Deploy and manage a Microsoft 365 tenant →mediumMultiple Choice

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "policy": {
    "name": "Data Loss Prevention Policy",
    "locations": [
      "ExchangeOnline",
      "SharePointOnline",
      "OneDriveForBusiness",
      "Teams"
    ],
    "rules": [
      {
        "name": "Credit Card Number Rule",
        "condition": {
          "sensitiveInformationTypes": [
            {
              "id": "Credit Card Number",
              "minCount": 1
            }
          ]
        },
        "actions": [
          {
            "type": "BlockAccess",
            "config": {
              "blockMessage": "Access blocked due to DLP policy"
            }
          }
        ]
      }
    ]
  }
}
```

The exhibit shows a DLP policy configuration. A user reports that they cannot share a document containing a credit card number from OneDrive for Business. However, the document was shared successfully last week. What is the most likely reason for the change?

⚠ Common exam trap

Candidates often assume DLP policies are static and only apply to new content, but Microsoft 365 DLP policies are dynamic and can affect existing shares when deployed or updated.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The DLP policy was recently deployed or updated.

The most likely reason is that the DLP policy was recently deployed or updated. DLP policies in Microsoft 365 are evaluated in near real-time, and a newly deployed or modified policy will immediately enforce its rules on content sharing. Since the document was shared successfully last week, the policy change is the most plausible cause for the sudden block.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The DLP policy was recently deployed or updated.
Why this is correct
When a Microsoft Purview DLP policy with a Block external-sharing action is newly deployed or updated, the policy engine starts evaluating new sharing operations from that point forward. In this scenario the user's earlier successful share almost certainly occurred when no restrictive policy was active, and the current attempt to share another link is now being blocked by the newly enforced rule. This timing makes a recent deployment or update the most plausible explanation for a sudden change from permitted to blocked external sharing.
✗
The DLP policy requires administrator override for sharing.
Why it's wrong here
The Block action in a DLP rule is absolute: it prevents the sharing action from completing and does not prompt for a business justification or administrator override. Microsoft 365 DLP does have a 'Block with override' action, but that behavior must be explicitly configured on the rule; the exhibit for this policy shows no such override option. Therefore the policy does not 'require' an administrator override—the rule simply denies the share.
✗
The DLP policy is applied only to SharePoint Online, not OneDrive.
Why it's wrong here
The exhibit's Locations list includes both SharePoint sites and OneDrive for Business, so the DLP policy is not limited to SharePoint Online. OneDrive for Business is a separate workload with its own sharing endpoints, and because it is selected, the same block action applies to documents shared from a user's OneDrive. The block occurs because OneDrive is a configured location, not because the policy ignores OneDrive.
✗
The DLP policy does not include Microsoft Teams.
Why it's wrong here
Microsoft Teams is listed as a location in the exhibit, but its inclusion or exclusion is irrelevant to a OneDrive external-sharing event. DLP policies for Teams govern chat and channel messages, whereas the action that blocks sharing of a file link is enforced by the SharePoint Online and OneDrive for Business workload detectors. Consequently, saying the policy 'does not include Teams' does not explain why or how a OneDrive share is blocked.

Go deeper

MS-102 Deploy and manage a Microsoft 365 tenant Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question