Data Loss Prevention

Question 1

What is the logic in case multiple rules apply?

Answer 1

The order in which they are listed defined the priority order. The lower the number, the higher the priority.

Question 2

What is the logic in case multiple rules are matching?

Answer 2

The first rule with the most restrictive option is applied

Question 3

What are the available options when crating a DLP policy?

Answer 3

(1) Available templates based on the SIT (can use the activity explorer to find which SIT are relevant) or (2) create a custom one

Question 4

What are the limitations of OCR? (3)

Answer 4

Max 20MB for Teams/Exchange. Max 50MB for SP/OD/Enpoints. Images only between 50x50 and 16kx16k

Question 5

Where are DLP policies being applied?

Answer 5

To locations, with the option to include/exclude particular users and groups

Question 6

Which type of groups can be selected as part of the configuration of DLP policy?

Answer 6

Distribution groups, mail-enabled security groups, M365 Groups

Question 7

What are the DLP rule settings? (3)

Answer 7

(1) conditions (2) actions (3) notification (4) user overrides (5) incident report

Question 8

What are possible actions of a DLP rule?

Answer 8

1) Restrict access or encrypt the content in Microsoft 365 locations
2) (Devices only) Audit or restrict activities
3) (Exchange only) Many actions e.g. apply header, forward, add recipient, apply branding

Question 9

Which rule should come last in a policy?

Answer 9

The most restrictive one, to avoid less restrictive rule overriding a stricter one

Question 10

Which functionalities do Advanced DLP rules offer? (5)

Answer 10

(1) Customize the SIT to detect (2) Add exceptions (e.g., in case of many FP) (3) Severity level for incident reports (4) If there is a match for the rues, stop processing additional ones (only for Exchanges) (5) Change order of rules inside a policy

Question 11

Which status can a DLP Alert take? (4)

Answer 11

Active, Investigating, Dismissed and Resolved

Question 12

What does the default DLP policy defines?

Answer 12

It shows a policy tip and sends an email notification to users when they attempt to share outside of the organization (1) credit card number (2) source code (3) content under HIPAA (4) content containing Intellectual Property

Question 13

What is Cloud Access Security Broker (CASB)?

Answer 13

It is a software/hardware acting as an intermediary between users and Cloud service providers. It allows companies to extend the reach of their security policies to the Cloud.

Question 14

What is Microsoft Cloud App Security?

Answer 14

It is Microsoft’s CASB

Question 15

Where can Microsoft Cloud App Security be accessed?

Answer 15

From the Security Portal (Defender)

Question 16

What is PowerPlatform Connector?

Answer 16

A connector is a proxy or a wrapper around an API that allows the underlying service to talk to Microsoft Power Automate, Microsoft Power Apps, and Azure Logic Apps

Question 17

Which OS are supported by Endpoint DLP?

Answer 17

Windows 10 (and later) and macOS

Question 18

Which browser support Endpoint DLP rules for website access?

Answer 18

Edge and Chrome if you have the Purview extension for Chrome

Question 19

What are some Endpoint DLP actions?

Answer 19

Audit and restrict
1) Upoad to cloud service
2) Copy to USB, network share, remote session, bluetooth devide, clipboard
3) Paste to supported browser
4) Print document
5) Access by unallowed browser

Audit only
Create or rename item

Question 20

How can the Purview extension for Chrome be installed (3)?

Answer 20

(1) Group Policy (2) Intune (3) Manually on each machine

Question 21

How can you onboard devices to Endpoint DLP (5)?

Answer 21

(1) Group Policy (2) Endpoint manager (3) VDI (4) Intune (5) Local scripty

Question 22

How can you monitor DLP activity (2)?

Answer 22

(1) Purview > Alerts (2) DLP > Activity Explorer

Question 23

How many days of history does the DLP Activity Explorer contains?

Answer 23

30 days

Question 24

Which events are the DLPRuleMatch paired with?

Answer 24

User activity events

Question 25

Where can you manage DLP alerts?

Answer 25

Purview or Defender (where they are automatically combined into incidents)

Question 26

Where can you create DLP policies for non-Microsoft cloud apps? (3)

Answer 26

1) File policies in Defender for Cloud Apps
2) File policies in Defender
3) DLP policies in Purview, selecting Defender for Cloud Apps as the location

Question 27

What do you need to perform prior to creating file policies in Defender for Cloud Apps?

Answer 27

Activate file monitoring

Question 28

If you create a file policy in Defender for Cloud Apps, where will the alerts appear?

Answer 28

In Defender for Cloud Apps

Question 29

If you create a DLP policy in Purview with Defender for Cloud Apps as a location, where will the alerts appear?

Answer 29

In regular DLP reports