MS-102 Manage compliance by using Microsoft Purview Practice Question
Your company is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers in emails. Which THREE actions can a DLP policy take when a match is found?
⚠ Common exam trap
MS-102 often tests the specific actions DLP can take versus those it cannot, such as encryption or deletion; candidates may incorrectly assume DLP can encrypt or delete emails.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Allow the user to override the block with a business justification.
Option C is correct because Microsoft Purview DLP policies can be configured with user override capabilities, allowing users to provide a business justification to bypass a block action when a sensitive information match is detected. Option D is correct because DLP policies can display policy tips to users in supported workloads like Outlook, notifying them that their email contains sensitive content and explaining the policy that triggered the match. Option E is correct because blocking the email from being sent is a core DLP enforcement action that prevents the message containing credit card numbers from leaving the organization. Option A is incorrect because DLP policies do not retroactively delete emails from a recipient's inbox; they act at send time or at rest through retention/retention labels, not as a DLP match action. Option B is incorrect because DLP policies do not automatically encrypt emails as a match action; encryption is handled through sensitivity labels, Azure Information Protection, or Exchange mail flow rules, not DLP policy actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the email from the recipient's inbox.
Why it's wrong here
Deleting from the recipient's inbox is not a DLP policy action; DLP can block, encrypt, or notify, but never reaches into a delivered mailbox to remove mail. It is tempting because quarantine and deletion sound similar, yet mailbox-level removal belongs to retention or eDiscovery, not transport-time DLP enforcement.
- ✗
Encrypt the email automatically.
Why it's wrong here
DLP cannot itself encrypt email; encryption is applied by Microsoft Purview Message Encryption or sensitivity labels, which DLP may trigger as a separate action. It is tempting because DLP does invoke encryption in some configurations, but the policy action list contains restrict access, not automatic encryption of the message.
- ✓
Allow the user to override the block with a business justification.
Why this is correct
Permits the sender to bypass the block by supplying a business justification, satisfying the need for a documented exception path. The override is recorded for audit, balancing strict credit card protection against legitimate business email flow.
- ✓
Send a notification to the user with a policy tip.
Why this is correct
Delivers a policy tip to the sender at the moment of the match, satisfying the requirement to make users aware of the credit card detection. This educates in real time without blocking delivery, complementing enforcement actions within the same DLP policy.
- ✓
Block the email from being sent.
Why this is correct
Blocking the email prevents the message containing detected credit card numbers from leaving the organisation, enforcing protection at the point of sending. This restrictive action satisfies the scenario's requirement to stop sensitive data exfiltration, complementing other DLP actions such as encryption or user override.
Go deeper
Related to this question
Learn chapter
OneDrive Sharing Policies and External Access
Key term
Outlook
Microsoft Outlook is an email, calendar, and contact management application that is part of the Microsoft 365 suite, used by businesses and individuals to organize communications and schedules.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.