Question 980 A DLP rule targets a fixed Entra group, but several new hires are not being protected. Which administrative dependency matters? Review only SharePoint library permissions rather than the Entra group policy audience Recreate the DLP policy with identical fixed group targeting Group membership or policy-scope synchronization for the intended users and locations Increase sensitive information confidence levels without reviewing targeted group membership Explanation Correct Answer C:A static group target may miss new users until membership or assignments update. Incorrect Answers A:Site access controls do not determine which identities are covered by the DLP user scope. B:A new policy with the same stale membership will still miss the new hires. D:Match confidence affects detection but cannot add missing users to the fixed target group.
Question 981 A global company moves employees between business units frequently and wants DLP coverage to follow relevant organizational attributes. What should it evaluate? Use the global default domain to identify every business unit Supported dynamic policy audience or location scoping and the governing identity attributes Hard-code the first hundred employee names forever Create a new DLP policy for every password reset Explanation Correct Answer B:Attribute-based targeting reduces stale manual lists when configured and supported. Incorrect Answers A:One tenant domain may serve many departments. C:Static enumeration becomes inaccurate as the workforce changes. D:Password changes are not a reliable group classification method.
Question 982 A simulated DLP policy reports 400 possible blocks last week, but no employees experienced denial. What is the correct interpretation? No denial proves the rule conditions never matched The test predicts or audits matches without necessarily enforcing its selected blocking action A higher retention period must be added to activate the DLP rule The event count proves all 400 transfers were blocked Explanation Correct Answer B:Simulation mode is intended to evaluate impact before broad enforcement. Incorrect Answers A:Test telemetry can exist without blocking. C:Retention is unrelated to whether simulation matches occurred. D:A simulated match does not imply actual enforcement.
Question 983 After enabling policy tips, users increasingly cancel risky external sends. What measurement supports the training effect? Count only how many staff have a license assigned Compare supported DLP warning interactions, override/cancel outcomes and repeat event trends over comparable periods Count only how many sensitivity labels exist in the catalog Assume fewer alerts always means better behavior without checking policy scope Explanation Correct Answer B:Behavioral outcomes can indicate whether just-in-time guidance is effective. Incorrect Answers A:Entitlement does not measure response to a policy tip. C:Label inventory does not measure warnings acted on. D:Fewer events can also result from suppressed or broken detection.
Question 984 A protected document is exported into an unprotected plaintext format before external upload. What should security design anticipate? Supported content-based DLP checks on the resulting file and movement path, not only original label metadata Assume the original sensitivity label automatically attaches to every possible export format Rely solely on a file's original SharePoint location when the exported copy leaves it Disable DLP because exported text is no longer an Office document Explanation Correct Answer A:Transformed copies can lose labels even while retaining sensitive text. Incorrect Answers B:Protection persistence depends on supported formats and transformation behavior. C:Location-only policies may miss a new transfer path. D:Content risk remains even after format conversion.
Question 985 An employee previously shared ordinary project files but suddenly copies hundreds of labeled records to an external destination. Which investigation context is most relevant? Treat a Confidential label as proof that no external transfer succeeded Treat file count alone as sufficient evidence of malicious intent User activity baseline, data classification, destination, policy exceptions and any correlated risk signals Compare only prior average sharing volume without inspecting recipients or content class Explanation Correct Answer C:Behavior change plus sensitive content and destination informs triage. Incorrect Answers A:Labels identify data sensitivity but do not prove every transfer was technically blocked. B:High volume can be authorized, and sensitive destinations or identity signals provide essential context. D:Baseline comparisons alone cannot establish which regulated data reached an external destination.
Question 986 A policy blocks writes of Confidential files to removable drives but permits approved cloud collaboration. What must be configured? Distinct activity and destination restrictions for removable storage versus approved cloud services A retention label that only makes files nondeletable One universal block on all file operations in every workload Use one global device-control rule without distinguishing USB storage from permitted cloud destinations Explanation Correct Answer A:Device-local removable media and sanctioned SaaS transfers are different output channels. Incorrect Answers B:Preservation does not specify permitted storage destinations. C:A blanket prohibition contradicts the approved collaboration requirement. D:A single undifferentiated restriction risks blocking approved collaboration while failing to describe removable media controls.
Question 987 A workplace wants to keep sensitive documents from being opened or copied into a prohibited legacy desktop application. Which feature family should be investigated? Only a cloud file-retention policy with the app name in its title Block phishing emails from the desktop application's publisher rather than its prohibited file-use behavior Supported Endpoint DLP restricted-app monitoring and file activity controls for protected content Only a Teams channel moderation rule Explanation Correct Answer C:Local app-specific restrictions can address a prohibited endpoint workflow where supported. Incorrect Answers A:Retention cannot enforce local app activity by title. B:Mail anti-phishing cannot prevent a local application from opening or copying classified files on a managed endpoint. D:Channel messages do not control a desktop application's local file access.
Question 988 Defender for Cloud Apps marks an app unsanctioned and endpoint web protection blocks its URL, but the team also needs to govern confidential files sent to approved apps. Which additional layer is required? Mark every approved app unsanctioned to avoid writing DLP rules Use only the unsanctioned tag to identify the sensitivity of each file Data-aware DLP conditions and supported activity enforcement for approved destinations Replace all sensitive information types with a domain risk rating Explanation Correct Answer C:App approval status and content-based restrictions answer different governance questions. Incorrect Answers A:Broad blocking defeats approved business collaboration. B:App categorization is not file content inspection. D:Vendor risk does not detect actual confidential records.
Question 989 An Endpoint DLP analyst sees no sensitive content matches inside an unsupported encrypted archive. What is a truthful conclusion? Every encrypted archive must contain malware and be deleted The policy may lack inspection visibility into encrypted contents; evaluate supported detection and alternative controls The archive is automatically safe because no DLP alert appeared Replacing its filename extension guarantees the DLP engine can inspect it Explanation Correct Answer B:No match from inaccessible bytes is not evidence of non-sensitive content. Incorrect Answers A:Encryption does not establish maliciousness. C:Telemetry absence is not clearance. D:Changing an extension does not reveal protected file contents.
Question 990 A harmless public brochure has a Confidential label and is blocked by a label-based DLP rule. What repair best addresses the demonstrated false positive? Lower the sensitivity of every Confidential item in the tenant Rename the brochure to Public without changing its label Review the brochure's actual classification and apply an authorized label correction with an audit trail Disable label-based DLP for all documents forever Explanation Correct Answer C:Correcting erroneous classification resolves the root match without weakening other protected files. Incorrect Answers A:Broad reclassification is disproportionate to one brochure. B:A filename change may leave the applied label unchanged. D:A global exception hides genuine confidential content.
