Exam MS-101 All Questions

View all questions & answers for the MS-101 exam

Exam MS-101 topic 3 question 54 discussion

Actual exam question from Microsoft's MS-101

Question #: 54
Topic #: 3

DRAG DROP -
You have a Microsoft 365 subscription.
In the Exchange admin center, you have a data loss prevention (DLP) policy named Policy1 that has the following configurations:
✑ Block emails that contain financial data.
✑ Display the following policy tip text: Message blocked.
From the Microsoft 365 compliance center, you create a DLP policy named Policy2 that has the following configurations:
✑ Use the following location: Exchange email.
✑ Display the following policy tip text: Message contains sensitive data.
✑ When a user sends an email, notify the user if the email contains health records.
What is the result of the DLP policies when the user sends an email? To answer, drag the appropriate results to the correct scenarios. Each result may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Show Suggested Answer

Suggested Answer:

Box 1: The email will be blocked, and the user will receive the policy tip: Message blocked.
If you've created DLP policies in the Exchange admin center, those policies will continue to work side by side with any policies for email that you create in the
Security & Compliance Center. But note that rules created in the Exchange admin center take precedence. All Exchange mail flow rules are processed first, and then the DLP rules from the Security & Compliance Center are processed.
Box 2: The email will be allowed, and the user will receive the policy tip: Message contains sensitive data.
Reference:
https://docs.microsoft.com/en-us/microsoft-365/compliance/how-dlp-works-between-admin-centers

by PersonT at April 2, 2021, 10:01 a.m.

Comments

Submit Cancel

MrDre

Highly Voted 3 years, 9 months ago

For me it should be blocked for both. if it was just health information in one of the examples, then the given answers would make sense. The fact that financial information is in both, means both emails should be blocked.

upvoted 40 times

Thespy45

3 years, 9 months ago

Yes blocked with tips "Message blocked". "If content matches multiple rules, the rules are processed in priority order and the most restrictive action is enforced." Reference : https://docs.microsoft.com/en-us/microsoft-365/compliance/data-loss-prevention-policies?view=o365-worldwide#the-priority-by-which-rules-are-processed

upvoted 16 times

Durden871

2 years, 9 months ago

But one is an Exchange rule and the other is a Security and Compliance rule.

upvoted 1 times

...

Kittu

Highly Voted 4 years ago

I feel the answers need to be swapped.

upvoted 25 times

...

JPO2021

Most Recent 2 months, 2 weeks ago

Change Question 2 : "When the user sends an email that contains only health records".....Box 2: The email will be allowed, and the user will receive the policy tip: Message contains sensitive data.

upvoted 1 times

...

jonny_sins

1 year, 7 months ago

Answer provided is soooo correct. anyone who thinks otherwise is not intelligent. straightforward answer

upvoted 1 times

jonny_sins

1 year, 7 months ago

update: was on exam and I answered as seen here. I scored a 980

upvoted 1 times

...

Meebler

2 years, 1 month ago

The email will be blocked, and the user will receive the policy tip: Message blocked, The email will be blocked, and the user will receive the policy tip: Message contains sensitive data

upvoted 2 times

...

ilma_nl

2 years, 7 months ago

both block but dlp in exchange online is not possible anymoren Legacy Exchange Online data loss prevention in the Exchange admin center is in the process of being deprecated. We recommend that you create DLP policies in the Microsoft Purview compliance portal. For more information about this DLP, see Learn about data loss prevention. Starting April 1, 2022, admins will no longer be able to make configuration changes to DLP policies in the classic Exchange admin center. Existing rules will continue to work as-is. Starting August 1, 2022, the DLP policy management experience in the classic Exchange admin center will be retired. Admins will still be able to view the associated rules in read-only mode using the mail flow rule (transport rule) experience. You can easily migrate your legacy Exchange Online DLP policies using the migration wizard. For more information, see Migrate Exchange Online data loss prevention policies to the Microsoft Purview compliance portal. Detailed timelines for GCC-H and DoD special clouds will be communicated separately.

upvoted 8 times

...

Contactfornitish

2 years, 8 months ago

Both blocked, no second thoughts. Exchange takes precedence and financial data is clearly written to be blocked.

upvoted 2 times

...

RazielLycas

2 years, 9 months ago

Both blocked with tips "Message blocked" due the first rule, the provided solution doesn't met the exibit

upvoted 3 times

Durden871

2 years, 9 months ago

I'm not the best resource for this, but the explanation makes sense (though the answers appear to be swapped), Exchange rules take precedence over Security and compliance. It will see that it has health information and send email out, notifying the user that health information is recorded.

upvoted 1 times

...

Iamrandom

2 years, 10 months ago

Exchange DLP rules always take precedence over unified DLP rules when it comes to processing email. This is natural because the Microsoft designed Exchange rule set to process email. However, it also means that a unified DLP rule will never scan messages blocked by an Exchange DLP rule. so both answer is "BLOCKED mail with Message Blocked text"

upvoted 2 times

...

Wearsy

3 years, 4 months ago

Exchange policy tips will take precedence https://docs.microsoft.com/en-us/microsoft-365/compliance/how-dlp-works-between-admin-centers?view=o365-worldwide Both blocked & message blocked imo

upvoted 7 times

...

NikPat3125

3 years, 9 months ago

Came in exam 27.07.2021

upvoted 7 times

...

Jake1

3 years, 11 months ago

Both Blocked with message "Blocked." Explanation giving by PersonT is correct.

upvoted 9 times

...

Prianishnikov

4 years ago

Ok, so what is the correct answers?

upvoted 1 times

PersonT

4 years ago

Both blocked, message blocked Because Exchange blocked the message: security center won’t scan the message

upvoted 36 times

Prianishnikov

4 years ago

Thanks you ^)

upvoted 1 times

...

JFRigot

4 years ago

rules created in the Exchange admin center take precedence. So they should be both blocked

upvoted 5 times

...

PersonT

4 years ago

other way around..

upvoted 1 times

PersonT

4 years ago

Not. If you've created DLP policies in the Exchange admin center, those policies will continue to work side by side with any policies for email that you create in the Security & Compliance Center. But note that rules created in the Exchange admin center take precedence. All Exchange mail flow rules are processed first, and then the DLP rules from the Security & Compliance Center are processed. This means that: Messages that are blocked by Exchange mail flow rules won't get scanned by DLP rules created in the Security & Compliance Center. Blocked, message blocked.

upvoted 9 times

BluMoon

3 years, 7 months ago

So, according to this page. Both should be blocked with the tip message blocked. Why the other answer? https://docs.microsoft.com/en-us/microsoft-365/compliance/how-dlp-works-between-admin-centers?view=o365-worldwide#:~:text=All%20Exchange%20mail%20flow%20rules,in%20the%20Security%20%26%20Compliance%20Center.

upvoted 1 times

...

Exam MS-101 All Questions

View all questions & answers for the MS-101 exam

Exam MS-101 topic 3 question 54 discussion

Comments

MrDre

Thespy45

Durden871

Kittu

JPO2021

jonny_sins

jonny_sins

Meebler

ilma_nl

Contactfornitish

RazielLycas

Durden871

Iamrandom

Wearsy

NikPat3125

Jake1

Prianishnikov

PersonT

Prianishnikov

JFRigot

PersonT

PersonT

BluMoon

SY0-701