Describe the concepts of security, compliance, and identity →easyMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

{
  "DLPRule": {
    "Name": "Block Credit Card Sharing",
    "Condition": {
      "SensitiveInformation": ["Credit Card Number"]
    },
    "Action": {
      "BlockAccess": true,
      "NotifyUser": {
        "EmailText": "Sharing credit card data is blocked."
      }
    }
  }
}

Refer to the exhibit. You have a Data Loss Prevention (DLP) policy in Microsoft Purview. What will happen when a user tries to share a document containing a credit card number via email?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The email is blocked and the user receives a notification

The DLP policy is configured to block the email and send a notification to the user when a credit card number is detected. Option A is incorrect because the policy applies to both internal and external recipients. Option B is incorrect because the email is blocked, not sent with a warning. Option C is incorrect because the user is notified when the email is blocked.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The email is blocked only if the recipient is external
Why it's wrong here
DLP policies can be configured to apply actions differently based on recipient location (internal vs. external). However, if the exhibit's DLP rule does not explicitly define a condition for recipient scope, such as 'Recipient is located outside your organization,' then the blocking action applies universally to any recipient, regardless of whether they are internal or external. The phrasing 'only if' implies a specific condition that is not present in a general blocking rule.
✗
The email is sent with a warning to the recipient
Why it's wrong here
A DLP policy action configured as 'Block access' explicitly prevents the email from being sent from the user's mailbox. This is fundamentally different from an 'Allow with override' or 'Allow with warning' action, which would permit the email to be sent while either requiring user justification or simply informing the user of a policy violation. Therefore, the email is not sent at all, making it impossible for the recipient to receive it with a warning.
✗
The email is sent but the user is not notified
Why it's wrong here
This option is incorrect because the primary action of the DLP policy is to block the email, meaning it is not successfully sent to any recipient. Furthermore, a properly configured DLP policy, as implied by the correct answer, typically includes a user notification setting. This ensures that the sender is immediately informed about the policy violation and the specific action taken (e.g., blocking the email), providing crucial feedback to the user.
✓
The email is blocked and the user receives a notification
Why this is correct
This option accurately describes the combined effect of a typical DLP policy configured for strict enforcement. When sensitive information is detected within the email, the policy's 'Block access' action prevents the email from being delivered to its intended recipients, ensuring data protection. Concurrently, the policy's notification setting ensures that the sender is immediately informed about the policy violation and the reason for the email's blocking, allowing them to understand and rectify the issue.

Go deeper

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question