Encrypting Emails with Azure Storage Keys via DLP
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You recently discovered that the developers at your company emailed Azure Storage Account keys in plain text to third parties. You need to ensure that when Azure Storage Account keys are emailed, the emails are encrypted. Solution: You create a data loss prevention (DLP) policy that has Exchange email, SharePoint sites, OneDrive accounts, and Teams chat and channel messages selected. Does this meet the goal?
Community Insight
The core trap is assuming that creating a DLP policy automatically encrypts content. The key insight is that DLP requires explicit rule actions, such as applying Message Encryption, which is distinct from simply detecting sensitive information.
This question evaluates the ability to configure Data Loss Prevention (DLP) policies in Microsoft Purview. It clarifies that selecting workloads alone is insufficient; specific actions like encryption must be defined.
Most learners incorrectly select 'Yes' because they believe that once a DLP policy is created and locations are selected, the system will automatically handle encryption. They fail to realize that detection conditions and remediation actions are separate configuration steps.
Community Discussion (7 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The solution fails to meet the goal because it only specifies the locations (Exchange, SharePoint, OneDrive, Teams) but does not define the necessary DLP rule actions. A DLP policy consists of conditions (what to detect) and actions (what to do). To encrypt emails containing Azure Storage Account keys, you must explicitly configure an action like "Apply Microsoft Purview Message Encryption" or use a mail flow rule. Without this action, the policy might only log or block the data, but it will not encrypt it.Why the Other Options Are Wrong
Option A is incorrect because a DLP policy without an encryption action cannot fulfill the requirement of encrypting emails. While DLP can block or restrict access, encryption is a specific feature that must be enabled. The comments highlight that "DLP policy alone does not enforce e-mail encryption" and that you need OME or a Mail flow Rule.Community Comment Notes
Community consensus strongly supports Option B. Users note that "When Exchange email... is selected you don't have an action to encrypt." Another user points out that "A DLP rule needs a condition to detect the keys and an action to encrypt the email, and the solution supplies neither." This confirms that the missing component is the explicit encryption action within the DLP rule configuration.Exam Strategy
Always verify if a solution includes both the detection condition and the remediation action. In DLP questions, simply listing workloads is rarely enough; look for specific actions like 'Block', 'Encrypt', or 'Require Approval'. If the action isn't mentioned, the solution is likely incomplete.
Frequently Asked Questions
Can DLP automatically encrypt emails without extra configuration?
No. DLP detects sensitive info but requires explicit actions like 'Apply Message Encryption' or integration with OME to encrypt content.
What is the difference between DLP and Mail Flow Rules?
DLP focuses on content detection and policy enforcement across M365 apps. Mail Flow Rules (Transport Rules) operate at the SMTP level and can also apply encryption or modifications to messages.