MS-102 - Microsoft 365 Administrator Expert Implementing Data Loss Prevention Questions and Answers

Question 1

An administrator needs to create a single Data Loss Prevention (DLP) policy to prevent the accidental sharing of documents containing credit card numbers. The policy must apply to users' corporate email, their OneDrive for Business accounts, and also block the upload of these files to non-allowed cloud services from their managed Windows 11 devices. Which locations must be selected in the DLP policy configuration?

Accepted Answer

Exchange Online, OneDrive for Business, and Devices

Answer

To meet all requirements, the policy must cover three distinct locations. 'Exchange Online' is required to monitor corporate email. 'OneDrive for Business' is needed to monitor files within the user's corporate cloud storage. The 'Devices' location (Endpoint DLP) is essential for monitoring and blocking actions on managed endpoints, such as preventing uploads of sensitive files to unapproved cloud services. Selecting only Exchange, SharePoint, and OneDrive would miss the endpoint protection requirement, and Defender for Cloud Apps is a separate, though related, service.

Question 2

You are configuring a new Data Loss Prevention (DLP) policy in 'Test it out first' mode. Your goal is to educate users about the company's data handling policies without immediately blocking their actions. Which of the following configurations is MOST appropriate for this initial educational phase?

Accepted Answer

Enable the policy and only configure policy tips to show to users.

Answer

The 'Test it out first' mode allows a DLP policy to be enabled without enforcing restrictive actions. Configuring it to only show policy tips is the ideal way to meet the educational goal. This setup makes users aware of potential policy violations in real-time as they are about to share sensitive information, but it does not block their workflow. Blocking everyone is too restrictive for an initial phase, restricting access without notification causes confusion, and only generating an admin report fails to educate the end-user.

Question 3

An administrator is creating a custom Sensitive Information Type (SIT) to detect a unique internal project code with the format 'PROJ-' followed by exactly six digits (e.g., PROJ-123456). Which of the following should be used as the primary element to define this specific pattern?

Accepted Answer

A regular expression

Answer

A regular expression (regex) is the ideal primary element for defining a specific, repeatable pattern like 'PROJ-' followed by six digits. A regex such as `PROJ-\d{6}` would accurately match this format. A keyword dictionary is impractical for a large number of unique codes, a document fingerprint detects entire forms, and a trainable classifier is for less-structured data.

Question 4

An organization wants to implement Endpoint Data Loss Prevention (DLP) to monitor and control activities on their corporate Windows 11 devices. Which of the following is a mandatory prerequisite for these devices to be covered by Endpoint DLP policies?

Accepted Answer

The devices must be onboarded into Microsoft Defender for Endpoint.

Answer

Endpoint DLP leverages the sensor and enforcement capabilities built into modern Windows operating systems. For the Microsoft Purview compliance portal to manage and apply DLP policies to a device, that device must first be onboarded into the Microsoft Defender for Endpoint service. This onboarding process establishes the necessary communication and management channel for the DLP engine.

Question 5

An administrator has configured two active Data Loss Prevention (DLP) policies:

- Policy 1 (Priority 0): Blocks external sharing of any content containing a single U.S. credit card number.
- Policy 2 (Priority 1): Shows a policy tip if content containing any financial data (including credit card numbers) is detected.

A user attempts to email a document containing one U.S. credit card number to an external recipient. What is the expected outcome?

Accepted Answer

The email is blocked, and the user also sees a policy tip.

Answer

Microsoft 365 DLP policies are processed in order of priority (lowest number first), and their actions are aggregated. The most restrictive action will always be enforced. In this case, Policy 1 has the highest priority and its 'Block' action is the most restrictive, so the email will be blocked. However, because Policy 2 also matches the content, its action (showing a policy tip) is also applied. Therefore, the user experiences both the block and the notification.

(MS-102) Microsoft 365 Administrator Expert Practice Test

(MS-102) Microsoft 365 Administrator Expert Practice Test

MS-102 - Microsoft 365 Administrator Expert Implementing Data Loss Prevention Questions and Answers