Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.
{
  "id": "dlp-policy-123",
  "name": "Credit Card Protection",
  "mode": "Test",
  "rules": [
    {
      "name": "Block Credit Card",
      "condition": {
        "sensitiveInfoTypes": [
          {
            "name": "Credit Card Number",
            "confidenceLevel": "high"
          }
        ]
      },
      "action": "BlockAccess"
    }
  ]
}

Refer to the exhibit. A Microsoft Purview DLP policy is configured in Test mode. An administrator notices that a user is still able to share a document containing a credit card number. What is the most likely reason?

⚠ Common exam trap

It's easy for candidates to assume Test mode still enforces some actions (like blocking) because they confuse it with 'Test mode with policy tips' or think DLP policies always block sharing by default, but Test mode explicitly disables all enforcement actions.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is in Test mode, so actions are not enforced

When a Microsoft Purview DLP policy is configured in Test mode, it logs policy matches and generates alerts but does not enforce any restrictive actions such as blocking access or sharing. The administrator observed that the user could still share the document because Test mode explicitly disables action enforcement, allowing the organization to evaluate the policy's impact before moving to Enforce mode.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The credit card number is not detected because low confidence threshold
Why it's wrong here
Microsoft Purview DLP policies are designed to detect sensitive information types, such as credit card numbers, using predefined patterns and validation checks (e.g., Luhn algorithm). If a credit card number is present and matches the defined pattern, the system typically assigns a high confidence level, ensuring detection. Therefore, a low confidence threshold would not be the reason for non-detection in this scenario, as the detection mechanism is robust for such critical data.
✗
The BlockAccess action is not supported for SharePoint Online
Why it's wrong here
The "BlockAccess" action is fully supported for content stored in SharePoint Online and OneDrive for Business within Microsoft Purview DLP policies. This action is crucial for preventing unauthorized sharing or access to sensitive information by blocking users from accessing the content or sharing it externally, aligning with common data protection requirements. Therefore, the premise that it's unsupported is incorrect.
✓
The policy is in Test mode, so actions are not enforced
Why this is correct
When a Microsoft Purview DLP policy is configured in "Test mode," it is designed to evaluate policy matches and generate incident reports without enforcing any configured actions, such as blocking access or notifying users. This mode allows administrators to assess the policy's impact and fine-tune its rules before full deployment. Consequently, any specified actions, like blocking access to a credit card number, will not be enforced while the policy remains in test mode.
✗
The policy requires an administrator to approve the action
Why it's wrong here
In "Test mode," Microsoft Purview DLP policies do not require administrator approval because no enforcement actions are actually taken; the policy only generates logs and alerts. While some advanced DLP scenarios or specific policy configurations might involve an approval workflow for user overrides or exceptions, this is not a default requirement for policy enforcement, especially not for a policy operating in test mode.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question