SC-401 · Question #167
You create a data loss prevention (DLP) policy. The Advanced DLP rules page is shown in the Rules exhibit. (Click the Rules tab) The Review your settings page is shown in the Review exhibit. (Click…
The correct answer is A. Exit the policy, and then select I'd like to test it out first. Exiting the policy wizard and selecting 'I'd like to test it out first' places the DLP policy in simulation (test) mode. In this mode, the policy evaluates content and generates alerts in the DLP Activity Explorer without enforcing any blocking or restrictive actions. This…
Question
You create a data loss prevention (DLP) policy. The Advanced DLP rules page is shown in the Rules exhibit. (Click the Rules tab) The Review your settings page is shown in the Review exhibit. (Click the Review tab.) You need to review the potential impact of enabling the policy without applying the actions. What should you do?
Exhibits
Options
- AExit the policy, and then select I'd like to test it out first.
- BEdit the policy, remove all the actions in DLP rule 1, and select I'd like to test it out first.
- CEdit the policy, remove the Restrict access to the content and Send incident report to
- DEdit the policy, remove all the actions in DLP rule 1, and select Yes, turn it on right away.
How the community answered
(24 responses)- A92% (22)
- B4% (1)
- D4% (1)
Explanation
Exiting the policy wizard and selecting 'I'd like to test it out first' places the DLP policy in simulation (test) mode. In this mode, the policy evaluates content and generates alerts in the DLP Activity Explorer without enforcing any blocking or restrictive actions. This allows administrators to review the policy's potential impact and false positives before enabling full enforcement. Removing actions manually (options B and D) is unnecessary because test mode already suppresses action enforcement.
Topics
Community Discussion
No community discussion yet for this question.