Microsoft MS-102 Practice Test 66
Question 650
At Acorn Services, the endpoint security team is responsible for a vulnerability remediation program. Security must prioritize endpoint software exposure across a large workstation fleet. The documented evidence is: defender Vulnerability Management shows vulnerable products and exposed devices. The required outcome is to use exposure-aware vulnerability recommendations. The project requires audit-ready before-and-after configuration records. Which controlled deployment step would best address the requirement before broad rollout?
- Pilot an evidence-preserving device investigation focused on a short incident window during Acorn Services' vulnerability remediation program
- Pilot an approved software remediation on the highest-priority device cohort during Acorn Services' vulnerability remediation program
- Pilot endpoint settings changes on a controlled device ring during Acorn Services' vulnerability remediation program
- Pilot the isolation procedure on an authorized test device and document recovery controls during Acorn Services' vulnerability remediation program
Explanation
Correct Answer
B:Pilot an approved software remediation on the highest-priority device cohort. This controlled implementation step is specific to defender vulnerability management prioritization. The immediate task is a narrowly scoped and reversible first implementation. It responds to the evidence that defender Vulnerability Management shows vulnerable products and exposed devices and advances the requested outcome to use exposure-aware vulnerability recommendations.
Incorrect Answers
A:Pilot an evidence-preserving device investigation focused on a short incident window. This is a controlled implementation step for endpoint device investigation timeline, where an analyst needs to understand a suspicious process chain on a specific laptop. This case instead reports that security must prioritize endpoint software exposure across a large workstation fleet. It does not directly demonstrate the required outcome to use exposure-aware vulnerability recommendations at this decision stage.
C:Pilot endpoint settings changes on a controlled device ring. This is a controlled implementation step for defender for endpoint device settings, where the SOC needs consistent endpoint detection configuration across a managed device population. This case instead reports that security must prioritize endpoint software exposure across a large workstation fleet. It does not directly demonstrate the required outcome to use exposure-aware vulnerability recommendations at this decision stage.
D:Pilot the isolation procedure on an authorized test device and document recovery controls. This is a controlled implementation step for endpoint isolation response, where a confirmed compromised workstation continues making malicious network connections. This case instead reports that security must prioritize endpoint software exposure across a large workstation fleet. It does not directly demonstrate the required outcome to use exposure-aware vulnerability recommendations at this decision stage.
Question 651
At Beacon Manufacturing, the identity security team is responsible for a Conditional Access policy rollout. A complex combination of policies makes it unclear which controls apply to a prospective user sign-in. The documented evidence is: several policies target overlapping groups, resources, and device conditions. The required outcome is to predict policy applicability for a specified sign-in scenario. Only a named pilot cohort may be changed before the production window. Which controlled deployment step would best address the requirement before broad rollout?
- Pilot a policy scoped to the finance app before including other sensitive applications during Beacon Manufacturing's Conditional Access policy rollout
- Pilot the report-only policy against a representative group and analyze expected failures during Beacon Manufacturing's Conditional Access policy rollout
- Pilot configuration changes based on What If results before enforcing a broad rule during Beacon Manufacturing's Conditional Access policy rollout
- Pilot the risk-based policy with monitored detections and emergency account exclusions during Beacon Manufacturing's Conditional Access policy rollout
Explanation
Correct Answer
C:Pilot configuration changes based on What If results before enforcing a broad rule. This controlled implementation step is specific to conditional access what if testing. The immediate task is a narrowly scoped and reversible first implementation. It responds to the evidence that several policies target overlapping groups, resources, and device conditions and advances the requested outcome to predict policy applicability for a specified sign-in scenario.
Incorrect Answers
A:Pilot a policy scoped to the finance app before including other sensitive applications. This is a controlled implementation step for conditional access application targeting, where a high-value finance application needs stronger sign-in controls than ordinary collaboration apps. This case instead reports that a complex combination of policies makes it unclear which controls apply to a prospective user sign-in. It does not directly demonstrate the required outcome to predict policy applicability for a specified sign-in scenario at this decision stage.
