Exam MS-100 All Questions

View all questions & answers for the MS-100 exam

Exam MS-100 topic 5 question 49 discussion

Actual exam question from Microsoft's MS-100

Question #: 49
Topic #: 5

HOTSPOT -
You have a data loss prevention (DLP) policy.
You need to increase the likelihood that the DLP policy will apply to data that contains medical terms from the International Classification of Diseases (ICD-9-CM).
The solution must minimize the number of false positives.
Which two settings should you modify? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

You can tune your rules by adjusting the instance count and match accuracy to make it harder or easier for content to match the rules. Each sensitive information type used in a rule has both an instance count and match accuracy.
To make the rule easier to match, decrease the min count and/or increase the max count. You can also set max to any by deleting the numerical value.
To minimize the number of false positives, we need to increase the minimum match accuracy.
A sensitive information type is defined and detected by using a combination of different types of evidence. Commonly, a sensitive information type is defined by multiple such combinations, called patterns. A pattern that requires less evidence has a lower match accuracy (or confidence level), while a pattern that requires more evidence has a higher match accuracy (or confidence level).
Reference:
https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies https://docs.microsoft.com/en-us/office365/securitycompliance/what-the-sensitive-information-types-look-for#international-classification-of-diseases-icd-9-cm

by hhaywood at May 11, 2021, 5:59 p.m.

Comments

Submit Cancel

Aysan

Highly Voted 4 years ago

MS-101 question

upvoted 7 times

...

joergsi

Highly Voted 3 years, 4 months ago

For me the first marking is wrong. We are asked to modify the settings of the International Classification of Diseases (ICD-9-CM) => Adjustment for the SSN is not needed at all! Min. Instance count and Match accuracy of ICD-9-CM needs to be adjusted!

upvoted 6 times

...

hufflepuff

Most Recent 2 years, 8 months ago

Other answers for the same question can be found here in the 101 exam. https://www.examtopics.com/discussions/microsoft/view/52124-exam-ms-101-topic-3-question-79-discussion/

upvoted 2 times

...

PurpleBreak

2 years, 11 months ago

I would change AND to OR in the policy definition so it would apply on ICD classifications even if didn’t have a SSN in the document. This would make it apply to more documents and then to reduce false positives I’d increase the accuracy.

upvoted 3 times

...

itmaster

3 years, 2 months ago

I would change only the "match accuracy" for both to increase it and avoid false positive. No need t change the "count", because if you increase the "count" the policy likehood to apply will reduce. The question states that "You need to increase the likelihood that the DLP policy will apply".

upvoted 1 times

...

FatsoGums

3 years, 7 months ago

MS-101 q

upvoted 2 times

...

jaolbreak

4 years ago

Both the minimum instance count and the minimum match accuracy need to be changed on the Medical Terms. If the minimum match accuracy was set to 99%, and the instance count to 1, that means 1 in every 100 could be a false positive. However if the instance count is increased to 5 matches, the number of false positives would drop exponentially. Unless there is specific reference to medical terms in the PII policy changing this would have no impact on reducing the false positives in the medical terms policy.

upvoted 4 times

...

hhaywood

4 years, 1 month ago

I understand the bottom option but why would the SSN min instance help?

upvoted 2 times

gsmith9897

4 years, 1 month ago

It seems both values should change on Medical Terms, increasing the instance count to compensate for lowering the match accuracy. Increasing instance count on PII Identifiers might decrease false positives by deceasing the number of matches, but doesn't seem like the right way to go about it.

upvoted 2 times

...