Exam MS-500 topic 3 question 12 discussion

Actual exam question from Microsoft's MS-500

Question #: 12
Topic #: 3

SIMULATION -
You need to ensure that a global administrator is notified when a document that contains U.S. Health Insurance Portability and Accountability Act (HIPAA) data is identified in your Microsoft 365 tenant.
To complete this task, sign in to the Microsoft Office 365 admin center.

Show Suggested Answer

Suggested Answer: See explanation below.
1. In the Security & Compliance Center > left navigation > Data loss prevention > Policy > + Create a policy.
2. Choose the U.S. Health Insurance Portability and Accountability Act (HIPAA) template > Next.
3. Name the policy > Next.
4. Choose All locations in Office 365 > Next.
5. At the first Policy Settings step just accept the defaults,
6. After clicking Next, you'll be presented with an additional Policy Settings page
✑ Deselect the Show policy tips to users and send them an email notification option.
✑ Select the Detect when content that's being shared contains option, and decrease the number of instances to 1.
✑ Select the Send incident reports in email option.
7. > Next
8. Select the option to turn on the policy right away > Next.
9. Click Create to finish creating the policy.
References:
https://docs.microsoft.com/en-us/microsoft-365/compliance/create-test-tune-dlp-policy?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/what-the-dlp-policy-templates-include?view=o365-worldwide

by shanti0091 at Jan. 28, 2021, 4:57 a.m.

Comments

Submit Cancel

mihos

3 years ago

just wonder if this can be done from DLP. it will not be sent but just "identify" (locate) the documents with HIPAA in M365. not sure where do go to accomplish this.

upvoted 1 times

...

Nail

3 years, 9 months ago

It doesn't matter if "send incident reports in email" is greyed out. The option for "Send alerts if any of the DLP rules match" is still there and checked, so Global Admins will be alerted in email. The simulation doesn't require an incident report, only notification.

upvoted 3 times

...

EzeQ

3 years, 9 months ago

On step 5 I had to change to "Create or Customize advanced DLP rules" to do the fine grained options, moving forward with the defaults showed the option "Send incident reports in email" greyout. I was still able to activate the "send alerts if any of the DLP rules match" but that's not the same thing, although I do not known the difference.

upvoted 1 times

...

Donnie21

4 years, 2 months ago

You do not have to select global administrators by default email are send to them.

upvoted 4 times

...

shanti0091

4 years, 4 months ago

The steps are correct but when you get to the part to deselect, you need to select instead and make sure you uncheck the all the box that selects all users, owners and select the add tab to include the global administrator account only.

upvoted 2 times

...