Configure DLP Policy Locations for Multi-Service Coverage
Short answer
B Configure the locations of the DLP policy to include Exchange Online alongside SharePoint.
Question
During testing, you discover that a user can share credit card information with external users by using email. However, the user is prevented from sharing files that contain credit card information by using Microsoft SharePoint.
You need to prevent the user from sharing the credit card information by using email and SharePoint.
What should you configure?
Key Takeaways
The trap is confusing 'conditions' with 'locations'; if a rule works in one place but not another, the issue is almost always missing locations rather than incorrect conditions.
This question tests how to extend a Microsoft 365 DLP policy to cover additional services like email when SharePoint protection is already working. The correct solution involves updating the policy locations.
Common mistake: Choosing 'conditions' is a common error because candidates assume the definition of sensitive info needs changing. However, since it works in SharePoint, the condition is correct; the scope (location) is simply incomplete.
Expert Analysis
The scenario describes a Microsoft 365 Data Loss Prevention (DLP) policy that is functioning correctly for one location (SharePoint) but failing to protect data in another location (email). The core issue is not with the rule's logic or conditions, but with the scope of the locations monitored by the policy.
In DLP architecture, policies are built on three main components: Conditions (what triggers the policy), Actions (what happens when triggered), and Locations (where the policy scans). Since SharePoint is already protected, the conditions defining "credit card information" are valid. The failure in email indicates that the email service (Exchange Online) was not included in the policy's configured locations.
To resolve this, you must modify the locations of the DLP policy to include Exchange Online. This ensures the policy scans both SharePoint and Email stores for the sensitive information defined in the rules.
- Option B (Locations) is correct because adding Exchange Online extends the policy's coverage to the unsecured channel.
- Option A (Overrides) is incorrect as overrides allow users to bypass policies, which contradicts the goal of prevention.
- Option C (Status) is incorrect because the policy is active; it just lacks coverage in specific areas.
- Option D (Conditions) is incorrect because the conditions are already working for SharePoint; they do not need adjustment to apply to email.
Exam Strategy
When troubleshooting DLP policies, isolate the variable. If a rule triggers correctly in Location A but not Location B, check if Location B is included in the policy's 'Locations' list. Do not change conditions unless the rule fails everywhere.
Frequently Asked Questions
What are the three components of an M365 DLP policy?
Can I apply different actions to different locations in one DLP policy?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
s.i.r.24 👍 1 Answered Dconditions of the DLP policy rule :The existing DLP policy already blocks sharing credit card information through SharePoint, so the policy is detecting the sensitive information correctly. The issue is that the policy does not apply to email.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.