Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

Microsoft Purview DLP: Block Access Action

Exhibit

{
  "properties": {
    "displayName": "Sensitive data DLP",
    "description": "DLP policy for sensitive info",
    "state": "Enabled",
    "rules": [
      {
        "name": "Credit Card Rule",
        "condition": {
          "sensitiveInfo": {
            "sensitiveType": "Credit Card Number",
            "minCount": 1
          },
          "location": {
            "service": ["Exchange", "SharePoint"]
          }
        },
        "action": "BlockAccess"
      }
    ]
  }
}

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy JSON snippet. The policy is enabled and contains one rule. What is the effect of this rule?

Quick Answer

The correct answer is that the rule blocks access to content containing a credit card number in Exchange and SharePoint, without user notification. This is because the JSON rule uses the 'BlockAccess' action, which prevents users from opening or interacting with the detected sensitive data, and critically, the rule lacks any 'NotifyUser' or 'NotifyUserOverride' parameter, meaning no policy tip or email notification is sent to the end user. On the SC-900 exam, this scenario tests your understanding of how DLP actions and notifications are configured separately—a common trap is assuming that blocking access automatically includes a notification, but they are distinct settings. Remember the memory tip: "Block without a knock" means the door is locked, but no one tells you why.

⚠ Common exam trap

Many exam-takers assume 'BlockAccess' always includes a policy tip or notification, but the 'NotifyUser' parameter independently controls whether users are informed, and when set to 'False', no notification is sent.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Blocks access to content containing a credit card number in Exchange and SharePoint, without user notification.

The JSON snippet shows a DLP rule with an action of 'BlockAccess' and 'NotifyUser' set to 'False', meaning the rule blocks access to content containing a credit card number in both Exchange and SharePoint (the locations are not restricted to a single workload). Since 'NotifyUser' is false, no policy tip or email notification is sent to the user. Therefore, the correct effect is that access is blocked without user notification, matching option D.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Applies only to SharePoint, not Exchange.
Why it's wrong here
The location includes both Exchange and SharePoint.
✗
Only audits the activity, does not block.
Why it's wrong here
The action is 'BlockAccess', not 'Audit'.
✗
Blocks access and sends a policy tip to users.
Why it's wrong here
No notification is configured in the rule.
✓
Blocks access to content containing a credit card number in Exchange and SharePoint, without user notification.
Why this is correct
The rule has 'BlockAccess' action and no notification settings.

Go deeper

1 more way this is tested on SC-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. The JSON shows a Microsoft Purview DLP policy. A user sends an email with a credit card number to an external recipient. What will happen?

medium

A.The email is delivered normally because TeamsChatAndChannel is false.
B.The email is delivered but an alert is generated.
✓ C.The email is blocked and the user receives a notification.
D.The email is encrypted before delivery.

Why C: The DLP policy in the exhibit has a condition that detects credit card numbers and an action set to 'BlockMessage' with 'NotifyUser' enabled. Since the policy is configured for Exchange (email) and the action blocks the message, the email is blocked and the user receives a notification. The 'TeamsChatAndChannel' property being false is irrelevant because the policy is applied to Exchange, not Teams.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.

Microsoft Purview DLP: Block Access Action

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

1 more way this is tested on SC-900