B:Pilot the report-only policy against a representative group and analyze expected failures. This is a controlled implementation step for conditional access report-only evaluation, where security wants to assess a new Conditional Access requirement without interrupting users. This case instead reports that a complex combination of policies makes it unclear which controls apply to a prospective user sign-in. It does not directly demonstrate the required outcome to predict policy applicability for a specified sign-in scenario at this decision stage.
D:Pilot the risk-based policy with monitored detections and emergency account exclusions. This is a controlled implementation step for identity protection sign-in risk, where security wants stronger access controls when an individual sign-in exhibits suspicious signals. This case instead reports that a complex combination of policies makes it unclear which controls apply to a prospective user sign-in. It does not directly demonstrate the required outcome to predict policy applicability for a specified sign-in scenario at this decision stage.
Question 652
At Orchard Logistics, the endpoint security team is responsible for a managed device security rollout. Commodity malware uses suspicious script and Office child-process behavior on managed endpoints. The documented evidence is: defender ASR rule telemetry identifies the activity but no blocking rule has been deployed. The required outcome is to reduce risky endpoint behaviors using supported ASR rules. The initial change must be small enough to observe before organization-wide adoption. Which configuration or response best meets the specified requirement?
- Use Microsoft Defender for Endpoint device isolation when the response criteria are met during Orchard Logistics' managed device security rollout
- Use the device investigation timeline to correlate suspicious process execution and network activity during Orchard Logistics' managed device security rollout
- Prioritize remediation based on Defender Vulnerability Management recommendations during Orchard Logistics' managed device security rollout
- Configure appropriate Microsoft Defender Attack surface reduction rules for the target endpoints during Orchard Logistics' managed device security rollout
Explanation
Correct Answer
D:Configure appropriate Microsoft Defender Attack surface reduction rules for the target endpoints. This solution design step is specific to attack surface reduction rule deployment. The immediate task is to select the technical control that matches the observed requirement. It responds to the evidence that defender ASR rule telemetry identifies the activity but no blocking rule has been deployed and advances the requested outcome to reduce risky endpoint behaviors using supported ASR rules.
Incorrect Answers
A:Use Microsoft Defender for Endpoint device isolation when the response criteria are met. This is a solution design step for endpoint isolation response, where a confirmed compromised workstation continues making malicious network connections. This case instead reports that commodity malware uses suspicious script and Office child-process behavior on managed endpoints. It does not directly demonstrate the required outcome to reduce risky endpoint behaviors using supported ASR rules at this decision stage.
B:Use the device investigation timeline to correlate suspicious process execution and network activity. This is a solution design step for endpoint device investigation timeline, where an analyst needs to understand a suspicious process chain on a specific laptop. This case instead reports that commodity malware uses suspicious script and Office child-process behavior on managed endpoints. It does not directly demonstrate the required outcome to reduce risky endpoint behaviors using supported ASR rules at this decision stage.
C:Prioritize remediation based on Defender Vulnerability Management recommendations. This is a solution design step for defender vulnerability management prioritization, where security must prioritize endpoint software exposure across a large workstation fleet. This case instead reports that commodity malware uses suspicious script and Office child-process behavior on managed endpoints. It does not directly demonstrate the required outcome to reduce risky endpoint behaviors using supported ASR rules at this decision stage.
Question 653
At Bluebird Freight, the Microsoft 365 tenant operations team is responsible for a productivity service modernization. A managed user cohort needs predictable Microsoft 365 Apps updates rather than unmanaged version drift. The documented evidence is: microsoft 365 Apps installation inventory shows mixed update channels and outdated versions. The required outcome is to control supported app-update rollout through Microsoft 365 management capabilities. The change cannot weaken an unrelated control or expand access to uninvolved users. Which controlled deployment step would best address the requirement before broad rollout?
