Describe the capabilities of Microsoft security solutions →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

{
  "Name": "DLP Policy - Credit Card Data",
  "Location": {
    "Exchange": true,
    "SharePoint": true,
    "OneDrive": true,
    "TeamsChatAndChannel": false
  },
  "Rules": [
    {
      "Name": "Rule1",
      "Condition": {
        "SensitiveInfoType": "Credit Card Number",
        "MinCount": 1
      },
      "Action": "BlockAccess",
      "Notification": {
        "UserNotify": true,
        "UserNotifyText": "This content is blocked due to DLP policy."
      }
    }
  ]
}

Refer to the exhibit. The JSON shows a Microsoft Purview DLP policy. A user sends an email with a credit card number to an external recipient. What will happen?

⚠ Common exam trap

A common mix-up: candidates confuse the 'TeamsChatAndChannel' property with the overall policy applicability, assuming a false value means the entire policy is inactive, when in fact it only controls Teams scope and the Exchange action still applies.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The email is blocked and the user receives a notification.

The DLP policy in the exhibit has a condition that detects credit card numbers and an action set to 'BlockMessage' with 'NotifyUser' enabled. Since the policy is configured for Exchange (email) and the action blocks the message, the email is blocked and the user receives a notification. The 'TeamsChatAndChannel' property being false is irrelevant because the policy is applied to Exchange, not Teams.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The email is delivered normally because TeamsChatAndChannel is false.
Why it's wrong here
This statement is incorrect because the `TeamsChatAndChannel` location setting only governs DLP policy application within Microsoft Teams. Email, handled by Exchange Online, is a distinct workload. Since the policy's `Exchange` location is enabled (as implied by the correct outcome), the DLP policy will evaluate emails regardless of the Teams setting, and therefore, email delivery is not determined by `TeamsChatAndChannel` being false.
✗
The email is delivered but an alert is generated.
Why it's wrong here
This is incorrect because the DLP policy explicitly defines `BlockAccess` as the primary action when a sensitive information type is detected in email. While an alert or incident report might also be generated (via `IncidentReport` being true), the most impactful action is to prevent the email from being delivered, not to allow delivery with just an alert or audit log entry.
✓
The email is blocked and the user receives a notification.
Why this is correct
This statement is correct. The DLP policy is configured to apply to `Exchange` (where email resides), and its rule specifies `BlockAccess` as the action when sensitive content is detected. Furthermore, the `UserNotification` setting is enabled, ensuring that the sender receives a policy tip or notification explaining why their email was blocked, providing immediate feedback and promoting compliance.
✗
The email is encrypted before delivery.
Why it's wrong here
This is incorrect because the DLP policy's configured action is `BlockAccess`, which prevents the email from being delivered entirely. While Microsoft Purview DLP policies can be configured to encrypt emails as an action, this specific policy does not specify encryption. The `Encrypt` action would need to be explicitly enabled in the policy rule for encryption to occur instead of blocking the communication.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question