Microsoft 365 Administrator Expert Implementing Data Loss Prevention Flashcards
7 cards from real MS-102 practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Microsoft 365 Administrator Expert Implementing Data Loss Prevention flashcards as text
A DLP policy is configured to detect credit card numbers in SharePoint. Users report legitimate business documents are being blocked. Which setting should you adjust to reduce false positives without disabling the policy?
Answer: Increase the instance count threshold before triggering the policy
Increasing the instance count threshold requires more occurrences of sensitive data before triggering a policy action, reducing false positives on documents with occasional credit card references.
Which Microsoft 365 compliance feature allows you to test a DLP policy's impact before enforcing it in production?
Answer: Audit mode
Audit mode logs policy matches and generates alerts without blocking users, allowing administrators to assess impact before enforcement.
You need to prevent users from sharing files containing SSNs via Teams chat but allow sharing within the same department. Which DLP condition should you configure?
Answer: Content is shared with people outside the organization
The 'Content is shared with people outside the organization' condition scopes the DLP rule to external sharing only, allowing internal departmental sharing to proceed.
An administrator needs to allow a specific user to override a DLP block when sharing financial reports externally. Which action configuration enables this?
Answer: Allow override with business justification
Configuring 'Allow override with business justification' lets users bypass the DLP block by entering a reason, which is logged for auditing.
Which endpoint DLP setting controls whether users can copy sensitive content detected on a managed device to a USB drive?
Answer: Unallowed removable storage device
The 'Unallowed removable storage device' setting in endpoint DLP blocks or audits attempts to copy sensitive content to USB or other removable media.
A DLP alert is triggered but no notification email was received by the compliance officer. Where in the Microsoft Purview compliance portal should you verify alert delivery configuration?
Answer: DLP policy > Edit policy > Alerts
Alert notification settings, including recipient email addresses, are configured within the DLP policy's Alerts section in the Microsoft Purview compliance portal.
You want to apply different DLP rules based on whether a document's sensitivity label is 'Confidential' or 'Public'. Which DLP condition supports this?
Answer: Content contains sensitivity label
The 'Content contains sensitivity label' condition allows DLP rules to be scoped based on labels applied by Microsoft Purview Information Protection.