Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple Choice

MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Exhibit

Refer to the exhibit.

```json
{
  "policy": {
    "name": "Block External Sharing for Confidential",
    "mode": "enforce",
    "rules": [
      {
        "name": "Rule1",
        "condition": {
          "sensitivityLabel": "Confidential",
          "sharingType": "external"
        },
        "action": "blockAccess"
      }
    ]
  }
}
```

You have the above Microsoft Purview DLP policy JSON. What will this policy do?

⚠ Common exam trap

Test-takers frequently confuse 'block external sharing' with 'alert on external sharing' or 'apply encryption', failing to read the specific action in the JSON and assuming a generic protection behavior.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Block external sharing of documents labeled Confidential

The JSON policy defines a DLP rule that blocks external sharing of documents labeled 'Confidential'. The 'Actions' section includes 'BlockExternalSharing', which prevents users from sharing these documents with external recipients via SharePoint, OneDrive, or Teams. The 'Condition' specifies that the policy applies only to content with the 'Confidential' sensitivity label, ensuring internal sharing remains unaffected.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Block internal sharing of documents labeled Confidential
Why it's wrong here
The DLP rule's condition is explicitly scoped to external sharing, not internal sharing. The condition matches activities such as 'Shared externally' or sharing with users outside the tenant, so internal sharing within the organization would not trigger the rule. Therefore, the rule would not block internal sharing of Confidential documents.
✗
Alert when Confidential documents are shared externally
Why it's wrong here
The rule does not include an alert or notification action; its action is set to blockAccess, which prevents access to shared content. While DLP policies can be configured to send email alerts or show user notifications, this particular policy lacks such an action. Consequently, the outcome is a block, not an alert, when the condition is met.
✓
Block external sharing of documents labeled Confidential
Why this is correct
This is the correct interpretation because the rule's condition combines the sensitivity label 'Confidential' with an external sharing activity, and the configured action is blockAccess. When an external user attempts to access or share such a document, the blockAccess action denies that access, effectively blocking the external sharing. This precisely matches the described functionality.
✗
Apply encryption to documents labeled Confidential when shared externally
Why it's wrong here
The action in this rule is blockAccess, not an encryption or protection action. Applying encryption would require a DLP action like 'Protect' or 'Apply encryption' to transform the document, but this rule simply denies access to external users. As a result, encryption is not applied to Confidential documents shared externally.

Go deeper

MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question