Exam MS-101 topic 3 question 79 discussion

I had this question on my test and I was able to modify the AND to be an OR in the hot area. I believe the answer is 1 to change the AND to OR & 2 to lift the match accuracy minimum on the medical terms to be higher confidence match (less false positives)

Because the two truth tables are compared with an AND. This means that both options would have to be true. So if there's no SSN but has medical information, you still want to count it. If you change the SSN min instance count to 0, then you would likely only get medical information but you could also get SSNs, but it would still need to include medical information to be true. You would not catch SSN instances. It's unclear if this is desirable. If you change the AND to and OR you would get positives for both instances. So catch instances with either SSN or medical information. To reduce the possibility or a false positive for medical information, you would increase the min match possibility. This would increase the criteria for matching information identified as medical terms and information. Lower it and you would catch more but it would be a less accurate match. So this is the value you want to change here, for sure. I would say that it depends on what the test lets you choose.

Answer correct set instance to 0 so PII wouldn't affect emails containing Medical information and increase confidence level to get less false positives https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitive-information-type-entity-definitions?view=o365-worldwide

I would set And to OR and Raise min Match accuracy. By set and to OR, PII is no longer relevant -- "increase the likelihood that the DLP policy will apply to data that contains medical terms" Raise match accuracy -- "minimize the number of false positives"

I really don't get it. Why we need to even touch SSN? Why can't Min instance count and Min Match accuracy both be tuned to higher? Reduce false positive means you make rule harder to match in context of what you consider end goal means if you increase instance count or match accuracy hard to match, then you reduce possibility of false positive. How improving SSN helps in the case? Also I don't think min can be 0 Ref: https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide#tuning-rules-to-make-them-easier-or-harder-to-match

I think I get it now. I couldn't wrap my head around why the SSN mattered in this case. But it does come down to the "AND" in this visual IF statement. So you increase the minimum count on the SSN -AND- increase the minimum accuracy of the medical condition to get better accuracy, because the two are evaluated as one rule. If you change this AND to an OR, and increase the minimum accuracy for the medical rule, you are essentially creating two different rules to match against. So, if the AND can't be changed, then yes, I agree with the given answer. Otherwise I would say to swap the AND for an OR and increase the minimum accuracy for the medical rule.

still valid, it was in my exam last Feb 5, 2022

I would decrease the match accuracy for SSN and increase the one for ICD. By decreasing the accuracy for SSN will increase the likelihood of a match and increasing the matching of ICD will decrease the chance of false positives.

The solution must minimize the number of false positives. So I think change the instance count to reduce the false positives.

Instance count should be 9 and accuracy should be max which is 100. Instance count: Typically, you use less restrictive actions, such as sending user notifications, in a rule with a lower instance count (for example, 1-9). And you use more restrictive actions, such as restricting access to content without allowing user overrides, in a rule with a higher instance count (for example, 10-any) Match accuracy: A pattern that requires less evidence has a lower match accuracy (or confidence level), while a pattern that requires more evidence has a higher match accuracy (or confidence level). To learn more about the actual patterns and confidence levels used by every sensitive information type, see Sensitive information type entity definitions.

I think you need to increase the instance count of Disease to more than 1. In the question they are speaking of "terms", not 1 term. "You need to increase the likelihood that the DLP policy will apply to data that contains medical terms". And of course increase the accuracy

I don't get it. Why modify the SSN instance count. Can someone explain, please?

Never mind, I didn't realize the setting was for "Any of these"

What does adjusting the SS number setting have anything to do with Disease terms?

Answers are correct. Direct Reference link: https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide#tuning-rules-to-make-them-easier-or-harder-to-match