Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
DLP Policy for Blocking Sensitive Data in Emails
A multinational corporation needs to ensure that all emails containing a customer's passport number are automatically blocked from being sent externally. Additionally, the sending user should receive a policy tip explaining the block. Which Microsoft Purview solution should be configured?
Quick Answer
Data Loss Prevention policies are the correct configuration because the requirement combines detection of a specific sensitive pattern — a passport number — with an automatic block and a policy tip explaining the block to the sender, which is precisely what a DLP rule is built to do in one configuration. Purview ships built-in sensitive information types for passport numbers across multiple countries, using pattern matching along with supporting context to reduce false positives, so the policy does not need to be built from scratch. Once a match triggers the rule, the block action prevents the message from leaving the organisation and the policy tip surfaces to the sender at the point of composition or send, explaining exactly which policy stopped the message. This pairing of automatic block plus user-facing explanation is the signature of a DLP policy tip scenario on this exam — any time both elements appear together, DLP is the answer rather than sensitivity labels or Conditional Access.
⚠ Common exam trap
Many exam-takers confuse sensitivity labels with DLP, assuming labels can block emails, but labels only apply protection after classification, whereas DLP actively inspects content and enforces rules like blocking and policy tips.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policies
Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect sensitive information, such as passport numbers, in emails and automatically block external transmission while displaying a policy tip to the user. This matches the requirement exactly, as DLP can inspect email content for sensitive data types and enforce actions like blocking and notifying the sender.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sensitivity labels
Why it's wrong here
Sensitivity labels classify and protect documents but do not block emails from being sent based on content.
- ✓
Data Loss Prevention (DLP) policies
Why this is correct
DLP policies can detect passport numbers in emails and block them from being sent, with user notification via policy tips.
- ✗
Conditional Access policies
Why it's wrong here
Conditional Access controls access to apps and data based on conditions like location or device, not email content.
- ✗
eDiscovery
Why it's wrong here
eDiscovery is used for legal hold and search of content, not for blocking email transmission in real time.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
About these practice questions
This MS-900 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Drag and drop the steps to configure a data loss prevention (DLP) policy in the Microsoft 365 compliance center into the correct order.
medium- ✓ A.Step 1: Select a DLP template or start with a custom policy. Step 2: Choose the locations (Exchange, SharePoint, OneDrive, Teams) where the policy applies. Step 3: Define the policy rules with conditions and actions.
- B.Step 1: Choose locations (Exchange, SharePoint, OneDrive, Teams). Step 2: Select a DLP template or start with a custom policy. Step 3: Define the policy rules with conditions and actions.
- C.Step 1: Define the policy rules with conditions and actions. Step 2: Select a DLP template or start with a custom policy. Step 3: Choose locations (Exchange, SharePoint, OneDrive, Teams).
- D.Step 1: Select a DLP template or start with a custom policy. Step 2: Define the policy rules with conditions and actions. Step 3: Choose locations (Exchange, SharePoint, OneDrive, Teams).
Why A: DLP policies are created in the compliance center by selecting a template, locations, and rules.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.