Which Components Require Approval for Emails with Two Customer Identifiers?
You have a Microsoft 365 tenant. You have a database that stores customer details. Each customer has a unique 13-digit identifier that consists of a fixed pattern of numbers and letters. You need to implement a data loss prevention (DLP) solution that meets the following requirements: • Email messages that contain a single customer identifier can be sent outside your company. • Email messages that contain two or more customer identifiers must be approved by the company's data privacy team. Which two components should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
Community Votes
67% of anonymous learners picked answer CD. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests instance-count DLP for outbound email; the common trap is selecting a mail flow rule because Exchange transport rules can also match sensitive information types.
Microsoft 365 DLP can use a custom sensitive information type to detect a 13-digit customer identifier and a DLP policy with an instance-count condition to allow one identifier but require approval for two or more. The correct components are a DLP policy (C) and a sensitive information type (D).
The most common wrong answer is a mail flow rule (A) instead of a DLP policy (C), because candidates remember that transport rules can inspect sensitive information types but overlook that the scenario asks for a DLP solution with a two-or-more approval threshold.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A sensitive information type (D) is mandatory because the customer identifier is a custom 13-digit pattern that Microsoft 365 does not know out of the box; the SIT defines the regex or function that recognizes that fixed format. A DLP policy (C) is then the enforcement component: in Microsoft Purview, DLP rules can test for that SIT and use an instance-count condition of 2 or more, while the action can forward the message for approval to the data privacy team. This combination exactly implements the stated logic: one identifier does not match the rule, so the email can leave; two or more identifiers match and trigger the approval workflow. No other option provides both the custom detection logic and the instance-count-based approval action.Why the Other Options Are Wrong
A mail flow rule (A) is the main distractor because Exchange transport rules historically supported sensitive information rules within the mail flow framework. However, the question asks for a DLP solution, and the unified Microsoft Purview DLP policy natively supports instance-count thresholds and approval routing; adding a separate mail flow rule is unnecessary and reflects the deprecated Exchange-only approach. A retention label (B) is about retaining or deleting content, not about inspecting outbound email or obtaining approval. A sensitivity label (E) classifies and protects content with encryption or other controls, but it does not count 13-digit identifier instances or route a message for approval.Community Comment Notes
Belyo captures the core doubt: "DLP & SIT not sure how can you configure mailflow rule to match this kind of requirement". Boeroe explains the exact mechanism, noting that a DLP rule with an SIT can be set to an instance count of 2 and forward the message for approval; when the count is 0 or 1, the rule is not hit. Ruslan23 argues for AD by citing sensitive information rules within the mail flow rule framework, but that older transport-rule integration is not the same as building a unified DLP policy. Dools points out that Exchange DLP policies are being deprecated and should be C and D, which aligns with the modern SC-400 Purview DLP design.Official Reference
Exam Strategy
In SC-400, map email approval requirements to Microsoft Purview DLP rules rather than legacy Exchange transport rules. Remember that a DLP policy supplies the condition/action logic, while a sensitive information type supplies the custom pattern matching.
Frequently Asked Questions
Why is a mail flow rule not the best choice for the 13-digit customer identifier DLP requirement?
A mail flow rule can inspect sensitive information types, but unified DLP policy natively supports instance-count conditions and approval routing without a separate transport rule.
How does the DLP policy ignore emails with only one customer identifier?
The DLP rule uses the sensitive information type with a minimum instance count of 2, so a single 13-digit identifier does not trigger the approval action.