Exam SC-400 topic 2 question 20 discussion

Actual exam question from Microsoft's SC-400

Question #: 20
Topic #: 2

A compliance administrator recently created several data loss prevention (DLP) policies.
After the policies are created, you receive a higher than expected volume of DLP alerts.
You need to identify which rules are generating the alerts.
Which DLP report should you use?

A. Third-party DLP policy matches
B. DLP policy matches
C. DLP incidents
D. False positive and override

Show Suggested Answer

Suggested Answer: B 🗳️

by klosedotorg83 at Oct. 9, 2021, 6:14 a.m.

Comments

Submit Cancel

wooyourdaddy

Highly Voted 2 years, 7 months ago

Selected Answer: B

I wrote the exam today, this question was on it, I choose B, scored 890!

upvoted 6 times

...

emartiy

Most Recent 11 months, 2 weeks ago

Selected Answer: B

B is correct option.

upvoted 2 times

...

Domza

1 year, 1 month ago

B is correct ~ Rule matched- will stop the process - File copied to clipboard - action. Simply open detail tab/Event of impacted entries With love~

upvoted 1 times

...

xswe

1 year, 9 months ago

To be able to see what policy that have been matched and how many times you can use the DLP Policy matches

upvoted 2 times

...

BTAB

2 years, 8 months ago

"the policy matches report is better for identifying matches with specific rules and fine tuning DLP policies. The incidents report is better for identifying specific pieces of content that are problematic for your DLP policies." https://docs.microsoft.com/en-us/microsoft-365/compliance/view-the-dlp-reports?view=o365-worldwide

upvoted 2 times

...