Private 1:1 chat (User2 # User1).
For User1's mailbox: Policy1 applies (7 years).
For User2's mailbox: Policy2 applies (5 years).
Retention in Teams chats is per-user, so each participant may have different durations.
For User1, the retention is 7 years.
# answer: YES
# Statement 3: The message deleted by User1 will be moved to the SubstrateHolds folder.
Location = Team2 channel.
User1 deletes the message, but retention policy (Policy1) applies (7 years).
Retention overrides user deletion: message is moved to the SubstrateHolds folder in the hidden mailbox for preservation.
# Reference: How retention works with SubstrateHolds
# answer: YES

Explanation:

To add a new keyword dictionary in Microsoft Purview Data Loss Prevention (DLP), you must create a Sensitive Information Type (SIT).
Sensitive Info Types (SITs) allow you to define custom detection rules, including keyword dictionaries, regular expressions, and functions for identifying sensitive content in emails, documents, and other Microsoft
365 locations. A keyword dictionary is a list of predefined words/phrases that Microsoft Purview can use to identify and classify content for DLP policies.
Steps to add a keyword dictionary:
1. Go to Microsoft Purview compliance portal
2. Navigate to Data classification > Sensitive info types
3. Create a new sensitive info type
4. Add a keyword dictionary
5. Save and use it in a DLP policy