Question 990 A harmless public brochure has a Confidential label and is blocked by a label-based DLP rule. What repair best addresses the demonstrated false positive? Lower the sensitivity of every Confidential item in the tenant Rename the brochure to Public without changing its label Review the brochure's actual classification and apply an authorized label correction with an audit trail Disable label-based DLP for all documents forever Explanation Correct Answer C:Correcting erroneous classification resolves the root match without weakening other protected files. Incorrect Answers A:Broad reclassification is disproportionate to one brochure. B:A filename change may leave the applied label unchanged. D:A global exception hides genuine confidential content.
Question 991 A compliance department wants a DLP rule to detect a confidential list of project code words, updated monthly. Which detection building block is appropriate? A service health alert policy listing the project words One static recipient exception list with the project words as email addresses A SharePoint retention period determined by keyword length A maintained keyword dictionary used by a supported sensitive information type condition Explanation Correct Answer D:A reusable dictionary supports vocabulary-driven matching for the policy. Incorrect Answers A:Service status notifications do not inspect business content. B:Recipient filters do not scan document vocabulary. C:Lifecycle duration is not word-list matching.
Question 992 An organization wants DLP to act only on actual employee identification numbers from its HR dataset, not arbitrary numbers with the same pattern. What should be considered? A mandatory sensitivity label on all internal email with no detector A nine-digit regex that treats every match as an employee ID Disabling all DLP alerts when a false positive appears An exact data match sensitive information type with a properly protected reference dataset Explanation Correct Answer D:EDM can distinguish known values from format-matching false positives. Incorrect Answers A:Mandating a label does not match HR identifiers selectively. B:A format-only detector may match unrelated numbers. C:Suppressing detection is not selective precision improvement.
Question 993 A report routinely contains one dummy national ID, but disclosure of more than 20 real IDs must be blocked. Which conditions should be evaluated together? A validated sensitive information type, instance count threshold and relevant content or recipient context A file size threshold alone, regardless of document contents Match messages containing the words National ID without validating the identifier count and detector A retention period that begins after sending the message Explanation Correct Answer A:Precise detection and occurrence thresholds reduce accidental blocking of safe examples. Incorrect Answers B:One small file can contain many real identities. C:A subject-text keyword cannot reliably distinguish dummy values from the threshold of real sensitive identifiers in content. D:Preservation timing does not block the initial disclosure.
Question 994 A team copies an Exchange DLP rule with a particular response action to Power BI and assumes all actions operate identically. What must be checked? Import the Exchange rule unchanged without verifying Power BI-supported conditions The supported DLP conditions and enforcement actions for the target Power BI location Reuse external SMTP recipient conditions for Power BI report actions without translation Assume Power BI supports identical Exchange recipient-notification actions Explanation Correct Answer B:Workloads expose different features and cannot be assumed to accept identical actions. Incorrect Answers A:Workload-specific DLP rules need conditions/actions appropriate to Power BI, not blind reuse. C:A report workspace or dataset is not an Exchange message with a mail recipient field. D:Power BI report objects and Exchange mail recipient flows expose different policy action models.
Question 995 An external mail DLP policy displays a warning but sensitive messages are still delivered. What setting should the administrator inspect? The sender's desktop screen resolution The warning's accent color in Outlook The rule's actual enforcement action, override allowance and test mode rather than its notification text Change the mailbox retention schedule instead of inspecting the effective DLP enforcement mode and override Explanation Correct Answer C:A user-facing tip can exist without a blocking action. Incorrect Answers A:Device display does not choose a DLP enforcement mode. B:Visual color does not enforce a transport decision. D:Retention lifecycle settings do not explain why a DLP warning is nonblocking during message delivery.
Question 996 A security admin proposes excluding every Global Administrator account from DLP because administrators need flexibility. What is the risk? Broad role-based exemptions could allow privileged identities to move sensitive data without monitoring or restrictions A role exclusion automatically improves detector precision Global Administrators never access business records DLP rules only apply to guest identities by design Explanation Correct Answer A:High privilege does not remove data-loss risk and may increase exposure in compromise. Incorrect Answers B:Excluding identities changes coverage, not the content classifier. C:Privileged accounts may encounter sensitive information. D:DLP location and user scoping can include internal administrators.
Question 997 An emergency partner sharing exception was authorized for two weeks but remains active three months later. What governance action is appropriate? Disable DLP activity reporting to prevent exception alerts Review business need and audit evidence, then expire or revoke the narrow exception when the approved period ends Expand the exception to every external recipient to simplify future approvals Remove the organization's underlying sensitivity labels instead Explanation Correct Answer B:Exceptions should be time-bounded and revisited rather than silently permanent. Incorrect Answers A:Removing telemetry makes the governance gap harder to detect. C:Widening scope increases exposure beyond the original authorization. D:Changing classification is not necessary to close an expired exception.
Question 998 A DLP investigation includes employee messages and classified documents. How should the SOC control investigator access? Delete all incident events immediately after a block is triggered Grant all service desk employees full content access for convenience Publish the matched confidential text in a public incident dashboard Use least-privilege Purview investigation roles, scoped access and retention of necessary evidence only Explanation Correct Answer D:DLP alerts may contain sensitive personal or business content requiring controlled examination. Incorrect Answers A:Premature deletion can undermine incident review and accountability. B:Broad access increases secondary data exposure. C:Public disclosure would compound the incident.
Question 999 A user has justified five DLP overrides in a month, but the same personal cloud recipient appears repeatedly. What should a reviewer do? Disable the destination check for every tenant user Increase file retention to make the overrides vanish Treat every entered justification as automatic permanent authorization Examine override reasons, destination approval, content sensitivity and pattern across incidents before allowing further exceptions Explanation Correct Answer D:Repetition can reveal a policy bypass or a genuinely missing approved workflow. Incorrect Answers A:A user-specific pattern does not justify tenant-wide removal. B:Retention does not address repeated risky transfers. C:Text entry alone does not establish an exception's legitimacy.
Question 1000 A new Exchange DLP policy unexpectedly blocks routine internal mail across several departments. What is the appropriate controlled response? Confirm the specific rule and scope, roll back or move the defective enforcement to test mode, preserve evidence, and correct conditions Disable every Purview DLP policy across all workloads before investigating which new Exchange rule caused the false positive Purge the matched email messages from both sender and recipient mailboxes before investigating which rule or condition incorrectly matched them Add a global DLP exception covering all internal Microsoft 365 mail and leave the defective rule conditions unchanged Explanation Correct Answer A:Targeted rollback restores operations while retaining incident and configuration evidence. Incorrect Answers B:Blanket deactivation may restore message flow but unnecessarily removes protection from unaffected policies and workloads; the faulty rule should be scoped. C:Deleting business correspondence does not correct the DLP rule and may destroy needed evidence; remediate enforcement while preserving messages. D:A tenant-wide internal-mail exclusion suppresses legitimate detections far beyond the reported false positives; target the implicated rule and test its fix.
