MS-102 Manage compliance by using Microsoft Purview Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Block the email from being sent

  Why this is correct

  In Microsoft Purview Data Loss Prevention (DLP), a policy can be configured with an action to block the transmission of an email that contains sensitive information. When the condition is met, the DLP engine can prevent the message from leaving the sender's mailbox, either silently or with a policy tip, depending on the rule configuration. This is a primary enforcement mechanism to stop data exfiltration before it occurs, as the email is never delivered to the recipient.

• ✗

  Allow the sender to override the block

  Why it's wrong here

  The ability for a sender to override a DLP block is not an action that DLP itself takes; rather, it is a user-initiated response when a policy allows for override with justification. DLP actions are automated enforcement steps, whereas override is an end-user decision that occurs when the policy tip includes an override option. Even if an override is possible, it is not a DLP 'action' in the same sense as blocking or encrypting; it is a permission granted to the user.

• ✗

  Block all emails from the sender

  Why it's wrong here

  DLP is content-aware and evaluates each email based on the presence of sensitive data, such as credit card numbers or personal health information, not based on the sender's identity alone. A blanket block on all emails from a particular sender is a transport rule or mail flow rule scenario, not a DLP action. DLP rules are designed to inspect and conditionally act on message content and context, not to enforce simplistic sender-based restrictions.

• ✓

  Notify the sender with a policy tip

  Why this is correct

  A common DLP action is to deliver a policy tip to the sender, which appears in Outlook (client or web) and informs them that the email contains sensitive information that violates a policy. The policy tip can explain the compliance issue and optionally provide guidance, such as allowing the sender to enter a justification or contact an administrator. This action supports user education and auditing without disrupting the flow unless combined with a blocking action.

• ✓

  Encrypt the email message

  Why this is correct

  DLP can apply Microsoft Purview Message Encryption as an action, automatically encrypting the email to protect sensitive content while still allowing it to be sent. This is a less restrictive alternative to blocking, ensuring that only authorized recipients can decrypt and read the message. The encryption action is often paired with a condition that triggers on high-confidence sensitive information types, and it is a separate, distinct DLP enforcement option from blocking or notifying.

Go deeper

Related to this question