Describe the concepts of security, compliance, and identity →easyMultiple Choice

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

{
  "DLPRule": {
    "Name": "Block Credit Card Sharing",
    "Condition": {
      "SensitiveInformation": ["Credit Card Number"]
    },
    "Action": {
      "BlockAccess": true,
      "NotifyUser": {
        "EmailText": "Sharing credit card data is blocked."
      }
    }
  }
}

Refer to the exhibit. You have a Data Loss Prevention (DLP) policy in Microsoft Purview. What will happen when a user tries to share a document containing a credit card number via email?

⚠ Common exam trap

SC-900 often tests the misconception that DLP only applies to external recipients — in reality, DLP rules can block internal sharing too, and the 'block' action always includes a user notification.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The email is blocked and the user receives a notification

When a DLP policy in Microsoft Purview is configured to block content containing sensitive information types like credit card numbers, the email is prevented from being sent and the user receives a policy tip notification explaining the violation. This is the standard 'Block' action behavior in a DLP rule, which stops the email at send time and surfaces a non-compliance notification to the sender.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The email is blocked only if the recipient is external
Why it's wrong here
DLP policies can be configured to apply actions differently based on recipient location (internal vs. external). However, if the exhibit's DLP rule does not explicitly define a condition for recipient scope, such as 'Recipient is located outside your organization,' then the blocking action applies universally to any recipient, regardless of whether they are internal or external. The phrasing 'only if' implies a specific condition that is not present in a general blocking rule.
✗
The email is sent with a warning to the recipient
Why it's wrong here
A DLP policy action configured as 'Block access' explicitly prevents the email from being sent from the user's mailbox. This is fundamentally different from an 'Allow with override' or 'Allow with warning' action, which would permit the email to be sent while either requiring user justification or simply informing the user of a policy violation. Therefore, the email is not sent at all, making it impossible for the recipient to receive it with a warning.
✗
The email is sent but the user is not notified
Why it's wrong here
The primary action of the DLP policy is to block the email, meaning it is not successfully sent to any recipient. Furthermore, a properly configured DLP policy, as implied by the correct answer, typically includes a user notification setting. This ensures that the sender is immediately informed about the policy violation and the specific action taken (e.g., blocking the email), providing crucial feedback to the user.
✓
The email is blocked and the user receives a notification
Why this is correct
This option accurately describes the combined effect of a typical DLP policy configured for strict enforcement. When sensitive information is detected within the email, the policy's 'Block access' action prevents the email from being delivered to its intended recipients, ensuring data protection. Concurrently, the policy's notification setting ensures that the sender is immediately informed about the policy violation and the reason for the email's blocking, allowing them to understand and rectify the issue.

Go deeper

SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question