Endpoint DLP Service Domains for Two Contoso Sites
You have a Microsoft 365 E5 subscription. You need to prevent users from uploading data loss prevention (DLP)-protected documents to the following third-party websites: web1.contoso.com web2.contoso.com The solution must minimize administrative effort. To what should you set the Service domains setting for Endpoint DLP?
Community Insight
The question tests exact service-domain targeting versus wildcard convenience; the trap is assuming a partial wildcard such as web*.contoso.com is accepted by Endpoint DLP.
This SC-401 scenario tests how Endpoint DLP service domains are scoped for two specific contoso.com upload sites. The answer is C: list web1.contoso.com and web2.contoso.com explicitly, because a broad .contoso.com wildcard would over-block and web.contoso.com is not a supported domain pattern.
The most common wrong answer is A (*.contoso.com), because it looks like a single-entry, low-effort wildcard, but it also blocks every other contoso.com subdomain and can create later cleanup effort.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C sets the Endpoint DLP Service domains list to exactly web1.contoso.com and web2.contoso.com, which matches the two named upload destinations while preserving other contoso.com subdomains. Endpoint DLP service domains are matched as domain entries, so C is the only option that blocks DLP-protected document uploads to those two third-party sites without over-scoping. Adding two explicit entries is still a small, one-time administrative action and avoids later remediation if another contoso.com subdomain must remain reachable. The minimize-administrative-effort requirement is satisfied by the precise list rather than by a broader rule that would need exceptions.
Why the Other Options Are Wrong
Option A (.contoso.com) matches web1 and web2 but also every other subdomain under contoso.com, which goes beyond the stated third-party sites and can create more administrative effort to exempt legitimate services. Option B (contoso.com) is the parent domain and does not reliably match the two subdomains, so uploads to web1.contoso.com or web2.contoso.com could remain allowed. Option D (web.contoso.com) requires a partial-label wildcard; Endpoint DLP's service-domain entry does not accept that pattern, as PsiCzar observed when the value would not persist after saving. Without a supported partial wildcard, C is the only valid exact configuration.
Community Comment Notes
The community mostly converged on C for the same scoping reason: as 4d76265 noted, .contoso.com is possible but would block more than intended, and 58d4802 emphasized that C targets exactly the two mentioned websites and nothing else. PsiCzar's testing point is the key technical evidence against D: web.contoso.com could be typed but did not remain in the service-domain list after saving. kollyp2000 argued for A on the theory that the question does not say only those two sites, but that reading ignores the over-blocking risk and the fact that C is still a very small administrative task. Eltooth and papillor likewise favored C because it avoids wildcard child-domain overreach.
Official Reference
Exam Strategy
Eliminate unsupported wildcard forms first, then compare the remaining exact and broad domain entries against the stated sites; broad matching is not minimal if it forces later exceptions. In Endpoint DLP questions, prefer the narrowest service-domain list that still covers every named destination.
Frequently Asked Questions
Why isn't *.contoso.com the best choice for Endpoint DLP service domains?
It covers web1 and web2 but also every other contoso.com subdomain, so it over-blocks and may require later cleanup if other sites must stay reachable.
Can web*.contoso.com be used in the Endpoint DLP service domains list?
No. Microsoft Purview's service-domain entry does not accept a partial-label wildcard in that position, so the pattern will not persist as a valid entry.