Implement and Monitor Microsoft Purview Endpoint DLP SC-401 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is typically monitored and blocked by Just-in-Time Protection in Endpoint DLP?

   • AInstalling a new application
   • BChanging the device wallpaper
   • CConnecting to a new Wi-Fi network
   • DCopying a sensitive file to a network share
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   Your organization has a DLP policy that restricts sharing of credit card numbers. You need to ensure that when a user attempts to paste a credit card number into an unauthorized web form, the action is blocked immediately without waiting for the user to save a file. What should you configure in the DLP policy?

   • AUse the 'Endpoint DLP' location and configure a rule that targets the 'Clipboard' activity with the action 'Block'.
   • BCreate a custom sensitive info type for credit card numbers and apply it to the 'Exchange' location.
   • CEnable 'Just-in-time protection' in the policy settings to require user justification before any sensitive data is pasted.
   • DAdd a rule with the condition 'Content contains' and set the action to 'Block' with 'Allow override' enabled.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   Your organization has Windows 11 Enterprise devices that are not yet enrolled in Microsoft Purview. You need to deploy Endpoint DLP so that DLP policies can evaluate files on these devices. The devices are already joined to Microsoft Entra ID and have Microsoft 365 E5 licenses. What is the minimum additional configuration you must perform before Endpoint DLP will work?

   • AConfigure a Windows Defender Firewall rule to allow Endpoint DLP traffic to Microsoft 365.
   • BInstall the Microsoft Purview extension on each device and enable device onboarding in the Microsoft Purview compliance portal.
   • CDeploy Microsoft Intune to manage the devices and create a configuration profile that enables Endpoint DLP.
   • DAssign the devices to a device group in Microsoft Purview and publish a DLP policy to that group.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   Your organization uses Endpoint DLP to protect sensitive documents. You notice that some users are able to print sensitive files, but the DLP policy should block printing. You have already configured a rule that blocks the 'Print' activity. What should you check first to ensure the policy is being applied correctly?

   • AEnsure that the devices have the latest Windows updates installed.
   • BVerify that the users are included in the policy's scope and that the policy is enabled.
   • CCheck if the users have local administrator rights on their devices.
   • DConfirm that the sensitive file type is included in the 'File types' list of the policy.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After implementing Endpoint DLP, you need to monitor for users who attempt to print sensitive documents. You want to receive an email alert when such an attempt is blocked. What should you configure?

   • AUse Microsoft Defender for Endpoint to monitor print activities.
   • BConfigure a Power Automate flow that reads the Windows event log.
   • CEnable 'Alert' on the rule that blocks the 'Print' activity.
   • DCreate a separate audit rule for printing and review logs weekly.
   Reveal Solution Discussion Select an answer first