SC-400 Data Loss Prevention & Threat Protection 2

Question 1

A compliance administrator needs to prevent users from sharing files containing credit card numbers via Microsoft Teams chat. Which DLP policy location should be configured?

Accepted Answer

Teams chat and channel messages

Answer

Teams chat and channel messages is the correct DLP location to intercept content shared directly within Microsoft Teams conversations.

Question 2

When configuring a DLP policy, what does setting a rule action to 'Block with override' allow end users to do?

Accepted Answer

Send the content after providing a business justification

Answer

Block with override allows users to proceed with the action after entering a business justification, which is logged for compliance review.

Question 3

An organization wants DLP policies to apply to endpoints (Windows 10/11 devices). What must be enabled first?

Accepted Answer

Microsoft Purview compliance portal device onboarding

Answer

Devices must be onboarded into Microsoft Purview compliance portal before endpoint DLP policies can be applied to them.

Question 4

Which DLP condition allows a policy to detect when a document contains both a Social Security Number AND a keyword like 'confidential'?

Accepted Answer

Content matches all conditions using AND logic

Answer

Combining multiple conditions with AND logic requires all specified conditions to be true simultaneously for the rule to trigger.

Question 5

A DLP policy is in simulation mode. What is the primary purpose of this mode?

Accepted Answer

To test policy impact without enforcing actions or blocking users

Answer

Simulation mode (test mode) lets administrators evaluate policy matches and impact reports before enabling enforcement.

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

(SC-400) Microsoft Certified Information Protection and Compliance Administrator Associate Practice Test

SC-400 Data Loss Prevention & Threat Protection 2