Question 960 A firm wants to prevent printing classified bid documents from its managed endpoints while still allowing approved internal file access. Which control action should be evaluated? Endpoint DLP print activity restriction targeted to the classified content and supported devices A Teams message policy that checks for credit card numbers Use an external mail recipient policy to prevent local printing of sensitive bid documents A SharePoint site retention period of two years Explanation Correct Answer A:A print-specific action addresses physical data output instead of blanket document deletion. Incorrect Answers B:Chat DLP does not cover all local printing actions. C:Mail recipient controls do not inspect a workstation's physical or virtual print activity. D:Retention cannot reliably stop a user from printing a local document.
Question 961 A user tries uploading a labeled confidential file from a managed laptop through a browser to an unapproved personal cloud account. What should be enforced? A retention label that preserves the file ten years Require an email DLP warning but leave browser upload activities outside endpoint policy scope A Microsoft 365 Backup rule that stores another copy of the file A supported Endpoint DLP browser/service-domain upload restriction using the file classification Explanation Correct Answer D:Endpoint controls can govern selected browser uploads to restricted destinations. Incorrect Answers A:Preservation does not stop uploading a separate copy. B:External mail scanning cannot enforce copying a sensitive file to an unapproved website through the endpoint browser. C:Backup does not prevent outbound web upload.
Question 962 A new Endpoint DLP rule is in audit mode and employees still copy protected files to network shares. What does that show? Auditing can record eligible actions without stopping them; blocking must be explicitly configured and validated The data must be unclassified because no error appeared Every audit event proves the employee bypassed an active block Copying to a share is always impossible on managed endpoints Explanation Correct Answer A:The intended action mode controls enforcement, not the mere presence of a matching rule. Incorrect Answers B:A nonblocked action can still match a sensitive data rule. C:A policy in audit mode is not necessarily intended to block. D:Network share transfers can occur unless appropriately restricted.
Question 963 A company deploys Endpoint DLP to supported Mac devices and observes different results than Windows laptops. What should be assessed? Assume every Windows endpoint action exists identically on macOS Platform feature support, onboarding, permissions and available monitored activities for the specific macOS configuration Turn off all device logging until both platforms produce the same chart Replace the macOS device name with a Windows style hostname Explanation Correct Answer B:Supported endpoint actions can vary by operating system and release. Incorrect Answers A:Platform parity must be checked rather than inferred. C:Removing telemetry hides differences instead of diagnosing them. D:Naming cannot add unsupported monitoring capabilities.
Question 964 A business adds Linux servers and expects exactly the same Purview Endpoint DLP actions available on supported employee clients. What should be confirmed? Actual operating-system and workload support for the specific Endpoint DLP feature before promising coverage A SharePoint sensitivity label applied elsewhere installs Endpoint DLP on Linux All Entra-registered Linux machines automatically enforce every Windows DLP action Any Microsoft Defender alert alone proves that Endpoint DLP blocked local copying Explanation Correct Answer A:Feature availability is platform-specific and cannot be inferred from organization membership. Incorrect Answers B:Content labels do not deploy device DLP support. C:Registration is not a guarantee of Purview feature support. D:Threat telemetry is distinct from supported Purview enforcement.
Question 965 A manufacturing firm permits uploads to its approved supplier portal but forbids similar protected files being uploaded to personal file-sharing domains. What must the endpoint policy identify? An unconditional DLP exception for any secure HTTPS site Only the filename extension, with no browser destination condition Block external email recipients rather than scope the restricted web domains used for file uploads The applicable restricted and allowed service domains with supported browser upload activities Explanation Correct Answer D:Destination-aware restrictions help distinguish partner workflows from personal cloud transfers. Incorrect Answers A:TLS encryption does not prove the destination is approved for sensitive data. B:A file extension cannot distinguish the approved portal from an unauthorized service. C:Email DLP does not distinguish supported browser uploads to approved supplier sites from uploads to personal services.
Question 966 A laptop is temporarily offline when a protected file is copied to removable storage. What telemetry behavior should administrators verify? Any offline device is automatically exempt from all Endpoint DLP policies Cloud activity dashboards necessarily show the event instantly despite the disconnected laptop Supported local enforcement and eventual event reporting after the endpoint reconnects Expect offline USB-copy activity to appear instantly in cloud telemetry despite the missing connection Explanation Correct Answer C:Offline controls and deferred telemetry depend on endpoint feature capability and policy delivery. Incorrect Answers A:Network disconnection does not inherently mean every local rule is disabled. B:A device with no network cannot guarantee immediate cloud ingestion. D:A temporarily disconnected endpoint may enforce locally and report evidence after connectivity returns.
Question 967 Employees cannot use a physical printer for protected files but can generate unprotected PDF copies through a virtual printer. What should administrators evaluate? Assume virtual printers can never copy sensitive content Supported Endpoint DLP printing coverage and whether virtual print or save-to-PDF flows need separate controls Block outgoing email attachments but leave virtual printer or save-to-PDF behavior unrestricted Set long document retention periods and assume they prevent generating a plaintext PDF Explanation Correct Answer B:Alternative output paths may require explicit monitoring or protection rather than only physical printer restrictions. Incorrect Answers A:Software print paths may create additional files. C:External email blocking cannot prevent creating a local unprotected PDF from a print workflow. D:Retention policy preserves or deletes content according to lifecycle rules, not virtual-printer output behavior.
Question 968 Endpoint DLP blocks protected file uploads in a supported managed browser, but a third-party browser still uploads the files. What should security examine? Browser support, extension/integration requirements and policies for the alternate upload path Turn off Endpoint DLP and use only a mail transport rule Assume identical coverage because both browsers use HTTPS Change the file's sensitivity label display color without changing rules Explanation Correct Answer A:Enforcement may vary by supported browser and configured components. Incorrect Answers B:Mail DLP does not close a nonmail browser upload route. C:Transport encryption does not guarantee the same endpoint enforcement integration. D:Color alone cannot add support for a new browser.
Question 969 Two files look alike, but only one has a Confidential sensitivity label; a DLP rule based on that label matches one file. What does this indicate? A retention policy's delete date determines whether the label condition matches The rule evaluates applied classification, not necessarily identical underlying text in both files Both files must be blocked because the filenames match The unlabeled file necessarily has no sensitive data Explanation Correct Answer B:Label-based conditions and content-pattern conditions are different selection methods. Incorrect Answers A:Lifecycle time does not substitute for an applied sensitivity label. C:Filename similarity alone does not establish the selected label condition. D:Absence of a label is not proof of safe content.
Question 970 An endpoint DLP pilot produces noisy printing events from controlled QA machines. What is the safest scope adjustment? Exclude the entire organization from DLP monitoring Disable every DLP rule whenever any test event appears Change all protected files to Public before the pilot Exclude the documented test-device group or pilot population while preserving coverage of production endpoints Explanation Correct Answer D:Narrow testing exceptions reduce noise without weakening unrelated staff protections. Incorrect Answers A:A global exclusion hides ordinary user activity. B:A single test source should not silence all production protection. C:Removing classification is not a safe test scope adjustment.
