How to Allow DLP Policy Override with Business Justification
Exhibit
$dlpPolicy = New-DlpCompliancePolicy -Name "CreditCardProtection" -ExchangeLocation All -SharePointLocation All New-DlpComplianceRule -Name "BlockHighConf" -Policy $dlpPolicy.Identity -BlockAccess $true -NotifyUser $true -NotifyAllowOverride $false -SentInfo SIT-CreditCardNumber
Refer to the exhibit. A compliance administrator runs the PowerShell commands to create a DLP policy. Users complain that they are blocked from sending emails containing credit card numbers but cannot override the block. The administrator wants to allow override with a business justification. What should they do?
Quick Answer
The correct answer is to change the NotifyAllowOverride parameter to $true in the rule. This is because the PowerShell cmdlet shown in the exhibit sets NotifyAllowOverride to $false, which explicitly prevents users from overriding the DLP policy when their email containing credit card numbers is blocked. By setting this parameter to $true, the administrator enables the end-user override prompt, allowing them to submit a business justification to bypass the block. On the SC-900 exam, this question tests your understanding of how DLP policy override with business justification is configured via PowerShell, a common scenario where compliance administrators need granular control over policy enforcement. A frequent trap is confusing the NotifyAllowOverride parameter with enabling the policy itself or changing its scope; remember that the default block is controlled by this specific notification flag. A helpful memory tip: think of "NotifyAllowOverride" as the "permission to plead your case" switch—set it to true to let users justify the exception.
⚠ Common exam trap
A common mix-up: candidates confuse enabling a policy (Option C) with enabling override behavior, not realizing that a policy can be active and blocking but still lack the override mechanism unless `NotifyAllowOverride` is explicitly set to `$true`.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the NotifyAllowOverride parameter to $true in the rule.
The `NotifyAllowOverride` parameter controls whether users can override a DLP rule action with a business justification. Setting it to `$true` enables the override prompt, allowing users to bypass the block when they provide a valid reason. The current policy blocks emails with credit card numbers without offering this option, so changing this parameter directly addresses the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Change the SentInfo parameter to a different sensitive info type.
Why it's wrong here
Changing the sensitive info type would not affect the override behavior.
- ✗
Remove the SharePoint location from the policy.
Why it's wrong here
Removing SharePoint does not affect email override.
- ✗
Enable the DLP policy by setting the Policy's Enabled parameter to $true.
Why it's wrong here
The policy is already enabled (no indication it's disabled).
- ✓
Change the NotifyAllowOverride parameter to $true in the rule.
Why this is correct
Setting NotifyAllowOverride to $true allows users to override the block with justification.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
DLP policy
A DLP policy is a set of rules that an organization uses to prevent sensitive data from being lost, stolen, or accidentally exposed, whether it is in use, in motion, or at rest.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. You are a compliance administrator managing a DLP policy in Microsoft Purview. The policy is set to 'enforce' mode but you notice that internal users can still share credit card numbers via email to external recipients. What is the most likely cause?
hard- A.The policy is in test mode, not enforce mode
- B.The policy is not applied to the user's mailbox
- C.The condition requires a minimum count of 5
- ✓ D.The action only blocks access to the content from external users, not sharing by internal users
Why D: A DLP policy in 'enforce' mode can still allow internal users to share sensitive data if the policy action is configured to 'block access to content from external users' rather than 'block sharing by internal users'. In Microsoft Purview, the 'block access' action restricts external recipients from viewing the content but does not prevent the internal sender from transmitting the email. To stop internal users from sending, the policy must use the 'block sending' action, which prevents the message from being delivered.
Variation 2. Refer to the exhibit. An administrator creates a DLP rule as shown. What is the expected outcome when a user tries to share a file containing a U.S. Social Security Number with an external recipient?
medium- A.The sharing is blocked only if the user is not the file owner.
- B.The sharing is allowed, but an audit event is generated.
- C.The file is shared, but the user is notified and must provide justification.
- ✓ D.The sharing is blocked, and the user receives a notification.
Why D: The DLP rule is configured with an action of 'Block' (or 'BlockAccess') and user notification enabled. When a user attempts to share a file containing a U.S. SSN with an external recipient, the rule blocks the sharing and displays a notification to the user explaining that the action is blocked. Option A is incorrect because the rule applies to all users, not just non-owners. Option B is incorrect because the rule does more than generate an audit event; it actively blocks the sharing. Option C is incorrect because the rule blocks the action outright, rather than allowing it with justification.
Variation 3. A compliance administrator creates the DLP policy shown in the exhibit. When a user shares a document containing a credit card number with an external partner, what is the expected outcome?
medium- ✓ A.The document is blocked from being shared externally, and the user receives a notification.
- B.The document is automatically deleted.
- C.A sensitivity label is automatically applied.
- D.The document is blocked from being shared both internally and externally.
Why A: The DLP policy is configured with an action to block external sharing and notify the user when a credit card number is detected. When the user shares the document externally, the policy triggers this action, preventing the share and sending a notification to the user. This matches option A exactly.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.