Exam SC-400 topic 2 question 20 discussion

Actual exam question from Microsoft's SC-400

Question #: 20
Topic #: 2

A compliance administrator recently created several data loss prevention (DLP) policies.
After the policies are created, you receive a higher than expected volume of DLP alerts.
You need to identify which rules are generating the alerts.
Which DLP report should you use?

A. Third-party DLP policy matches
B. DLP policy matches
C. DLP incidents
D. False positive and override

Show Suggested Answer

Suggested Answer: B 🗳️

by klosedotorg83 at Oct. 9, 2021, 6:14 a.m.

Comments

Submit Cancel

wooyourdaddy

Highly Voted 2 years, 6 months ago

Selected Answer: B

I wrote the exam today, this question was on it, I choose B, scored 890!

upvoted 6 times

...

emartiy

Most Recent 10 months ago

Selected Answer: B

B is correct option.

upvoted 2 times

...

Domza

12 months ago

B is correct ~ Rule matched- will stop the process - File copied to clipboard - action. Simply open detail tab/Event of impacted entries With love~

upvoted 1 times

...

xswe

1 year, 8 months ago

To be able to see what policy that have been matched and how many times you can use the DLP Policy matches

upvoted 2 times

...

BTAB

2 years, 7 months ago

"the policy matches report is better for identifying matches with specific rules and fine tuning DLP policies. The incidents report is better for identifying specific pieces of content that are problematic for your DLP policies." https://docs.microsoft.com/en-us/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide

upvoted 2 times

...

[Removed]

2 years, 9 months ago

Why is this policy matches when the incidents report shows matches at a rule level?

upvoted 1 times

[Removed]

2 years, 9 months ago

I was getting them the wrong way round: "the policy matches report shows matches at a rule level; for example, if an email matched three different rules, the policy matches report shows three different line items." https://docs.microsoft.com/en-us/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide#view-the-reports-for-data-loss-prevention

upvoted 2 times

...