mediumMultiple Choice
CAS-004 Practice Question: A security consultant for a law firm that handles…
You are a security consultant for a law firm that handles highly confidential client data. The firm wants to implement a data loss prevention (DLP) solution to prevent sensitive data from leaving the network via email. The firm's email system is Microsoft 365. The DLP policy must comply with the firm's data classification policy, which identifies 'Legal Strategy' as top secret and 'Client Contact Info' as confidential. The firm also wants to allow attorneys to send confidential information to clients with a business justification. Which of the following DLP rule configurations best meets these requirements?
⚠ Common exam trap
Test-takers frequently confuse 'allow with audit log' (passive monitoring) with 'allow with override requiring justification' (active enforcement), overlooking the specific business requirement for a justification workflow.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Block top secret content and allow confidential content with an override requiring a business justification
It aligns with the firm's data classification policy by blocking top-secret 'Legal Strategy' content outright, while allowing 'Client Contact Info' (confidential) to be sent with a business justification override. This balances security with operational needs, as Microsoft 365 DLP supports policy tips and override options with justification for lower-sensitivity data, ensuring compliance without disrupting attorney-client communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt all emails containing any sensitive data and allow delivery
Why it's wrong here
Encrypting every sensitive email permits delivery without any business justification, so attorneys cannot be held to the override requirement and top secret content still leaves the network. Encryption protects confidentiality in transit but does not enforce the classification-based blocking the policy demands.
- ✗
Block both top secret and confidential content with no override
Why it's wrong here
Blocking both classifications with no override removes the business-justification path the firm explicitly requires for attorneys sending confidential data to clients. It is tempting because hard blocking maximises enforcement of top-secret Legal Strategy content, which is the right posture when no legitimate override exists.
- ✗
Block top secret content and allow confidential content with an audit log
Why it's wrong here
Blocking top secret outright prevents attorneys from ever sending Legal Strategy material with justification, which the firm requires for confidential content. Audit-only logging also fails to stop Client Contact Info leaving, since no override or encryption is applied to that classification.
- ✓
Block top secret content and allow confidential content with an override requiring a business justification
Why this is correct
Blocking top secret content outright satisfies the Legal Strategy classification, while permitting confidential content with a justification override lets attorneys email Client Contact Info to clients as required. Microsoft Purview DLP policy tips enforce the override, capturing the business justification before release rather than silently blocking legitimate client communication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.