Describe the capabilities of Microsoft compliance solutions →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

{
  "RuleName": "Block-PII-External",
  "Condition": "AnyOf(ContentContainsSensitiveInformation('U.S. Social Security Number'))",
  "Action": "BlockAccess",
  "UserNotification": true
}

Refer to the exhibit. An administrator creates a DLP rule as shown. What is the expected outcome when a user tries to share a file containing a U.S. Social Security Number with an external recipient?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The sharing is blocked, and the user receives a notification.

The DLP rule is configured with an action of 'Block' (or 'BlockAccess') and user notification enabled. When a user attempts to share a file containing a U.S. SSN with an external recipient, the rule blocks the sharing and displays a notification to the user explaining that the action is blocked. Option A is incorrect because the rule applies to all users, not just non-owners. Option B is incorrect because the rule does more than generate an audit event; it actively blocks the sharing. Option C is incorrect because the rule blocks the action outright, rather than allowing it with justification.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The sharing is blocked only if the user is not the file owner.
Why it's wrong here
Data Loss Prevention (DLP) rules evaluate specific conditions to determine their applicability. If the DLP rule does not include an explicit condition checking for the user's relationship to the file owner (e.g., "User is owner" or "User is not owner"), then the rule's enforcement, including the `BlockAccess` action, will apply irrespective of who owns the file. The action is triggered by the sensitive information match, not by the user's ownership status in this context.
✗
The sharing is allowed, but an audit event is generated.
Why it's wrong here
This option is incorrect because the specified action for the DLP rule is `BlockAccess`. This action is designed to actively prevent the sharing or exfiltration of sensitive information, not merely to monitor it. While an audit event is typically generated whenever a DLP rule is matched and an action is taken, the primary outcome of `BlockAccess` is prevention, meaning the sharing itself is not allowed to proceed.
✗
The file is shared, but the user is notified and must provide justification.
Why it's wrong here
This scenario describes a DLP policy configured with an override option, where a user can bypass the block by providing a business justification. However, the question implies a standard `BlockAccess` action without an explicit override setting. In such a configuration, the sharing is strictly blocked, and while the user might be notified, they are not given an option to proceed by providing justification.
✓
The sharing is blocked, and the user receives a notification.
Why this is correct
This option accurately describes the combined effect of a DLP rule configured with `BlockAccess` and `UserNotification` enabled. The `BlockAccess` action ensures that the attempted sharing of sensitive content is prevented. Simultaneously, the `UserNotification` setting ensures that the user attempting the action receives a policy tip or email notification, explaining that their action was blocked due to a DLP policy violation.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question