- Apply the update configuration to a pilot device group and monitor app reliability during Bluebird Freight's productivity service modernization
- Apply protection first to a controlled eligible resource subset and check recovery readiness during Bluebird Freight's productivity service modernization
- Update a small pilot identity set and test authentication before a bulk suffix migration during Bluebird Freight's productivity service modernization
- Apply the profile change to approved business contact fields and review a pilot administrator view during Bluebird Freight's productivity service modernization
Explanation
Correct Answer
A:Apply the update configuration to a pilot device group and monitor app reliability. This controlled implementation step is specific to microsoft 365 apps update configuration. The immediate task is a narrowly scoped and reversible first implementation. It responds to the evidence that microsoft 365 Apps installation inventory shows mixed update channels and outdated versions and advances the requested outcome to control supported app-update rollout through Microsoft 365 management capabilities.
Incorrect Answers
B:Apply protection first to a controlled eligible resource subset and check recovery readiness. This is a controlled implementation step for microsoft 365 backup configuration, where critical Exchange Online and OneDrive content needs a defined operational backup and recovery plan. This case instead reports that a managed user cohort needs predictable Microsoft 365 Apps updates rather than unmanaged version drift. It does not directly demonstrate the required outcome to control supported app-update rollout through Microsoft 365 management capabilities at this decision stage.
C:Update a small pilot identity set and test authentication before a bulk suffix migration. This is a controlled implementation step for custom sign-in suffix rollout, where users should sign in with a recently verified organization domain instead of the initial onmicrosoft.com suffix. This case instead reports that a managed user cohort needs predictable Microsoft 365 Apps updates rather than unmanaged version drift. It does not directly demonstrate the required outcome to control supported app-update rollout through Microsoft 365 management capabilities at this decision stage.
D:Apply the profile change to approved business contact fields and review a pilot administrator view. This is a controlled implementation step for tenant organization profile, where the company legal name and support contact shown in Microsoft 365 tenant information are outdated. This case instead reports that a managed user cohort needs predictable Microsoft 365 Apps updates rather than unmanaged version drift. It does not directly demonstrate the required outcome to control supported app-update rollout through Microsoft 365 management capabilities at this decision stage.
Question 654
At Willow Health, the messaging security team is responsible for a secure messaging operations improvement. Unknown malicious attachments evade signature-only filtering in business email. The documented evidence is: the tenant needs additional evaluation of attachments before user access. The required outcome is to use Defender for Office 365 Safe Attachments to inspect suspicious attachments. The administrator must retain a rollback path and document evidence of success. Which configuration or response best meets the specified requirement?
- Configure impersonation protection in a Defender for Office 365 anti-phishing policy during Willow Health's secure messaging operations improvement
- Configure Safe Attachments protection using an appropriate supported action for target mailboxes during Willow Health's secure messaging operations improvement
- Create an authorized Attack simulation training simulation with appropriate user training during Willow Health's secure messaging operations improvement
- Configure outbound anti-spam protections and investigate the suspected sender compromise during Willow Health's secure messaging operations improvement
Explanation
Correct Answer
B:Configure Safe Attachments protection using an appropriate supported action for target mailboxes. This solution design step is specific to safe attachments detonation. The immediate task is to select the technical control that matches the observed requirement. It responds to the evidence that the tenant needs additional evaluation of attachments before user access and advances the requested outcome to use Defender for Office 365 Safe Attachments to inspect suspicious attachments.
Incorrect Answers
A:Configure impersonation protection in a Defender for Office 365 anti-phishing policy. This is a solution design step for anti-phishing impersonation protection, where attackers send messages that mimic an executive's display name while using unauthorized sender identities. This case instead reports that unknown malicious attachments evade signature-only filtering in business email. It does not directly demonstrate the required outcome to use Defender for Office 365 Safe Attachments to inspect suspicious attachments at this decision stage.
