Exam SC-400 topic 2 question 29 discussion

Obviously refers to 2 DLP Policies, as you can only have the policy in Audit Mode or On. Audit Mode for Group 1. On for everyone else.

1 policy + 2 rules.

Its A, One Policy for Block (including all Users and exlude Group1 with action Block) One Policy for Audit (including only Group1 with action Audit) If you would only create one Policy with exclude Group1 and Block only the Blocked ones would be audited not the successfully copyed one from Group1

Its A, One Policy for Block (including all Users and exlude Group1 with action Block) One Policy for Audit (including only Group1 with action Audit) If you would only create one Policy with exclude Group1 and Block only the Blocked ones would be audited not the successfully copyed one from Group1

If it wasn't for the Audit requirement this would be just one policy with a block and exclude group 1, however with the audit requirement it would be t DLP policies

A is the correct answer. The first DLP policy sets up a block for all users. Group 1 is excluded. The second policy sets up recording in the audit log for group 1.

You should go for two DLP policies and one DLP rule to achieve this

The real question is whether a group excluded from a policy setting still generates an audit record of the exclusion. If yes, then 1 for each is good. If no, we need 2 policies. I believe its the Latter

Hmmmm, the audit question is irrelevant here because as soon as an event takes place, an Audit log is created (this is implied). Also creating an exclusion in a simple rule is perfectly possible, therefore 1 policy 1 rule.

With 1 policy you cannot choose both Audit and Block. You need 1 policy for all users with block rule, and exclude group1 and 1 policy that includes group1 only and the rule set to Audit only

A is the only way

Correct answer is (B). 1 policy and 1 rule. From the DLP Policy, under "Choose locations to apply the policy", when you select "Devices", you are provided with "Included" and "Excluded" to allow you to "Exclude user or group" which you add Group1 to for exclusion from this one policy scope, all other users will be included. So you only need one DLP policy, with the scope excluding Group1. Then you create 1 rule that has an action (from Actions > selecy "Apply restrictions to specific activity" > and select only "Copy to a USB removable media" > and make the action "Block") which will block copying files to USB for the scope you chose.

On exam 1/20/2022

I think 1 policy, 1 rule using exlusion group or user