MS-102 Manage compliance by using Microsoft Purview Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create DLP policy, Define conditions and actions, Test the policy, Deploy the policy

  Why this is correct

  In Microsoft Purview, creating the DLP policy first establishes the policy container and its scope—such as Exchange, SharePoint, OneDrive, and endpoints. You then define conditions, like sensitive info types or labels, and actions, such as restricting access or showing policy tips. Testing the policy in simulation mode validates detection accuracy and user impact before full enforcement. Deploying in the final step turns on enforcement, often after reviewing test results and adjusting rules to minimize false positives.

• ✗

  Define conditions and actions, Create DLP policy, Test the policy, Deploy the policy

  Why it's wrong here

  You cannot define conditions and actions before the DLP policy exists because in Microsoft Purview, conditions and actions are properties of a policy object, not standalone entities. Attempting to configure them first is impossible in the compliance portal UI; the policy creation wizard must first capture the policy name, locations, and scope. Only after this container is created can you add rules with conditions and actions. This order also ensures that any test or deployment activity has a defined policy to which it can refer.

• ✗

  Create DLP policy, Define conditions and actions, Deploy the policy, Test the policy

  Why it's wrong here

  Deploying the DLP policy before testing risks making changes to production without evidence that detection rules are accurate. Unlike test mode, a fully deployed policy enforces actions such as blocking or encrypting content, which can disrupt legitimate business workflows if the policy has false positives. Microsoft Purview provides a test mode that generates reports on matches without applying remediation, letting you validate the policy and adjust thresholds. Only after validating test results should you set the policy to enforcement mode, making deploy-before-test an unsafe shortcut.

• ✗

  Create DLP policy, Test the policy, Define conditions and actions, Deploy the policy

  Why it's wrong here

  Testing a DLP policy before defining its conditions and actions yields no meaningful results because there is no detection logic to evaluate. In Microsoft Purview, test mode measures how well rules and conditions match content; with no rules configured, all test reports would be empty or non-informative. Additionally, the policy's scope and locations are not yet finalized, so tests would not reflect the actual environment. Therefore, conditions and actions must be configured first to provide content for the test phase.

Go deeper

Related to this question