Question 970 An endpoint DLP pilot produces noisy printing events from controlled QA machines. What is the safest scope adjustment? Exclude the entire organization from DLP monitoring Disable every DLP rule whenever any test event appears Change all protected files to Public before the pilot Exclude the documented test-device group or pilot population while preserving coverage of production endpoints Explanation Correct Answer D:Narrow testing exceptions reduce noise without weakening unrelated staff protections. Incorrect Answers A:A global exclusion hides ordinary user activity. B:A single test source should not silence all production protection. C:Removing classification is not a safe test scope adjustment.
Question 971 An Endpoint DLP alert states a sensitive file was copied to USB. What information should a responder request first? Only the name of the employee's Teams channels The device, signed-in user, file identity/classification, destination and applicable policy action Review only the user's mailbox quota without identifying the USB destination or classified file Only the current number of sensitivity labels in the tenant Explanation Correct Answer B:Case context is needed to distinguish an allowed backup from unauthorized copying. Incorrect Answers A:Collaboration memberships do not explain the file-copy event. C:Storage quotas do not show the actual device, file and policy evidence required to investigate a USB exfiltration alert. D:Label inventory lacks the event's actor and destination.
Question 972 A legal export workflow may legitimately write selected confidential files to authorized removable media. How should an override be governed? Remove all file sensitivity labels before the export Grant a broad user exemption from all removable-media DLP controls rather than an approved documented override on selected exports Allow overrides only where policy permits, require documented justification and retain event audit evidence Permit all users to disable Endpoint DLP at will Explanation Correct Answer C:A controlled exception supports business requirements while preserving accountability. Incorrect Answers A:Erasing classification undermines the data-handling context. B:General exemption exposes unrelated sensitive data; a scoped user override should capture justification and event evidence. D:Uncontrolled opt-outs defeat policy enforcement.
Question 973 A compliance officer needs a timeline of attempts to print, copy to USB and upload protected files from a specific endpoint. Which information source fits? Only the organization's broad Microsoft 365 usage report Supported Endpoint DLP activities in Purview Activity explorer and associated alert/event details Only the SharePoint site's storage quota chart Export the endpoint's current DLP policy assignments without querying actual print, removable-storage and cloud-upload events Explanation Correct Answer B:Action-level DLP telemetry can connect device behavior and policy response. Incorrect Answers A:Adoption summaries lack individual file-movement action detail. C:Site capacity does not show local USB and printing attempts. D:Assignment reports show intended enforcement but cannot reconstruct the observed timeline of user actions and alert events.
Question 974 One incident contains a single highly sensitive document, while another contains 5,000 low-value documents. What should DLP severity design account for? Always rank the largest file count as highest severity regardless of content Content sensitivity, action, destination and volume rather than raw file count alone Use only total tenant storage capacity as the threat score Always ignore single-file events even when the item is regulated Explanation Correct Answer B:A small transfer can be severe if data class and exposure path are critical. Incorrect Answers A:Quantity alone does not establish impact. C:Storage quota is not an event risk indicator. D:One classified record can still trigger a serious breach.
Question 975 A DLP alert reports a confidential customer list sent to a personal email address by a user who recently resigned. What is the most appropriate first response? Ignore it because the employee was licensed when sending Immediately delete every customer record from the tenant Verify policy evidence, exposure scope and business authorization, then follow incident containment and escalation procedures Change the file's retention period but do not examine the recipient Explanation Correct Answer C:Context supports an actionable investigation without presuming guilt from an alert alone. Incorrect Answers A:License entitlement does not authorize external disclosure. B:Broad destruction does not contain a delivered copy or preserve evidence. D:Lifecycle changes cannot establish whether data left the organization.
Question 976 A DLP alert and Defender XDR investigation reference the same user and exfiltration timeline. What should responders do? Treat the two alerts as proof of two unrelated compromises Correlate relevant alerts and preserve DLP evidence within the coordinated incident workflow Close the DLP alert automatically because Defender XDR also detected activity Suppress all future DLP alerts for that user after triage Explanation Correct Answer B:The signals can describe related stages of one incident and should not be handled in isolation. Incorrect Answers A:Duplicate detection sources do not automatically mean separate intrusions. C:The DLP event may add distinct data and destination evidence. D:A completed review is not justification for indefinite blindness.
Question 977 A policy previously blocked external sharing but no longer records matches after an administrator edit. What configuration should be examined? Only the number of active Microsoft 365 subscriptions Policy enablement, rule conditions, scope, mode and change history Whether an unrelated anti-phishing preset has a higher score Only whether every affected file still exists in backup Explanation Correct Answer B:An edit may alter matching or enforcement without changing the policy's display name. Incorrect Answers A:Subscription totals do not reveal the rule's match conditions. C:Mail threat scoring does not determine all DLP rule scope. D:Backup coverage is not equivalent to active DLP monitoring.
Question 978 A service desk supervisor must review DLP alerts but not edit tenant-wide DLP policies. What authorization design is appropriate? Grant a supported investigation or reader role/role group while reserving DLP policy editing to authorized specialists Make each reviewer the owner of all SharePoint sites Assign Global Administrator to every service desk reviewer Give reviewers permission to delete the DLP event history Explanation Correct Answer A:Purview role separation limits unnecessary policy-management rights. Incorrect Answers B:Site ownership does not replace Purview alert permissions. C:Tenant-wide admin access is excessive for alert investigation. D:Audit deletion contradicts the need to investigate incidents.
Question 979 A security team wants stricter DLP actions for users with elevated insider-risk signals and ordinary rules for others. What integration should be evaluated? Reduce all user passwords to a short common value for easier detection Use only a site retention duration to distinguish high-risk user behavior Supported adaptive protection that uses appropriate risk levels to apply DLP restrictions Make all sensitive information types public so risky users can be identified Explanation Correct Answer C:Risk-adaptive controls may tighten data movement policy where user risk warrants it. Incorrect Answers A:Weak passwords increase risk rather than enabling adaptive controls. B:Retention timing is not the same as an insider-risk level. D:Declassifying data does not establish user risk.
Question 980 A DLP rule targets a fixed Entra group, but several new hires are not being protected. Which administrative dependency matters? Review only SharePoint library permissions rather than the Entra group policy audience Recreate the DLP policy with identical fixed group targeting Group membership or policy-scope synchronization for the intended users and locations Increase sensitive information confidence levels without reviewing targeted group membership Explanation Correct Answer C:A static group target may miss new users until membership or assignments update. Incorrect Answers A:Site access controls do not determine which identities are covered by the DLP user scope. B:A new policy with the same stale membership will still miss the new hires. D:Match confidence affects detection but cannot add missing users to the fixed target group.
