Question 940 A financial analyst exports a Power BI report containing restricted records for an external recipient. Which governance question should be reviewed? Whether a SharePoint site uses a short retention period Rely solely on Exchange mail DLP while omitting supported Power BI DLP coverage Whether supported Purview DLP policies for Power BI and relevant report sensitivity labels govern this workflow Inspect managed laptop antivirus posture instead of verifying DLP coverage for supported Power BI report export or sensitivity labels Explanation Correct Answer C:Power BI content and export controls require workload-appropriate policy coverage. Incorrect Answers A:Site retention alone cannot govern all Power BI report exports. B:Email enforcement cannot be assumed to inspect actions involving sensitive Power BI reports. D:Device malware signatures are independent of report-level content sensitivity and applicable Purview policy actions.
Question 941 A team uses Microsoft 365 Copilot with sensitive labeled documents, and policy requires supported controls for Copilot use of classified content. What must be confirmed? Assume every email-scoped DLP rule automatically covers all Copilot prompts and grounding sources A file retention label automatically blocks every Copilot response A Teams chat policy alone covers every Copilot access path and response The DLP policy's available Microsoft 365 Copilot location and supported conditions/actions for the intended interaction Explanation Correct Answer D:Copilot-specific controls depend on supported policy scope and capabilities, not an assumption that every DLP rule applies uniformly. Incorrect Answers A:Copilot interaction coverage depends on the supported policy location and conditions; an Exchange rule is not universal. B:Retention preserves content and does not define all Copilot interaction restrictions. C:Different Copilot interactions and workloads require feature-specific coverage.
Question 942 Two DLP rules match a document: one merely audits and another restricts external sharing. What should the administrator examine before deployment? Delete one rule's sensitive information type so neither can match Edit content retention policy priority and expect it to determine which of two matching DLP enforcement actions takes effect Rule conditions, priorities, and how enforcement actions interact for the selected workload Assume the audit rule necessarily cancels all later blocking rules Explanation Correct Answer C:Match and action resolution should be verified rather than assumed from visual order. Incorrect Answers A:Removing detection destroys the intended protection rather than resolving interaction. B:Retention precedence governs item lifecycle, not the DLP rule conditions and enforcement interaction for the matched workload. D:Monitoring is not a universal override of enforced protection.
Question 943 A DLP policy alerts on random numeric strings that resemble customer records. What is the most direct precision improvement? Turn off all DLP alerts instead of adjusting the detector's evidence requirements or match-confidence level for noisy identifiers Increase the document retention period regardless of its content Adjust sensitive-information match confidence, supporting context and required evidence in the policy rule Change the email sender's display name to an internal alias Explanation Correct Answer C:Richer detection conditions target actual records rather than any numeric coincidence. Incorrect Answers A:Blanket alert removal hides legitimate events; improving the pattern's supporting context addresses the false-positive mechanism. B:Retention duration cannot improve match specificity. D:Identity display changes do not refine a regex match.
Question 944 An approved legal team sometimes must send protected records to a regulated outside partner. What should a DLP exception design include? Exempt every external recipient and workload from DLP so the small approved legal team can share regulated records A narrowly scoped condition for the approved recipients or context, plus auditing and periodic review Rely on a sensitivity label color alone for proof of recipient authorization Raise the match threshold so all sensitive records are ignored Explanation Correct Answer B:Specific exceptions allow legitimate workflows without removing the baseline policy. Incorrect Answers A:Tenant-wide exceptions sacrifice enforcement for unapproved transfers; a narrow audited condition can permit the intended partner. C:Visual classification does not grant a contractual exception. D:Suppressing detection hides other risky transfers.
Question 945 A DLP rule can allow a documented user override after warning. What does an override setting change? It converts the record into a retention-only item It permanently removes the sensitive information type from all future messages It may permit the action under defined conditions while collecting a business justification or policy evidence It guarantees the item is harmless because the user clicked Allow Explanation Correct Answer C:Overrides provide controlled flexibility rather than unconditional permission. Incorrect Answers A:Movement controls and retention are different policy domains. B:One user's override does not delete the global detector. D:A user decision is not proof the sensitive content posed no risk.
Question 946 Employees repeatedly attempt to email confidential attachments externally. The company wants a prompt describing the risk at the point of action. Which DLP feature fits? A Defender Vulnerability Management device recommendation Add a Teams meeting transcript retention policy to display guidance when users attempt external email transfers of protected attachments A policy tip or supported user notification associated with the matching DLP rule A hidden disposition review assignment for old records Explanation Correct Answer C:Just-in-time guidance explains why the action is sensitive. Incorrect Answers A:Endpoint vulnerability advice does not warn on mail content matches. B:Meeting content retention cannot show Exchange DLP policy tips during a matching email send action. D:Disposition processes do not warn a sender about current mail.
Question 947 A new DLP policy could block external sharing from hundreds of SharePoint sites. What should happen before enforcement? Use supported simulation/test mode, inspect matches, and refine scope and exceptions Turn off audit logging so users do not see simulation entries Enable tenant-wide block immediately because the detector is configured Delete SharePoint sites with frequent sensitive-data matches before simulating which planned DLP rules would disrupt collaboration Explanation Correct Answer A:A nonblocking test reduces unexpected collaboration interruptions. Incorrect Answers B:Removing evidence makes test evaluation harder. C:A configured rule has not yet demonstrated acceptable match precision. D:Deleting business sites is not a safe test of rule scope; simulated matches should be reviewed before enforcement.
Question 948 An administrator sees an Activity explorer DLP event, but no incident appears in the DLP Alerts dashboard. What should be checked? Whether all sensitivity labels have been deleted Match the rule name to the event but ignore whether the action enables alert creation Whether the matched action satisfies the policy's alert-generation and severity conditions Inspect the Cloud Apps sanction state but ignore the actual DLP alert-generation setting on the matching rule Explanation Correct Answer C:Not every recorded activity necessarily creates a separate alert. Incorrect Answers A:Label existence alone does not dictate every alert rule. B:A DLP match can appear in activity reporting without meeting configured alert notification and severity conditions. D:App governance labels do not determine whether the Purview DLP event met alert severity and generation conditions.
Question 949 A protected template may include one sample account number, but a batch of many real customer records must be blocked. Which rule design can distinguish them? Remove labels from reusable document templates and assume this changes the detector's count of sensitive information instances Block every email with more than a certain number of words Use a supported sensitive-information instance count threshold and contextual conditions Use only a fixed file size threshold for all recipients Explanation Correct Answer C:Counting occurrences can distinguish isolated examples from bulk exposure when accurately configured. Incorrect Answers A:Classification labels do not directly establish the sensitive-information occurrence threshold for blocking a message. B:Total word count does not identify sensitive record instances. D:Small files can contain many sensitive identifiers.
Question 950 A DLP policy misses a password-protected file attachment whose contents are not inspectable. What is the correct response? Claim the document is non-sensitive because no content pattern matched Review supported protected-file detection, inaccessible-content handling and additional channel controls Disable the DLP policy whenever it encounters encrypted documents rather than configuring supported inaccessible-content handling Assume setting a retention label reveals the document's password Explanation Correct Answer B:Encrypted or unsupported attachments may need special treatment rather than assumed plaintext inspection. Incorrect Answers A:A non-match caused by inaccessible bytes does not establish safe content. C:An inspection limitation should be handled with appropriate policy action and channel controls, not by dropping all DLP protection. D:Retention does not decrypt a third-party encrypted attachment.
