Microsoft MS-102 Exam Dumps, Practice Test Questions

Endpoint DLP device onboarding or the removable-media rule is missing. would fit a different circumstance involving: A security team must prevent copying regulated files from managed laptops to removable drives. Here the actual symptom is: Protected regulated identifiers leave through external email despite a DLP policy.

End-user policy tip notification settings were not enabled or scoped. is a plausible failure in another case: Employees experience unexplained DLP restrictions without any configured policy tip. It does not explain the current incident: Protected regulated identifiers leave through external email despite a DLP policy.

Aggregated inventory counts were confused with historical labeling activity events. would fit a different circumstance involving: A data protection officer wants to prove that a label was changed by an employee on a certain day. Here the actual symptom is: Protected regulated identifiers leave through external email despite a DLP policy.

Enable supported DLP policy tips or end-user notifications for the applicable workload. can be useful when a DLP policy detects genuine sensitive material but should inform employees why an action was blocked. However, it does not specifically achieve: A protected file's external sharing action is restricted when the policy matches.

Use Microsoft Purview Endpoint DLP with supported removable storage restrictions. addresses another administrative need: A security team must prevent copying regulated files from managed laptops to removable drives. This question instead requires the outcome: A protected file's external sharing action is restricted when the policy matches.

Use Microsoft Purview Content explorer for supported sensitive-content visibility. can be useful when a data steward needs to locate repositories containing identified sensitive information types. However, it does not specifically achieve: A protected file's external sharing action is restricted when the policy matches.

Onboard eligible devices and configure an Endpoint DLP rule for copying protected content to USB. is directed at a separate task: A security team must prevent copying regulated files from managed laptops to removable drives. It does not produce the required configuration outcome: A protected file's external sharing action is restricted when the policy matches.

Deploy the policy in a nonblocking evaluation mode and examine matched events. implements a different mechanism for: A new DLP policy might disrupt legitimate workflows and must be assessed before enforcement. It does not configure the mechanism needed here: Use Purview DLP for supported SharePoint Online content and external sharing controls.

Create a retention label policy that makes approved labels available to the target location. is directed at a separate task: A records manager wants an employee to manually choose a retention classification on eligible documents. It does not produce the required configuration outcome: A protected file's external sharing action is restricted when the policy matches.

The affected employee sees the intended policy explanation during a blocked action. would assess a different control. In this case it does not rule out the specific failure: A protected SharePoint file remains accessible through an anonymous sharing link.

The policy reports expected matches without immediately interrupting production actions. is evidence of another system state: A new DLP policy might disrupt legitimate workflows and must be assessed before enforcement. The acceptance evidence here instead is: A protected file's external sharing action is restricted when the policy matches.

The steward identifies content locations associated with the defined sensitive information type. would assess a different control. In this case it does not rule out the specific failure: A protected SharePoint file remains accessible through an anonymous sharing link.

The Copilot policy workload and applicability were not specifically verified. would fit a different circumstance involving: An organization enables Copilot but must protect matching sensitive information within supported Microsoft 365 Copilot scenarios. Here the actual symptom is: A protected SharePoint file remains accessible through an anonymous sharing link.

The investigator did not distinguish a policy match from confirmed malicious intent. is a plausible failure in another case: A DLP alert is automatically labeled malicious merely because a rule matched. It does not explain the current incident: A protected SharePoint file remains accessible through an anonymous sharing link.

A sensitivity label was mistakenly treated as a replacement for retention policy. would fit a different circumstance involving: An administrator wants to distinguish file sensitivity labeling from organizational content-retention requirements. Here the actual symptom is: A protected SharePoint file remains accessible through an anonymous sharing link.

Enable supported DLP policy tips or end-user notifications for the applicable workload. can be useful when a DLP policy detects genuine sensitive material but should inform employees why an action was blocked. However, it does not specifically achieve: A matching OneDrive file triggers the documented protective DLP action.

Use the separate supported Microsoft 365 Copilot DLP location in an eligible custom policy rather than combining it with other workload locations. addresses another administrative need: An organization enables Copilot but must protect matching sensitive information within supported Microsoft 365 Copilot scenarios. This question instead requires the outcome: A matching OneDrive file triggers the documented protective DLP action.

