Exam SC-400 topic 2 question 47 discussion

Actual exam question from Microsoft's SC-400

Question #: 47
Topic #: 2

You have a Microsoft 365 E5 subscription that contains a data loss prevention (DLP) policy named DLP1.

DLP1 has a rule that triggers numerous alerts.

You need to reduce the number of alert notifications that are generated. The solution must maintain the sensitivity of DLP1.

What should you do?

A. Change the mode of DLP1 to Test without notifications.
B. Modify the rule and increase the instance count.
C. Modify the rule and configure an alert threshold.
D. Modify the rule and set the priority to the highest value.

Show Suggested Answer

Suggested Answer: C 🗳️

by See_Es at Jan. 22, 2023, 10:19 p.m.

Comments

Submit Cancel

EM1234

11 months, 3 weeks ago

Selected Answer: C

I am kind of surprised that there were not any people who chose B. When you read: https://learn.microsoft.com/en-us/purview/dlp-alerts-get-started?view=o365-worldwide#aggregate-event-alert-configuration You see that one way (maybe the most important?) to configure the "threshold" is to increase the instances required for alert. I am going with C, since it is the more general answer but having B as an option makes it less clear.

upvoted 1 times

...

emartiy

1 year, 3 months ago

Selected Answer: C

Accepted

upvoted 1 times

...

Domza

1 year, 7 months ago

Correct ~

upvoted 1 times

...

Gesbie

1 year, 10 months ago

was on Exam August 9, 2023

upvoted 1 times

...

xswe

2 years, 2 months ago

Changing the alert threshold will create less alerts but not effect the policy

upvoted 4 times

...

See_Es

2 years, 4 months ago

Selected Answer: C

Correct. Tested in my tenant

upvoted 4 times

wooyourdaddy

2 years, 3 months ago

Also documented here: https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-configure-view-alerts-policies?view=o365-worldwide#alert-configuration-experience

upvoted 2 times

...