Which DLP Policy Tip Appears for File2 in SharePoint Online?

SC-401 By islever Editorial Last updated

Create and configure data loss prevention policies

Short answer

A Only Tip1 is displayed for File2, because Microsoft Purview shows the policy tip from the highest-priority DLP rule that matches.

Question

You have a Microsoft SharePoint Online site named Site1 that contains the files shown in the following table.
Exhibit: Which DLP Policy Tip Appears for File2 in SharePoint Online?
You have a data loss prevention (DLP) policy named DLP1 that has the advanced DLP rules shown in the following table.
Exhibit: Which DLP Policy Tip Appears for File2 in SharePoint Online?
You apply DLP1 to Site1.
Which policy tips will appear for File2?
  1. Tip1 only Correct Answer
  2. Tip2 only
  3. Tip3 only
  4. Tip1 and Tip2 only

Key Takeaways

This question tests whether you know that DLP shows only one policy tip per item; the trap is treating every matching rule as a separate visible tip.

Microsoft Purview DLP policy tips are governed by rule priority: even when File2 matches both IP-address rules, only the tip from the highest-priority matching rule is displayed. This page establishes that Tip1, not Tip1 and Tip2, appears for File2.

Common mistake: Selecting Tip1 and Tip2 only because File2 meets both Rule1 and Rule2 thresholds; matching multiple rules does not cause multiple policy tips to be shown.

Expert Analysis

Why the Answer Is Correct

File2 contains three IP addresses, so it satisfies Rule1's at-least-one-IP condition and Rule2's at-least-three-IP condition. In Microsoft Purview DLP, when an item matches multiple rules that each have a policy tip, the user does not get a tip for every matching rule; only the policy tip for the highest-priority matching rule is displayed. Because Rule1 has the lower priority number (priority 0) and therefore outranks Rule2, Tip1 is the tip shown for File2. Rule3's higher threshold is not met by File2, and it is lower priority anyway. The decisive point is tip display, not merely which conditions evaluate to true.

Why the Other Options Are Wrong

B is wrong because Tip2 belongs to Rule2, which is lower priority than Rule1; even if Rule2 is evaluated and matches, it does not replace Rule1's tip. C is wrong because File2 does not reach Rule3's condition and Rule3 is lower priority. D is the trap: File2 does match Rule1 and Rule2, but Purview shows only one policy tip per item, so Tip1 and Tip2 are not both displayed. The correctness of D would require a product behavior where every matching rule contributes a visible tip, which is contrary to the policy-tip note in the Purview documentation.

Community Comment Notes

underscore1234 gives the practical Purview-engineer explanation: "Only a single policy tip can be shown", with the highest-priority matching rule winning. kollyp2000 cites the related rule behavior that "actions from the highest priority rule are applied", which reinforces why Rule1's Tip1 wins. skalolaz and Eltooth focus on the fact that Rule1 and Rule2 both match File2's IP count, but matching two rules does not mean two tips appear. PAPAKIA correctly states that "Rules are evaluated by priority order (lowest number first)." but then assumes both matching tips would be shown, which is where that reasoning departs from the documented policy-tip display behavior. Scrambles points readers to the Note section of Microsoft's policy reference, which is the key documentation behavior.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Read the rule priority column before comparing which conditions match. When several DLP rules match, ask which policy tip Purview surfaces (the highest-priority matching rule), not how many rules evaluated to true; check Stop processing separately because it affects enforcement, not the one-tip display rule.

Frequently Asked Questions

Why does File2 show Tip1 only when Rule2’s IP address threshold is also met?

File2 matches both Rule1 and Rule2, but Purview displays only one policy tip: the tip from the highest-priority matching rule, Rule1.

Does “Stop processing” explain why only one policy tip appears?

No. The single-tip result comes from DLP policy-tip display behavior; Stop processing only controls whether later rules are evaluated for enforcement.

More SC-401 FAQ →

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. skalolaz 👍 7 Answered D
    Rules 1 and 2 match the number of IP addresses.
  2. underscore1234 👍 5 Answered A
    Purview Engineer here. Only a single policy tip can be shown, both Rule 1 and 2 match the same file, the one with highest priority + most restrictive is shown, in this case only Tip 1 will be shown.
  3. Scuzlebutt 👍 4 Answered A
    Looks like the highest priority or most restrictive policy tip is shown according to this https://learn.microsoft.com/en-us/purview/dlp-policy-reference#actions
  4. Eltooth 👍 3 Answered D
    D is correct answer: Tip1 and Tip2 and Rule 1 has 0 priority, which is highest/first, then rule 2 stops processing.
  5. Caezarlay 👍 3 Answered D
    D. Tip1 and Tip2 only Both rules match and both tips will be shown since processing continues through all rules.
Show 5 more comments
  1. PAPAKIA 👍 2 Answered D
    Important: How DLP Rule Processing Works Rules are evaluated by priority order (lowest number first). If a rule has Stop processing = Yes, no further rules are evaluated after it matches. So evaluation order is: Rule1 (Priority 0) Rule2 (Priority 1) Rule3 (Priority 2) Evaluate File2 (3 IP addresses) ✅ Rule1 (≥1 IP) Matches Tip1 applies Stop processing? No → Continue ✅ Rule2 (≥3 IP) Matches Tip2 applies Stop processing? Yes → Processing stops here 🚫 Rule3 Would match (≥2 IP) BUT never evaluated because Rule2 stopped processing ✅ Final Answer: D. Tip1 and Tip2 only
  2. iNazz 👍 2 Answered B
    B, Tip 2 only, only one policy tip can be shown, even tho all three tips match, DLP stops processing once rule 2 is matched, leaving only rule 1 and rule 2 to match, but as only one policy can be shown rule 2 will be as its higher impact
  3. Scrambles 👍 2
    Correct. This is spelled out in the Note section of Microsoft documentation: https://learn.microsoft.com/en-us/purview/dlp-policy-reference#policy-tips-and-user-notifications-configuration-options
  4. kollyp2000 👍 1 Answered A
    When an item matches multiple rules in a policy and those rules have identical actions, the actions from the highest priority rule are applied.” Source: Data Loss Prevention policy reference, https://learn.microsoft.com/purview/dlp-policy-reference#rules
  5. Jideakin 👍 1
    DLP doesn't apply two rules at the same time, hence will never show two policy tips. It uses priority and restrictiveness to determine which rule to apply and whichever rule gets applied, that's the one whose tips would be shown. Tip1 in this case

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Sensitivity Labels to Restrict Microsoft 365 Copilot Access

S-grade

Microsoft Purview Retention Policy Conflict Resolution

S-grade

Maximum Primary Elements in Microsoft Purview EDM Classifier

S-grade

Encrypting Emails with Azure Storage Keys via DLP

S-grade

← Back to SC-401 Study Guide