Implement Microsoft Purview Data Loss Prevention (DLP) MS-102 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   Your DLP reports show that a policy for SharePoint Online has a high number of matches, but most are for a specific document library that is used for testing. You need to exclude this library from the policy without affecting other locations. What should you do?

   • ADelete the test library and recreate it after the policy is removed.
   • BChange the policy to 'Audit only' so it does not block actions in the test library.
   • CDisable the DLP policy and create a new one without the test library.
   • DEdit the DLP policy and add an exclusion for the specific SharePoint site or library.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An organization has a DLP policy for Exchange Online that blocks emails containing credit card numbers. Recently, a legitimate email was blocked because it contained a credit card number in a signature block. The compliance team wants to reduce false positives without weakening protection. What should you do?

   • AIncrease the confidence level of the sensitive info type to require more matches.
   • BDisable the DLP policy and rely on user training to avoid including credit card numbers in signatures.
   • CRefine the DLP policy by adding an exception for emails where the credit card number appears in the signature block, and review the activity explorer to confirm the change.
   • DChange the action to 'audit only' so that no emails are blocked.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has multiple DLP policies across different workloads. The compliance team wants to compare the effectiveness of these policies and identify which ones need adjustment. What should they use?

   • AThe DLP reports page, which provides a summary of matches and actions across all policies.
   • BThe activity explorer, which shows individual events.
   • CThe alerts queue, which lists all alerts from all policies.
   • DThe audit log, which records all user activities.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   After a DLP incident, the compliance team needs to provide a report to management that includes the number of incidents, the types of data involved, and the actions taken. They also need to identify any trends. What should they use?

   • AThe alerts queue to list all alerts generated.
   • BThe DLP reports page to get aggregate data, and the activity explorer for detailed incident information.
   • CThe audit log to see all user activities.
   • DThe sensitivity labels applied to files.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   Your organization has a DLP policy for SharePoint Online that blocks external sharing of documents containing sensitive data. Users are also using the OneDrive sync client to sync SharePoint libraries to their devices. You need to ensure that sensitive data is not copied to USB drives from the synced files. What should you do?

   • AUse sensitivity labels to encrypt the documents so they cannot be copied.
   • BConfigure the SharePoint DLP policy to block downloads of sensitive documents.
   • CDisable the OneDrive sync client for all users to prevent local copies.
   • DEnable Endpoint DLP and create a policy that blocks copying sensitive files to removable media.
   Reveal Solution Discussion Select an answer first