Question 950 A DLP policy misses a password-protected file attachment whose contents are not inspectable. What is the correct response? Claim the document is non-sensitive because no content pattern matched Review supported protected-file detection, inaccessible-content handling and additional channel controls Disable the DLP policy whenever it encounters encrypted documents rather than configuring supported inaccessible-content handling Assume setting a retention label reveals the document's password Explanation Correct Answer B:Encrypted or unsupported attachments may need special treatment rather than assumed plaintext inspection. Incorrect Answers A:A non-match caused by inaccessible bytes does not establish safe content. C:An inspection limitation should be handled with appropriate policy action and channel controls, not by dropping all DLP protection. D:Retention does not decrypt a third-party encrypted attachment.
Question 951 An organization already labels financial contracts as Confidential and wants to stop their external email transfer. Which DLP condition can leverage that designation where supported? Match the file or message's sensitivity label as part of the DLP rule Change the subject of outgoing messages to Confidential instead of evaluating the document's actual label Apply only a retention period and assume sending is blocked Match only the contract file's creation date Explanation Correct Answer A:Labels can be input signals for DLP conditions rather than only visual indicators. Incorrect Answers B:Subject text does not by itself identify the sensitivity label applied to a file or message for DLP matching. C:A lifecycle rule does not automatically enforce mail restrictions. D:Age does not represent its classification.
Question 952 Legal wants a DLP rule triggered by complex contract language, even when no fixed personal-ID pattern occurs. Which supported detection source should be considered? A trainable classifier for the relevant document category combined with policy conditions A country-code-only pattern applied to every message A tenant Service health advisory subscription Increase the retention period for legal mailboxes rather than classify contract content Explanation Correct Answer A:Document semantics may require a learned classifier instead of one numeric regex. Incorrect Answers B:Country codes have poor specificity for contract meaning. C:Service status cannot classify contract language. D:Longer retention preserves material but does not identify semantically complex contract clauses for a DLP detector.
Question 953 A SharePoint document is labeled Sensitive but can still be shared with outside guests. What control design should be verified? That the guest user has a Microsoft 365 license in a separate tenant That DLP or site-sharing restrictions actually enforce the desired external-access action on eligible content That the label display color is red rather than blue That the file is retained for a decade Explanation Correct Answer B:Classification and movement restriction are separate layers that must be scoped correctly. Incorrect Answers A:An external license is not equivalent to an access-control policy. C:Color does not block a sharing link. D:Retention does not automatically prevent all external access.
Question 954 A user uploads a protected customer workbook from a mobile device to their OneDrive account and then shares it externally. Which control must be evaluated independently of device type? Only a Teams chat policy for the uploader A Windows-only endpoint USB restriction and nothing else Service-side OneDrive DLP detection and restrictions for the stored file and share action Deploy an email-only DLP rule while omitting the OneDrive file and sharing location Explanation Correct Answer C:Cloud DLP can inspect supported OneDrive content regardless of which client uploaded it. Incorrect Answers A:Chat coverage cannot replace the OneDrive content location. B:USB controls do not cover all mobile uploads and cloud sharing. D:An email rule cannot be assumed to govern external links created from documents held in OneDrive.
Question 955 A company must prevent sensitive contract attachments from being emailed to outside recipients, but allow the same content inside the company. What condition should be combined with classification? A blanket policy deleting the file after 30 days An endpoint firewall policy that blocks all corporate web traffic A user-only condition that never examines recipients An external-recipient condition or relevant recipient scope in the Exchange DLP rule Explanation Correct Answer D:Recipient context distinguishes outbound exposure from authorized internal exchange. Incorrect Answers A:Lifecycle rules do not prevent immediate external sending. B:Network-wide blocking is not a precise mail-content response. C:Sender targeting alone cannot distinguish inside versus outside destination.
Question 956 A DLP rule is enabled at noon, but an audit asks whether it retroactively blocked an email delivered at 9 AM. What should be stated? The rule automatically recalls every earlier external email A sensitivity label change on a different file reverses every earlier send A newly enforced DLP rule cannot retroactively block an already delivered message; use investigation and remediation processes for past exposure Changing the policy title retroactively deletes historical messages Explanation Correct Answer C:DLP enforcement applies when eligible content is processed under the active policy. Incorrect Answers A:Recipient control after delivery is not guaranteed by a new rule. B:Unrelated classification changes cannot undo a delivered email. D:Display names do not rewrite past mail delivery.
Question 957 A DLP policy controls sensitive document use in one supported Copilot interaction, but another workflow still exposes classified data. Which question must be answered before broadening rules? Publish sensitivity labels to all users without validating Copilot policy processing Apply a Teams chat DLP rule and infer protection for all Copilot content processing Which Copilot entry points, content locations and policy conditions/actions are supported for the observed workflow Assume an Exchange mail DLP rule protects every Copilot workflow using those emails Explanation Correct Answer C:Product support boundaries affect coverage; a single policy name is not proof of universal Copilot control. Incorrect Answers A:Publishing classification is not proof that the affected Copilot entry point enforces the desired restriction. B:Teams message rules cannot establish full coverage across other Copilot interactions and data locations. D:Traditional mail transport scope does not necessarily implement the supported Copilot processing controls.
Question 958 An administrator wants to block copying labeled internal payroll documents to personal USB storage from managed Windows endpoints. What policy family fits? Rely on outbound email DLP to stop local writes of labeled files to removable drives A Purview retention policy that preserves payroll records for seven years A Teams chat message rule alone Endpoint DLP with removable-storage activity restrictions and relevant classification conditions Explanation Correct Answer D:Endpoint DLP addresses local device movement of protected content. Incorrect Answers A:Exchange mail DLP evaluates messages, not USB copy activity on a managed endpoint. B:Preservation does not prevent writing copies to USB drives. C:Chat policies do not govern local removable storage.
Question 959 An endpoint DLP rule is published, but it records no events from a set of corporate laptops. What should be checked first? Device onboarding, supported operating system, policy assignment and health of the endpoint DLP components Check the DLP rule is enabled without inspecting whether the affected devices receive it Review Entra user sign-ins without checking device DLP status Confirm only the file sensitivity label is published to staff Explanation Correct Answer A:Unonboarded or unsupported devices will not provide expected enforcement telemetry. Incorrect Answers B:A policy can be active in the portal but absent from particular endpoints. C:Successful authentication is not proof that endpoint DLP components are operational. D:Label availability does not establish device onboarding or Endpoint DLP health.
Question 960 A firm wants to prevent printing classified bid documents from its managed endpoints while still allowing approved internal file access. Which control action should be evaluated? Endpoint DLP print activity restriction targeted to the classified content and supported devices A Teams message policy that checks for credit card numbers Use an external mail recipient policy to prevent local printing of sensitive bid documents A SharePoint site retention period of two years Explanation Correct Answer A:A print-specific action addresses physical data output instead of blanket document deletion. Incorrect Answers B:Chat DLP does not cover all local printing actions. C:Mail recipient controls do not inspect a workstation's physical or virtual print activity. D:Retention cannot reliably stop a user from printing a local document.
