SC-400 Data Loss Prevention & Threat Protection 4 — Questions and Answers
Question 1: A DLP policy needs to detect US bank account numbers only when they appear alongside a routing number in the same document. Which sensitive information type configuration achieves this?
- Create two separate DLP rules, one for each sensitive info type
- Use a sensitive information type with corroborating evidence that requires both elements (Correct answer)
- Use keyword dictionaries to detect both terms independently
- Configure exact data match (EDM) with a single field schema
Correct answer: Use a sensitive information type with corroborating evidence that requires both elements
Sensitive information types can be configured with primary and corroborative patterns, requiring both a bank account number and routing number to increase accuracy.
Question 2: What is the maximum number of items that can be included in an Exact Data Match (EDM) sensitive information type data source?
- 1 million
- 10 million (Correct answer)
- 100 million
- 1 billion
Correct answer: 10 million
EDM supports data stores of up to 100 million rows, but the practical supported limit per data source upload is commonly cited as 100 million rows; note the 10M limit applies to the lookup table.
Question 3: An organization wants its DLP policies to also apply to documents stored in on-premises file shares. Which component must be deployed?
- Microsoft Defender for Identity sensor
- Microsoft Purview Information Protection scanner (on-premises scanner) (Correct answer)
- Azure AD Application Proxy
- Microsoft Endpoint Configuration Manager
Correct answer: Microsoft Purview Information Protection scanner (on-premises scanner)
The Microsoft Purview Information Protection on-premises scanner extends DLP and sensitivity label policies to on-premises file repositories.
Question 4: A DLP policy generates too many false positive alerts for a specific internal SharePoint site that stores synthetic test data. What is the best approach to resolve this?
- Delete and recreate the policy with different sensitive info types
- Add the SharePoint site URL to the policy's exception or exclusion list (Correct answer)
- Increase the confidence level threshold for all sensitive info types in the policy
- Disable the policy and use activity explorer for manual review
Correct answer: Add the SharePoint site URL to the policy's exception or exclusion list
Adding an exclusion for the specific SharePoint site prevents the policy from applying to known false-positive locations while keeping it active elsewhere.
Question 5: Which DLP policy priority rule applies when multiple DLP policies match the same content?
- All matching policies are applied simultaneously with combined actions
- The most restrictive rule across all matching policies takes effect (Correct answer)
- Only the highest-priority (lowest number) policy's rules apply
- The most recently created policy takes precedence
Correct answer: The most restrictive rule across all matching policies takes effect
When multiple DLP rules from different policies match, the most restrictive action (e.g., block over notify) is applied across all matching rules.
Question 6: An admin wants endpoint DLP to log all user activity involving sensitive data but not block any actions. Which policy mode should be used?
- Enforce mode with 'Audit only' action
- Test mode with policy tips disabled
- Enforce mode with no block actions, only Audit actions configured (Correct answer)
- Simulation mode with alerts enabled
Correct answer: Enforce mode with no block actions, only Audit actions configured
Configuring an enforced policy with only Audit actions logs activity to Activity Explorer without restricting user behavior.
Question 7: A DLP policy is configured with a high confidence threshold (85%) for detecting passport numbers. This reduces false positives but may cause what trade-off?
- Increased processing time for all emails
- Higher false negative rate — some actual passport numbers may not be detected (Correct answer)
- Policy tips will no longer appear to end users
- The policy will only apply to outbound emails
Correct answer: Higher false negative rate — some actual passport numbers may not be detected
Higher confidence thresholds reduce false positives but increase false negatives, meaning some genuine sensitive content may not be flagged.
SC-400 Data Loss Prevention & Threat Protection 4
A DLP policy needs to detect US bank account numbers only when they appear alongside a routing number in the same document.
Which sensitive information type configuration achieves this?