Describe the capabilities of Microsoft security solutions →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

{
  "policies": [
    {
      "name": "Sensitive data DLP",
      "rules": [
        {
          "condition": {
            "sensitiveInfoTypes": ["Credit Card Number"]
          },
          "actions": ["BlockAccess", "NotifyUser"]
        }
      ]
    }
  ]
}

Refer to the exhibit. A Microsoft Purview DLP policy is configured. When a user attempts to share a document containing a credit card number externally, what will happen?

⚠ Common exam trap

Many exam-takers assume a missing severity level disables the policy, but in Microsoft Purview DLP, severity is only for reporting and alerting—the configured actions (e.g., Block, Notify) are enforced independently of severity settings.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The sharing attempt is blocked and the user receives a notification.

The exhibit shows a Microsoft Purview DLP policy configured with a 'Block' action for sharing documents containing credit card numbers externally. When the action is set to 'Block', the sharing attempt is prevented, and the user receives a notification explaining why the action was blocked. This aligns with the default behavior of DLP policies that enforce restrictive actions on sensitive data.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The document is shared but the user is notified.
Why it's wrong here
The BlockAccess action within a Microsoft Purview Data Loss Prevention (DLP) policy is designed to prevent the specified activity, such as sharing, from occurring altogether. It does not permit the action while merely notifying the user. Therefore, if BlockAccess is configured, the document will not be shared, making this option incorrect as it states the document is shared.
✓
The sharing attempt is blocked and the user receives a notification.
Why this is correct
This option accurately describes the combined effect of common DLP policy actions. A Microsoft Purview DLP policy can be configured with multiple actions for a single rule. When BlockAccess is specified, it actively prevents the sharing attempt, ensuring the sensitive information remains within the defined boundaries. Concurrently, the NotifyUser action ensures that the individual attempting the prohibited action receives an immediate notification, explaining why their action was blocked and often providing guidance on compliance.
✗
The document is encrypted before sharing.
Why it's wrong here
Microsoft Purview DLP policies do not automatically encrypt content unless a specific encryption action is explicitly configured within the policy rule. Actions such as ApplyProtection or Encrypt would be required to trigger encryption before sharing. Since the exhibit does not indicate any such encryption-related action, the document would not be encrypted as a result of this DLP policy.
✗
The policy has no effect because no severity level is set.
Why it's wrong here
Severity levels in Microsoft Purview DLP policies are primarily used for reporting, auditing, and prioritizing incidents within the compliance center, not for determining policy enforcement. A DLP policy will enforce its configured rules and actions, such as blocking sharing, irrespective of whether a severity level (e.g., High, Medium, Low) has been assigned to the policy or its rules. The absence of a severity level does not render the policy ineffective.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question