C:Create an authorized Attack simulation training simulation with appropriate user training. This is a solution design step for attack simulation training campaign, where security awareness owners want to evaluate susceptibility to phishing using approved practice messages. This case instead reports that unknown malicious attachments evade signature-only filtering in business email. It does not directly demonstrate the required outcome to use Defender for Office 365 Safe Attachments to inspect suspicious attachments at this decision stage.
D:Configure outbound anti-spam protections and investigate the suspected sender compromise. This is a solution design step for outbound spam protection, where a compromised mailbox is sending a high volume of unsolicited external mail. This case instead reports that unknown malicious attachments evade signature-only filtering in business email. It does not directly demonstrate the required outcome to use Defender for Office 365 Safe Attachments to inspect suspicious attachments at this decision stage.
Question 655
At Seabright Freight, the messaging security team is responsible for a collaboration security hardening. Inbound email contains attachments with known malware signatures. The documented evidence is: exchange Online protection needs a consistent anti-malware response for this mail flow. The required outcome is to apply malware filtering policy rather than relying only on user reports. The change cannot weaken an unrelated control or expand access to uninvolved users. Which ongoing operational signal would best reveal recurrence of this particular problem?
- Monitor simulated compromise rates and training completion without exposing user secrets during Seabright Freight's collaboration security hardening
- Review quarantine policy changes and sensitive message-release events during Seabright Freight's collaboration security hardening
- Monitor anti-malware detections and policy handling errors during Seabright Freight's collaboration security hardening
- Monitor outbound spam threshold alerts and compromised sender indicators during Seabright Freight's collaboration security hardening
Explanation
Correct Answer
C:Monitor anti-malware detections and policy handling errors. This ongoing assurance step is specific to anti-malware email policy. The immediate task is to watch for regression in the relevant control or service. It responds to the evidence that exchange Online protection needs a consistent anti-malware response for this mail flow and advances the required outcome to apply malware filtering policy rather than relying only on user reports.
Incorrect Answers
A:Monitor simulated compromise rates and training completion without exposing user secrets. This is an ongoing assurance step for attack simulation training campaign, where security awareness owners want to evaluate susceptibility to phishing using approved practice messages. The current case instead reports that inbound email contains attachments with known malware signatures. It does not directly demonstrate the required outcome to apply malware filtering policy rather than relying only on user reports at this decision stage.
B:Review quarantine policy changes and sensitive message-release events. This is an ongoing assurance step for quarantine policy permissions, where the helpdesk needs to determine which quarantined messages users may preview or release. The current case instead reports that inbound email contains attachments with known malware signatures. It does not directly demonstrate the required outcome to apply malware filtering policy rather than relying only on user reports at this decision stage.
D:Monitor outbound spam threshold alerts and compromised sender indicators. This is an ongoing assurance step for outbound spam protection, where a compromised mailbox is sending a high volume of unsolicited external mail. The current case instead reports that inbound email contains attachments with known malware signatures. It does not directly demonstrate the required outcome to apply malware filtering policy rather than relying only on user reports at this decision stage.
Question 656
At Crescent Manufacturing, the messaging security team is responsible for an email threat protection rollout. Unknown malicious attachments evade signature-only filtering in business email. The documented evidence is: the tenant needs additional evaluation of attachments before user access. The required outcome is to use Defender for Office 365 Safe Attachments to inspect suspicious attachments. Only a named pilot cohort may be changed before the production window. Which controlled deployment step would best address the requirement before broad rollout?
- Pilot protection for a small set of priority users and protected executive identities during Crescent Manufacturing's email threat protection rollout
- Pilot the simulation with a consented training cohort before the full approved rollout during Crescent Manufacturing's email threat protection rollout
- Pilot a targeted control for the affected sender without disabling all organization mail during Crescent Manufacturing's email threat protection rollout
- Pilot Safe Attachments policy on a test mail recipient group before broadening its scope during Crescent Manufacturing's email threat protection rollout
Explanation
Correct Answer
D:Pilot Safe Attachments policy on a test mail recipient group before broadening its scope. This controlled implementation step is specific to safe attachments detonation. The immediate task is a narrowly scoped and reversible first implementation. It responds to the evidence that the tenant needs additional evaluation of attachments before user access and advances the requested outcome to use Defender for Office 365 Safe Attachments to inspect suspicious attachments.
