Data Loss Prevention Policies Flashcards

An organization needs to prevent employees from emailing documents containing credit card numbers to external recipients. However, the policy must allow for legitimate business cases where a user can send the information after providing a reason. Which combination of actions should an administrator configure in the Data Loss Prevention (DLP) policy rule?

Answer: Set the action to 'Restrict access' to block external users, and enable 'User overrides' with a business justification.

To meet the requirement, the policy must first block the action ('Restrict access' for people outside the organization). Then, to allow for exceptions with a reason, the 'User overrides' option must be enabled, which can be configured to require a business justification. This combination blocks the action by default but gives users a way to proceed if necessary, while logging their reason for audit purposes.

What is the primary function of a "Policy Tip" within a Microsoft 365 Data Loss Prevention (DLP) policy for Exchange Online?

Answer: To display a real-time notification to the sender in their Outlook client, warning them of a potential policy violation.

A Policy Tip is a notification that appears in Outlook and Outlook on the web while a user is composing an email. Its main purpose is to inform the sender that their message content appears to violate a DLP policy, allowing them to correct the issue before sending or, if configured, to override the policy.

An administrator is creating a new Data Loss Prevention (DLP) policy to identify and protect Australian financial data, including bank account and tax file numbers. Which of the following components should the administrator use to define the specific patterns for this type of data?

Answer: Sensitive Information Types (SITs)

Sensitive Information Types (SITs) are pattern-based classifiers used to detect specific types of sensitive data. Microsoft provides over 300 built-in SITs for various countries and regulations, including specific types for Australian financial data. DLP policies use SITs as a condition to identify content that needs protection.

A financial services company has a strict DLP policy that blocks any email containing a high volume of customer financial records from being sent externally. A user in the wealth management group needs to send an encrypted report to a pre-approved external auditor. How can an administrator modify the DLP policy to allow this specific scenario without weakening the overall policy?

Answer: Add an exception to the rule that allows the email if the message is encrypted.

DLP rules can be configured with exceptions. A common and secure exception is to allow an action if the message is protected with encryption (rights management). This allows the specific business process to continue while ensuring the sensitive data remains protected. Disabling the rule or creating a separate, weaker policy is less secure, and the safe sender list does not override DLP policy blocks.

An administrator is creating a unified Data Loss Prevention (DLP) policy. They need to ensure the policy applies to emails, files stored in personal cloud storage, and collaborative team chats. Which of the following locations must be selected in the policy scope?

Answer: Exchange Online, OneDrive for Business accounts, and Microsoft Teams chat and channel messages

Microsoft 365 DLP policies can be scoped to multiple locations. To cover emails, personal cloud storage, and team chats, the administrator must select Exchange Online, OneDrive for Business accounts, and Microsoft Teams chat and channel messages respectively.

A messaging administrator wants to be automatically notified via email and receive a comprehensive summary whenever a user triggers a high-severity DLP rule by attempting to send a large number of Social Security Numbers. Which feature should be configured within the DLP policy rule to achieve this?

Answer: A mail flow rule with a 'Generate incident report' action

The 'Incident reports' feature within a DLP policy rule is designed specifically for this purpose. It can be configured to send an email notification to specified administrators when a policy match occurs. The severity level (low, medium, high) can also be set, and the report will contain details about the incident.