HOTSPOT -
You have a Microsoft 365 E5 subscription that contains a Microsoft SharePoint site named Site1 and a data loss prevention (DLP) policy named DLP1. DLP1 contains the rules shown in the following table.
Site1 contains the files shown in the following table.
Which policy tips are shown for each file? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
File1.docx:rule2 only. And File2.docx:rule4 only. When content is evaluated against rules, the rules are processed in priority order. If content matches multiple rules, the first rule evaluated that has the most restrictive action is enforced. For example, if content matches all of the following rules, Rule 3 is enforced because it's the highest priority, most restrictive rule: https://learn.microsoft.com/en-us/purview/dlp-policy-reference
why not File1.docx:rule3 only. rule 3 is most restrictive than rule 2, no ?
rule 3 enables user over rides while rule 2 disables them there for more restrictive .
This is correct . I looked at the doc 'When content is evaluated against rules, the rules are processed in priority order. If content matches multiple rules, the first rule evaluated that has the most restrictive action is enforced. For example, if content matches all of the following rules, Rule 3 is enforced because it's the highest priority, most restrictive rule: Rule 1: only notifies users Rule 2: notifies users, restricts access, and allows user overrides Rule 3: notifies users, restricts access, and doesn't allow user overrides Rule 4: restricts access Rules 1, 2, and 4 would be evaluated, but not applied. In this example, matches for all of the rules are recorded in the audit logs and shown in the DLP reports, even though only the most restrictive rule is applied." so I dont know how they rule 1 for both
Agree with Hoge, specific reference in the doc: https://learn.microsoft.com/en-us/purview/dlp-policy-reference#the-priority-by-which-rules-are-evaluated-and-applied
Rule 1 for both, when multiple rules matches, the rule with the higher priority is enabled.
Great catch Hoge3x, but the very next paragraph states" Rules 1, 2, and 4 would be evaluated, but not applied. In this example, matches for all of the rules are recorded in the audit logs and shown in the DLP reports, even though only the most restrictive rule is applied." So reading the question again "Which tips are SHOWN", I believe its all for each. File1 rule 1,2 and 3. File 2 rule 1,3 and 4
When content is evaluated against rules, the rules are processed in priority order. If content matches multiple rules, the first rule evaluated that has the most restrictive action is enforced. For example, if content matches all of the following rules, Rule 3 is enforced because it's the highest priority, most restrictive rule: Rule 1: only notifies users Rule 2: notifies users, restricts access, and allows user overrides Rule 3: notifies users, restricts access, and doesn't allow user overrides Rule 4: restricts access
Hoge is correct. "Only the policy tip from the highest priority, most restrictive rule will be shown. For example, a policy tip from a rule that blocks access to content will be shown over a policy tip from a rule that simply sends a notification. This prevents people from seeing a cascade of policy tips."
Rule 1 Tip Only" for both
Tips follow rules applied and are not cumulative as that would be confusing. DLP rules are applied as one with most restrictive actions over priority unless the policies are the actions are the same in terms of restrictions. File 1 : Rule 2 only, File 2 : Rule 4 only
Correction, Rule 2 then Rule 4 as each is the Most Restrictive.
Confusing, now thinking Rule 2, then Rule 3. It's possible for content to match several rules in a DLP policy or several different DLP policies, but only the policy tip from the most restrictive, highest-priority rule will be shown (including policies in Test mode). For example, a policy tip from a rule that blocks access to content will be shown over a policy tip from a rule that simply sends a notification. https://learn.microsoft.com/en-us/purview/use-notifications-and-policy-tips
As its not asking which rules are applied, but which rules are Shown.
Agree with hoge