Incorrect Answers
A:Pilot protection for a small set of priority users and protected executive identities. This is a controlled implementation step for anti-phishing impersonation protection, where attackers send messages that mimic an executive's display name while using unauthorized sender identities. This case instead reports that unknown malicious attachments evade signature-only filtering in business email. It does not directly demonstrate the required outcome to use Defender for Office 365 Safe Attachments to inspect suspicious attachments at this decision stage.
B:Pilot the simulation with a consented training cohort before the full approved rollout. This is a controlled implementation step for attack simulation training campaign, where security awareness owners want to evaluate susceptibility to phishing using approved practice messages. This case instead reports that unknown malicious attachments evade signature-only filtering in business email. It does not directly demonstrate the required outcome to use Defender for Office 365 Safe Attachments to inspect suspicious attachments at this decision stage.
C:Pilot a targeted control for the affected sender without disabling all organization mail. This is a controlled implementation step for outbound spam protection, where a compromised mailbox is sending a high volume of unsolicited external mail. This case instead reports that unknown malicious attachments evade signature-only filtering in business email. It does not directly demonstrate the required outcome to use Defender for Office 365 Safe Attachments to inspect suspicious attachments at this decision stage.
Question 657
At Granite Consulting, the Microsoft 365 tenant operations team is responsible for a Microsoft 365 tenant governance rollout. Remote users have poor Microsoft 365 connectivity in one branch office. The documented evidence is: users in the affected office have different network egress and Microsoft 365 latency than headquarters. The required outcome is to identify tenant-relevant network connectivity improvement opportunities. The administrator must retain a rollback path and document evidence of success. Which ongoing operational signal would best reveal recurrence of this particular problem?
- Track network connectivity insight trends for branch locations and service endpoints during Granite Consulting's Microsoft 365 tenant governance rollout
- Periodically review domain verification status and authoritative TXT record drift during Granite Consulting's Microsoft 365 tenant governance rollout
- Monitor deployment success, update failures, and version compliance for targeted apps during Granite Consulting's Microsoft 365 tenant governance rollout
- Monitor inbound mail-flow errors and DNS MX resolution after cutover during Granite Consulting's Microsoft 365 tenant governance rollout
Explanation
Correct Answer
A:Track network connectivity insight trends for branch locations and service endpoints. This ongoing assurance step is specific to network connectivity insights. The immediate task is to watch for regression in the relevant control or service. It responds to the evidence that users in the affected office have different network egress and Microsoft 365 latency than headquarters and advances the requested outcome to identify tenant-relevant network connectivity improvement opportunities.
Incorrect Answers
B:Periodically review domain verification status and authoritative TXT record drift. This is an ongoing assurance step for custom-domain ownership verification, where the new company email domain appears in the tenant but remains unverified. This case instead reports that remote users have poor Microsoft 365 connectivity in one branch office. It does not directly demonstrate the required outcome to identify tenant-relevant network connectivity improvement opportunities at this decision stage.
C:Monitor deployment success, update failures, and version compliance for targeted apps. This is an ongoing assurance step for microsoft 365 apps update configuration, where a managed user cohort needs predictable Microsoft 365 Apps updates rather than unmanaged version drift. This case instead reports that remote users have poor Microsoft 365 connectivity in one branch office. It does not directly demonstrate the required outcome to identify tenant-relevant network connectivity improvement opportunities at this decision stage.
D:Monitor inbound mail-flow errors and DNS MX resolution after cutover. This is an ongoing assurance step for exchange online mx cutover, where a verified Microsoft 365 domain has working accounts but incoming messages still reach a former mail provider. This case instead reports that remote users have poor Microsoft 365 connectivity in one branch office. It does not directly demonstrate the required outcome to identify tenant-relevant network connectivity improvement opportunities at this decision stage.
