Create and Configure Data Loss Prevention Policies SC-401 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   Contoso's compliance team needs to block the sharing of credit card numbers in email, but they also want to allow the finance department to send credit card data to the company's payment processor. You are configuring a DLP policy in the Microsoft Purview compliance portal. What should you do?

   • ACreate one policy that blocks credit card sharing and set the rule to 'Audit only' for the finance department.
   • BCreate one policy that blocks credit card sharing and configure an exception for the payment processor's email domain in the rule.
   • CCreate one policy with a rule that blocks credit card sharing and add the finance department to an allow list in that rule.
   • DCreate two policies: one that blocks credit card sharing for everyone, and a second with a higher priority that allows sharing to the payment processor for the finance department.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You have two DLP policies in Microsoft Purview. Policy A has priority 1 and blocks sharing of sensitive information. Policy B has priority 2 and allows sharing to a specific external domain. A user attempts to share a document containing sensitive information with that external domain. The user receives a policy tip that the sharing is blocked. What is the most likely reason?

   • AThe user does not have permission to share with the external domain, so the sharing is blocked by the system.
   • BPolicy B has a rule that only allows sharing if the user provides a business justification, and the user did not provide one.
   • CPolicy B is in test mode, so it does not allow the sharing.
   • DPolicy A has higher priority and its block rule matches, so the sharing is blocked before Policy B can allow it.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a DLP policy in Microsoft Purview that blocks external sharing of sensitive data in SharePoint. They also have a file policy in Defender for Cloud Apps that blocks sharing of the same sensitive data in Box. A user shares a sensitive file externally from SharePoint. Which policy applies?

   • AThe Microsoft Purview DLP policy applies because it covers SharePoint.
   • BThe Defender for Cloud Apps file policy applies because it has a broader scope.
   • CNeither policy applies because the file is shared externally from SharePoint.
   • DBoth policies apply, and the most restrictive action wins.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When creating a file policy in Defender for Cloud Apps, which of the following can be used as a condition to trigger the policy?

   • AThe network location of the user
   • BThe device's compliance status
   • CThe user's Azure AD role
   • DThe file's sharing level, such as public or internal
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   Your organization is deploying DLP policies in Microsoft Purview. The compliance team needs to create and edit policies, but they should not be able to view DLP analytics reports or manage the DLP role permissions. You need to assign the least-privilege role that meets these requirements. What should you assign?

   • ADLP Compliance Management
   • BDLP Policy Management
   • CInformation Protection Admin
   • DCompliance Administrator
   Reveal Solution Discussion Select an answer first