Describe the capabilities of Microsoft compliance solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

{
  "policyType": "dlp",
  "name": "PCI-DSS Policy",
  "rules": [
    {
      "name": "Credit Card Rule",
      "mode": "enforce",
      "conditions": [
        {
          "conditionType": "contentContainsSensitiveInformation",
          "sensitiveInformationType": "Credit Card Number",
          "minCount": 1
        }
      ],
      "actions": [
        {
          "actionType": "blockAccess",
          "blockLevel": "blockOnlyExternal"
        }
      ]
    }
  ]
}

Refer to the exhibit. You are a compliance administrator managing a DLP policy in Microsoft Purview. The policy is set to 'enforce' mode but you notice that internal users can still share credit card numbers via email to external recipients. What is the most likely cause?

⚠ Common exam trap

It's easy for candidates to assume 'enforce' mode means all sharing is blocked, but they overlook that the action type (block access vs. block sending) determines whether internal users can still send the data externally.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The action only blocks access to the content from external users, not sharing by internal users

A DLP policy in 'enforce' mode can still allow internal users to share sensitive data if the policy action is configured to 'block access to content from external users' rather than 'block sharing by internal users'. In Microsoft Purview, the 'block access' action restricts external recipients from viewing the content but does not prevent the internal sender from transmitting the email. To stop internal users from sending, the policy must use the 'block sending' action, which prevents the message from being delivered.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The policy is in test mode, not enforce mode
Why it's wrong here
The exhibit explicitly indicates that the Data Loss Prevention (DLP) policy is configured in 'enforce' mode. This setting means the policy is actively monitoring content and applying its defined actions, rather than merely generating alerts or policy tips without blocking. If the policy were in 'test' mode, it would typically only log incidents or display policy tips to users, but it would not prevent the sensitive information from being shared or accessed, which contradicts the 'enforce' status shown.
✗
The policy is not applied to the user's mailbox
Why it's wrong here
Microsoft 365 Data Loss Prevention policies are designed to apply tenant-wide by default across all supported locations, including Exchange Online mailboxes, unless specific inclusions or exclusions are explicitly defined. Without any scoping shown in the exhibit that would limit the policy's application, it is presumed to cover all user mailboxes within the organization. Therefore, the policy would indeed be applied to the user's mailbox, making this option incorrect.
✗
The condition requires a minimum count of 5
Why it's wrong here
The policy's condition, as shown in the exhibit, specifies a "minCount" of 1 for the sensitive information type (SIT) it is designed to detect. This configuration means that the presence of even a single instance of the identified sensitive data, such as a credit card number, is sufficient to trigger the policy rule. Consequently, the assertion that the condition requires a minimum count of 5 is incorrect, as the policy would activate on the very first detection.
✓
The action only blocks access to the content from external users, not sharing by internal users
Why this is correct
The action "blockOnlyExternal" specifically prevents external users from accessing content that contains sensitive information, but it does not prevent internal users from initially sharing or sending that content to external recipients. While external access to the shared content might be blocked, the internal user successfully initiated the sharing action. This distinction is crucial because the policy allows the internal user to perform the outbound sharing, even if the external recipient cannot ultimately view the sensitive data within the shared item.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question