Implement Microsoft Purview Data Loss Prevention (DLP) MS-102 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization has a DLP policy for Microsoft 365 Copilot that blocks responses containing sensitive data. However, the compliance team wants to allow Copilot to use sensitive data for internal queries but block responses that would be shared externally. They also want to analyze the effectiveness of the policy. What should you do?

   • ADisable the Copilot DLP policy and rely on user training.
   • BChange the DLP policy to 'audit only' for all Copilot interactions.
   • CCreate a sensitivity label that blocks Copilot from accessing sensitive data.
   • DConfigure the DLP policy for Copilot to block only when the response is shared externally, and use the activity explorer to analyze matches.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   After implementing a DLP policy, you need to assess its effectiveness. You want to see which rules are triggering the most matches and which locations have the most incidents. What should you review?

   • ADLP reports in the Microsoft Purview compliance portal, which provide insights into rule matches and location activity.
   • BThe DLP alerts page to see individual incidents.
   • CThe audit log for all user activities.
   • DThe compliance score to see the overall security posture.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A DLP policy generates a large number of alerts, but the security team is not sure which alerts are genuine incidents. They want to reduce noise while ensuring real incidents are not missed. What should you do?

   • AReview the DLP reports to see which policy generated the most alerts.
   • BDisable the DLP policy to stop all alerts.
   • CAdjust the alert thresholds and use the activity explorer to validate the alerts before taking action.
   • DIncrease the confidence level of the sensitive info types to reduce false positives.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user at Fabrikam accidentally emailed a spreadsheet containing customer passport numbers to an external recipient. The DLP policy for Exchange Online is set to 'Block' with 'Override' allowed. The email was sent successfully. What should you do first to investigate and respond?

   • ACheck the audit log for the user's mailbox to see if the email was sent, then create a new DLP policy.
   • BUse Exchange message tracking to find the email and then manually delete it from the recipient's mailbox.
   • CDisable the DLP policy immediately to prevent further incidents, then contact the user.
   • DReview the DLP alerts in the Microsoft Purview compliance portal to see if an alert was generated and whether the user provided an override justification.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company has Endpoint DLP configured to block copying sensitive data to USB drives. However, some users need to copy data to USB drives for legitimate business purposes. The compliance team wants to allow these users to copy but still monitor the activity. What should you do?

   • AUse a sensitivity label that allows copying to USB drives.
   • BChange the Endpoint DLP action to 'audit only' for all users.
   • CDisable Endpoint DLP for all users.
   • DCreate an Endpoint DLP policy exception for the specific users, and configure the action to 'audit' for those users.
   Reveal Solution Discussion Select an answer first