Use labeling activity evidence and appropriate audit history in Microsoft Purview. can be useful when a data protection officer wants to prove that a label was changed by an employee on a certain day. However, it does not specifically achieve: A matching OneDrive file triggers the documented protective DLP action.

Review the Endpoint DLP event details and supporting business context before disposition. is directed at a separate task: A protected endpoint file transfer produces alerts but the SOC must separate a real data leak from a benign test. It does not produce the required configuration outcome: A matching OneDrive file triggers the documented protective DLP action.

Deploy the policy in a nonblocking evaluation mode and examine matched events. implements a different mechanism for: A new DLP policy might disrupt legitimate workflows and must be assessed before enforcement. It does not configure the mechanism needed here: Apply Purview DLP to eligible OneDrive accounts for specific sensitive data patterns.

Query the relevant Activity explorer labeling event or audit record with identity and time filters. is directed at a separate task: A data protection officer wants to prove that a label was changed by an employee on a certain day. It does not produce the required configuration outcome: A matching OneDrive file triggers the documented protective DLP action.

An eligible Copilot prompt or response scenario triggers the configured DLP protection. would assess a different control. In this case it does not rule out the specific failure: A regulated file is shared from OneDrive but only SharePoint sites were scoped.

The case records a defensible classification and evidence for the transfer attempt. is evidence of another system state: A protected endpoint file transfer produces alerts but the SOC must separate a real data leak from a benign test. The acceptance evidence here instead is: A matching OneDrive file triggers the documented protective DLP action.

The event shows the relevant actor, time and labeling action. would assess a different control. In this case it does not rule out the specific failure: A regulated file is shared from OneDrive but only SharePoint sites were scoped.

The Copilot policy workload and applicability were not specifically verified. would fit a different circumstance involving: An organization enables Copilot but must protect matching sensitive information within supported Microsoft 365 Copilot scenarios. Here the actual symptom is: A regulated file is shared from OneDrive but only SharePoint sites were scoped.

The investigator did not distinguish a policy match from confirmed malicious intent. is a plausible failure in another case: A DLP alert is automatically labeled malicious merely because a rule matched. It does not explain the current incident: A regulated file is shared from OneDrive but only SharePoint sites were scoped.

The regex or supporting match criteria are too broad for the intended sensitive information. would fit a different circumstance involving: Compliance needs to detect a proprietary employee identifier that follows a distinct pattern in documents. Here the actual symptom is: A regulated file is shared from OneDrive but only SharePoint sites were scoped.

Use supported DLP test or simulation mode before turning on blocking actions. can be useful when a new DLP policy might disrupt legitimate workflows and must be assessed before enforcement. However, it does not specifically achieve: A matching sensitive file transfer to removable storage is blocked or audited as required.

Enable supported DLP policy tips or end-user notifications for the applicable workload. addresses another administrative need: A DLP policy detects genuine sensitive material but should inform employees why an action was blocked. This question instead requires the outcome: A matching sensitive file transfer to removable storage is blocked or audited as required.

Use labeling activity evidence and appropriate audit history in Microsoft Purview. can be useful when a data protection officer wants to prove that a label was changed by an employee on a certain day. However, it does not specifically achieve: A matching sensitive file transfer to removable storage is blocked or audited as required.

Create a DLP policy targeting Exchange Online and appropriate external recipient conditions. is directed at a separate task: A company wants to stop employees emailing files containing regulated identifiers outside the organization. It does not produce the required configuration outcome: A matching sensitive file transfer to removable storage is blocked or audited as required.

Create an eligible custom Purview DLP policy selecting the Copilot and Copilot Chat location and supported conditions. implements a different mechanism for: An organization enables Copilot but must protect matching sensitive information within supported Microsoft 365 Copilot scenarios. It does not configure the mechanism needed here: Use Microsoft Purview Endpoint DLP with supported removable storage restrictions.

Configure the sensitivity label's encryption and content marking settings and publish it. is directed at a separate task: An enterprise wants confidential files to carry encryption and visual marking based on classification. It does not produce the required configuration outcome: A matching sensitive file transfer to removable storage is blocked or audited as required.