Question 658
At Juniper Media, the hybrid identity team is responsible for a hybrid directory synchronization rollout. A hybrid organization requires supported on-premises AD DS synchronization features managed by a dedicated sync server. The documented evidence is: identity infrastructure includes an established Entra Connect Sync installation and hybrid dependencies. The required outcome is to maintain supported directory synchronization between AD DS and Entra ID. The owner requires repeatable validation using a dedicated test identity or dataset. Which post-change check would most directly establish that the requirement has been met?
- Confirm synchronized users can authenticate using the intended cloud authentication method during Juniper Media's hybrid directory synchronization rollout
- Confirm the expected AD DS objects and attributes appear in Entra after a sync cycle during Juniper Media's hybrid directory synchronization rollout
- Confirm intended users synchronize while excluded test objects do not during Juniper Media's hybrid directory synchronization rollout
- Confirm in-scope identities provision correctly and out-of-scope objects remain excluded during Juniper Media's hybrid directory synchronization rollout
Explanation
Correct Answer
B:Confirm the expected AD DS objects and attributes appear in Entra after a sync cycle. This acceptance testing step is specific to microsoft entra connect sync topology. The immediate task is to observe a concrete success condition, not rely on a configuration screenshot alone. It responds to the evidence that identity infrastructure includes an established Entra Connect Sync installation and hybrid dependencies and advances the required outcome to maintain supported directory synchronization between AD DS and Entra ID.
Incorrect Answers
A:Confirm synchronized users can authenticate using the intended cloud authentication method. This is an acceptance testing step for password hash synchronization, where hybrid users need cloud authentication with resilience when on-premises authentication servers are unavailable. The current case instead reports that a hybrid organization requires supported on-premises AD DS synchronization features managed by a dedicated sync server. It does not directly demonstrate the required outcome to maintain supported directory synchronization between AD DS and Entra ID at this decision stage.
C:Confirm intended users synchronize while excluded test objects do not. This is an acceptance testing step for directory synchronization scoping, where only selected departments should be synchronized from on-premises AD DS to Microsoft Entra. The current case instead reports that a hybrid organization requires supported on-premises AD DS synchronization features managed by a dedicated sync server. It does not directly demonstrate the required outcome to maintain supported directory synchronization between AD DS and Entra ID at this decision stage.
D:Confirm in-scope identities provision correctly and out-of-scope objects remain excluded. This is an acceptance testing step for microsoft entra cloud sync provisioning, where several locations need resilient agent-based identity provisioning without a dedicated central sync engine. The current case instead reports that a hybrid organization requires supported on-premises AD DS synchronization features managed by a dedicated sync server. It does not directly demonstrate the required outcome to maintain supported directory synchronization between AD DS and Entra ID at this decision stage.
Question 659
At Seabright Freight, the hybrid identity team is responsible for a directory provisioning reliability initiative. Hybrid users need cloud authentication with resilience when on-premises authentication servers are unavailable. The documented evidence is: the organization currently depends on on-premises authentication infrastructure and wants a supported cloud-managed option. The required outcome is to use password hash synchronization where it meets the organization's requirements. The change cannot weaken an unrelated control or expand access to uninvolved users. Which ongoing operational signal would best reveal recurrence of this particular problem?
- Review Entra Connect Health alerts and health-report trends during Seabright Freight's directory provisioning reliability initiative
- Monitor Entra Connect Sync scheduler health and connector export errors during Seabright Freight's directory provisioning reliability initiative
- Monitor password hash sync health and hybrid sign-in failures during Seabright Freight's directory provisioning reliability initiative
- Monitor password writeback errors and failed SSPR operations during Seabright Freight's directory provisioning reliability initiative
Explanation
Correct Answer
C:Monitor password hash sync health and hybrid sign-in failures. This ongoing assurance step is specific to password hash synchronization. The immediate task is to watch for regression in the relevant control or service. It responds to the evidence that the organization currently depends on on-premises authentication infrastructure and wants a supported cloud-managed option and advances the required outcome to use password hash synchronization where it meets the organization's requirements.
