Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```json
{
  "rules": [
    {
      "id": "DLP Rule 1",
      "condition": {
        "sensitiveInfoTypes": [
          {
            "name": "Credit Card Number",
            "confidenceLevel": "high"
          }
        ],
        "instanceCount": "10",
        "location": "Exchange"
      },
      "action": "BlockAccess"
    }
  ]
}
```

You are reviewing a Microsoft Purview DLP policy rule represented in JSON. What is the effect of this rule?

⚠ Common exam trap

Many exam-takers confuse the 'NotifyUser' action with a simple policy tip or notification, overlooking that the 'BlockAccess' action combined with a threshold count (10) means the email is blocked, not just flagged, and that the rule is scoped to Exchange, not SharePoint.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It blocks the sending of an email if it contains 10 or more credit card numbers with high confidence

The JSON rule defines a condition where the DLP policy blocks email transmission when the count of credit card numbers detected with high confidence meets or exceeds 10. The 'BlockAccess' action in the rule enforces this by preventing the email from being sent, and the 'NotifyUser' action with 'NotifyOnly' set to false ensures the user is notified of the block. This matches the behavior of a Microsoft Purview DLP policy that uses a threshold-based condition with high confidence to block sensitive data sharing.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
It blocks the sending of an email if it contains 10 or more credit card numbers with high confidence
Why this is correct
This option accurately describes a Microsoft Purview DLP policy configured to prevent data exfiltration. The policy rule is set to detect the presence of 10 or more credit card numbers, identified with a high confidence level, within an email message. Upon this condition being met, the specified action is to block the sending of that email, ensuring sensitive data remains within organizational boundaries.
✗
It notifies the user when a single credit card number is detected in email
Why it's wrong here
This statement is incorrect because the DLP policy's primary action is configured to "BlockAccess", which prevents the email from being sent, rather than merely notifying the user. Furthermore, the policy rule specifies a threshold of 10 or more credit card numbers (instanceCount 10) for the action to trigger, not just a single instance.
✗
It triggers a policy tip when a single credit card number is detected
Why it's wrong here
This option is inaccurate as the DLP policy's configured action is "BlockAccess", which prevents the email from being sent, rather than just triggering a policy tip. While policy tips can be an additional notification, they are not the primary enforcement action in this scenario. Moreover, the policy's detection threshold requires a minimum of 10 credit card numbers, not just a single one, to activate any rule action.
✗
It blocks access to a SharePoint site containing credit card numbers
Why it's wrong here
This option is incorrect because the DLP policy rule is specifically scoped to the "Exchange" location, meaning it applies to email communications. It is not configured to monitor or enforce actions on "SharePoint Online" sites. Consequently, the policy would not block access to a SharePoint site, as its enforcement capabilities are limited to email sending events.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question