MS-102 Exam - Question 212

Question

HOTSPOT-You have a Microsoft 365 E5 subscription that contains two users named [email protected] and [email protected] and a Microsoft SharePoint site named Site1. You create a data loss prevention (DLP) policy named DLP1 that has the advanced DLP rules shown in the following table. DLP1 is applied to Site1. You have the files shown in the following table. You copy the files to Site1. How many notifications will each user receive? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Examice · Accepted Answer

.

MvdSpoel · Answer

txt file is in scope don't get confused with sentitifity label see https://learn.microsoft.com/en-gb/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments

Answer is 4 and 0

TonyManero · Answer

The explanation is:
When content is evaluated against rules, the rules are processed in priority order. If content matches multiple rules, the first rule evaluated that has the most restrictive action is enforced. For example, if content matches all of the following rules, Rule 3 is enforced because it's the highest priority, most restrictive rule:

Rule 1: only notifies users
    Rule 2: notifies users, restricts access, and allows user overrides
    Rule 3: notifies users, restricts access, and doesn't allow user overrides
    Rule 4: restricts access

Rules 1, 2, and 4 would be evaluated, but not applied. In this example, matches for all of the rules are recorded in the audit logs and shown in the DLP reports, even though only the most restrictive rule is applied.

So because the most restrictive rule, I think :
User1--> 4
User2--> 3

Paul_white · Answer

PERSONALLY I WILL GOT WITH USER1 = 3, AND USER 2 = 0. THE RANKING SAYS IT ALL

https://www.examtopics.com/discussions/microsoft/view/67917-exam-ms-101-topic-3-question-107-discussion/

northgaterebel · Answer

User1 = 4. All file types are now supported. https://learn.microsoft.com/en-us/purview/endpoint-dlp-learn-about#files-monitored-via-policy
User2 = 0. Agree with Paul_white about the ranking.

cpaljchc4 · Answer

Rule priority order When an item matches multiple rules in a policy and those rules have identical actions, the actions from the highest priority rule is applied.
According to the rule priority , I think User 1 - 4 , User 2 - 0 should be right?
Ref: https://learn.microsoft.com/en-us/purview/dlp-policy-reference

angra01 · Answer

so basically no one knows !!

DiligentSam · Answer

i think 
user 1 receive 3 notification
Use2 receive 3 notification

faeem · Answer

For user2, there are 3 files with 3 or more IP's. Why would user2 not receive 3 notifications?

Amir1909 · Answer

- 2
- 1

BlackCat9588 · Answer

It should be 3 & 0 ?

Greatone1 · Answer

5 and 2 from ms 101
Reference:
https://docs.microsoft.com/en-gb/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments

sergioandreslq · Answer

I tested it in my tenant demo,
Box 1: I got 15 notifications to user1 mailbox, the answer is not there
Box 2: I got 8 notifications to user2 mailbox, I got with 8.
Why this is happening, No idea, this question was difficult to answer, that is why I created the DLP to see the results but, unfortunately, it is not clear.

Sorry team, I will just choose this one to 8-8 but in this case, it is guessing because I believe even Microsoft doesn't know.

Tomtom11 · Answer

https://learn.microsoft.com/en-us/purview/dlp-policy-reference

Tomtom11 · Answer

https://learn.microsoft.com/en-us/purview/dlp-policy-reference

nicvig01 · Answer

- 4
- 0

Murad01 · Answer

I would go for:

User1: 4 
User2: 0

MS-102 Exam - Question 212

Discussion