Exam SC-400 topic 2 question 34 discussion

The "Action" is a response that occurs when a data loss prevention (DLP) policy is triggered. In this case, when the policy rule detects credit card data on a Windows 10 device joined to Azure AD, it will trigger the "Action" you have configured. To restrict the ability to copy the sensitive data to the clipboard, you need to choose an appropriate "Action." One of the available actions is to "Block Access" to the sensitive data. You can also customize the action by choosing to "Notify User" with a custom message that explains why the access has been blocked. This will help prevent users from unknowingly violating the policy by providing them with clear information about what actions are permitted and what are not. Therefore, the correct answer is B - an Action. The incident report is used to notify the appropriate personnel when a policy rule is triggered. User notifications and user overrides are not directly related to configuring an action to restrict the ability to copy sensitive data to the clipboard.

it's confusing because we can block the action by allow override : https://docs.microsoft.com/en-us/microsoft-365/compliance/endpoint-dlp-using?view=o365-worldwide