Exam MS-100 topic 2 question 26 discussion

Actual exam question from Microsoft's MS-100

Question #: 26
Topic #: 2

HOTSPOT -
Your company is based in the United Kingdom (UK).
Users frequently handle data that contains Personally Identifiable Information (PII).
You create a data loss prevention (DLP) policy that applies to users inside and outside the company. The policy is configured as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based in the information presented in the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer

Suggested Answer:

The text in the Policy Settings section of the exhibit explains what will happen.
If a user sends between 1 and 10 instances of the sensitive info (passport number), then a notification email and will be sent to the user and a policy tip will be displayed. The email will not be blocked though. Therefore, it will be allowed.
If a user sends more than 10 instances of the sensitive info (passport number), the email will be blocked and a high-severity alert generated. However, the user can override the block.
Reference:
https://docs.microsoft.com/en-us/office365/securitycompliance/data-loss-prevention-policies

by airairo at May 18, 2021, 10:31 a.m.

Comments

Submit Cancel

airairo

Highly Voted 4 years, 1 month ago

The given answers are correct.

upvoted 18 times

...

Eggsamine

Most Recent 3 years, 8 months ago

Has anyone had this show up in the MS-100 exam as it is an MS-101 question?

upvoted 4 times

sehlohomoletsane

2 years, 3 months ago

Yes i have

upvoted 1 times

...

InformationOverload

3 years, 10 months ago

If you choose the email notification and policy tip, it can allow users to override a rule by reporting a false positive or providing a business justification

upvoted 1 times

...

momonoke

3 years, 11 months ago

If a user sends more than 10 instances of the sensitive info (passport number), the email will be blocked and a high-severity alert generated. Yes, but the note doesn't explain why.. The setting states, that the access will be blocked, if we have "..more than 10 instances of the sensitive info..". But why is the user able to override it. That makes this setting and its description senseless.

upvoted 2 times

TechMinerUK

3 years ago

I can only speak from personal experience with DLP policies however I think the second statement is a bit muddled as the policy tip is the element which can be over-ridden however it sounds like what is being configured is as follows: 1. Policy tip shows without any blocking 2. Policy tip shows in block mode but user can over-ride by providing a justification. It seems the question wording is just a bit unusual in how it's conveying this however the functionality is there as it is similar to the overriding for document labelling

upvoted 1 times

...