Manage the Microsoft Power Platform environment →mediumMultiple Choice

PL-900 Data Loss Prevention (DLP) policy Practice Question

Exhibit

{
  "policyName": "Block Social Connectors",
  "description": "Prevent use of social media connectors in all environments",
  "environments": ["All"],
  "connectorClassification": ["Blocked"],
  "connectors": ["Twitter", "Facebook", "LinkedIn"],
  "action": "Block"
}

An administrator configures a Data Loss Prevention (DLP) policy with the scope set to 'All environments' and places selected connectors in the 'Blocked' group. What will be the result of this policy?

⚠ Common exam trap

The trap is misreading the scope — candidates assume 'All environments' excludes the default environment or only applies to production, but it applies to every environment including the default one.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The connectors are blocked in all environments

A DLP policy scoped to 'All environments' applies its connector classification across every Power Platform environment in the tenant. When connectors are placed in the 'Blocked' group, any app or flow using those connectors is prevented from running in any environment, including the default one. The scope setting directly determines where the policy's restrictions take effect.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The connectors are allowed but audited
Why it's wrong here
Placing connectors in the Blocked group prevents their use entirely; auditing without blocking is the behaviour of a different connector classification. Auditing is tempting because DLP policies can log connector activity, but that applies to non-blocked groups, not the Blocked group under this scope.
✗
The connectors are blocked only in production environments
Why it's wrong here
'All environments' applies the policy tenant-wide, so blocked connectors are refused in every environment, not production alone. Scoping a policy to specific environments is what produces environment-limited blocking, which is why production-only restriction appears plausible but contradicts the chosen scope.
✓
The connectors are blocked in all environments
Why this is correct
Scoping the DLP policy to 'All environments' applies the connector classification everywhere, so placing connectors in the 'Blocked' group prevents their use across every environment. This satisfies the stem's stated scope, rather than restricting blocking to a single environment.
✗
The connectors are blocked except for the default environment
Why it's wrong here
Blocked connectors are refused across all environments, including the default one; the policy carves out no exception for it. Excluding the default environment requires an explicit environment-scoped policy, so this option misstates the effect of the 'All environments' scope.

Go deeper

PL-900 Data Loss Prevention (DLP) policy Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question