Incorrect Answers
A:Review Entra Connect Health alerts and health-report trends. This is an ongoing assurance step for entra connect health monitoring, where the hybrid identity team notices authentication and synchronization outages only after end users report problems. The current case instead reports that hybrid users need cloud authentication with resilience when on-premises authentication servers are unavailable. It does not directly demonstrate the required outcome to use password hash synchronization where it meets the organization's requirements at this decision stage.
B:Monitor Entra Connect Sync scheduler health and connector export errors. This is an ongoing assurance step for microsoft entra connect sync topology, where a hybrid organization requires supported on-premises AD DS synchronization features managed by a dedicated sync server. The current case instead reports that hybrid users need cloud authentication with resilience when on-premises authentication servers are unavailable. It does not directly demonstrate the required outcome to use password hash synchronization where it meets the organization's requirements at this decision stage.
D:Monitor password writeback errors and failed SSPR operations. This is an ongoing assurance step for sspr on-premises password writeback, where a synchronized employee resets their cloud password successfully but cannot use the new password against on-premises resources. The current case instead reports that hybrid users need cloud authentication with resilience when on-premises authentication servers are unavailable. It does not directly demonstrate the required outcome to use password hash synchronization where it meets the organization's requirements at this decision stage.
Question 660
At Sterling Retail, the data loss prevention team is responsible for a sensitive data control implementation. Compliance receives multiple DLP alerts but needs to identify which data movement created them. The documented evidence is: purview DLP alerts contain rule matches, affected items, and supporting activity context. The required outcome is to investigate DLP violations with the right evidence. The project requires audit-ready before-and-after configuration records. Which configuration or response best meets the specified requirement?
- Configure Purview DLP for the Microsoft 365 Copilot policy location using supported sensitivity label conditions during Sterling Retail's sensitive data control implementation
- Configure a Purview DLP policy covering SharePoint and OneDrive file locations during Sterling Retail's sensitive data control implementation
- Configure an Exchange Online DLP rule with the appropriate sensitivity condition and external-sharing action during Sterling Retail's sensitive data control implementation
- Use Microsoft Purview DLP alerts and activity records to triage and remediate the incident during Sterling Retail's sensitive data control implementation
Explanation
Correct Answer
D:Use Microsoft Purview DLP alerts and activity records to triage and remediate the incident. This solution design step is specific to dlp incident investigation and alert triage. The immediate task is to select the technical control that matches the observed requirement. It responds to the evidence that purview DLP alerts contain rule matches, affected items, and supporting activity context and advances the required outcome to investigate DLP violations with the right evidence.
Incorrect Answers
A:Configure Purview DLP for the Microsoft 365 Copilot policy location using supported sensitivity label conditions. This is a solution design step for microsoft 365 copilot dlp policy location, where the organization must prevent Microsoft 365 Copilot from processing certain highly confidential content in supported scenarios. The current case instead reports that compliance receives multiple DLP alerts but needs to identify which data movement created them. It does not directly demonstrate the required outcome to investigate DLP violations with the right evidence at this decision stage.
B:Configure a Purview DLP policy covering SharePoint and OneDrive file locations. This is a solution design step for sharepoint and onedrive dlp, where sensitive files in SharePoint and OneDrive can be shared with external recipients. The current case instead reports that compliance receives multiple DLP alerts but needs to identify which data movement created them. It does not directly demonstrate the required outcome to investigate DLP violations with the right evidence at this decision stage.
C:Configure an Exchange Online DLP rule with the appropriate sensitivity condition and external-sharing action. This is a solution design step for exchange online dlp sensitive email, where users occasionally send external messages containing regulated personal identifiers. The current case instead reports that compliance receives multiple DLP alerts but needs to identify which data movement created them. It does not directly demonstrate the required outcome to investigate DLP violations with the right evidence at this decision stage.
