Describe the capabilities of Microsoft security solutions →mediumMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.
```json
{
  "policyType": "DLP",
  "rules": [
    {
      "name": "Credit Card Rule",
      "conditions": {
        "sensitiveInformationTypes": [
          {"id": "creditCardNumber"}
        ],
        "location": "Exchange"
      },
      "actions": [
        {
          "type": "BlockAccess",
          "restrictions": ["External"]
        }
      ],
      "notifications": {
        "notifyUser": true,
        "policyTip": "Sharing credit card data externally is blocked."
      }
    }
  ]
}```

You are reviewing a Microsoft Purview DLP policy configuration as shown in the exhibit. What is the expected behavior when a user sends an email containing a credit card number to an external recipient?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The email is blocked, and the user receives a policy tip notification.

The DLP policy is configured to block external sharing when credit card numbers are detected. When a user sends an email with a credit card number to an external recipient, the email is blocked and the user receives a policy tip notification. Option A is incorrect because the email is not delivered. Option B is incorrect because the email is blocked, not delivered with a justification prompt. Option C is incorrect because the policy blocks external recipients regardless of internal allowance.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The email is delivered, but the user receives a warning.
Why it's wrong here
If a Microsoft Purview DLP policy is configured with an action to 'BlockAccess' for sensitive content, the system will actively prevent the email from being delivered to its intended recipients. A warning, by definition, implies that the email is still sent but with an advisory. Therefore, this outcome is inconsistent with a direct blocking action, as the email would not reach its destination at all.
✗
The email is delivered, and the user is asked to provide a business justification.
Why it's wrong here
The ability for a user to provide a business justification to bypass a DLP policy action is typically enabled through a 'Block with override' or 'Allow with override' configuration. If the policy is set to a straightforward 'BlockAccess' without any override options, the system will not prompt the user for justification. The email would simply be blocked without an opportunity for the sender to proceed.
✗
The email is blocked, but only if the recipient is external and internal recipients are allowed.
Why it's wrong here
While many DLP policies are indeed scoped to block sensitive information sharing specifically with external recipients while allowing internal sharing, this option describes only the conditions under which the block occurs. It fails to include the full user experience, specifically the crucial element of the policy tip notification. A complete outcome for a blocking DLP policy includes both the action taken (blocking the email) and the immediate feedback provided to the user.
✓
The email is blocked, and the user receives a policy tip notification.
Why this is correct
When a Microsoft Purview DLP policy is configured to block the sharing of sensitive information, the system actively prevents the email from being sent or delivered. Simultaneously, a policy tip notification is displayed to the sender within their email client or application. This notification informs the user about the policy violation, explains why the action was taken, and often provides guidance on how to resolve the issue, ensuring immediate feedback and education.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question