Microsoft 365 Certified: Administrator ExpertImplement and manage Microsoft Defender XDRMedium
A company is implementing Microsoft Defender for Office 365. They frequently exchange sensitive information via email with external partners. The security team wants to ensure that any email containing specific keywords (e.g., 'Confidential Project X') or classified as 'Highly Confidential' by a sensitivity label is automatically quarantined if sent outside the organization. Which Defender for Office 365 policy should the administrator configure to meet this requirement?
- AData Loss Prevention (DLP) policy
- BAnti-phishing policy
- CSafe Attachments policy
- DAnti-spam policy
Show answer & explanationAnswer & explanation
Correct answer: A. Data Loss Prevention (DLP) policy
Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including preventing its unauthorized sharing outside the organization based on content, keywords, or sensitivity labels.
Why the other options are wrong
- B. Anti-phishing policies protect against phishing attempts, not against legitimate sensitive data being intentionally or accidentally sent out.
- C. Safe Attachments policies detonate attachments in a sandbox to protect against malware, not to prevent sensitive data leakage.
- D. Anti-spam policies detect and block unwanted bulk email, not sensitive data egress.
Defender for Office 365 DLP
Data Loss Prevention (DLP) policies in Microsoft Defender for Office 365 help prevent sensitive information from leaving the organization by identifying, monitoring, and automatically protecting sensitive data across emails, documents, and other services.
- Identifies sensitive information types (SITs).
- Uses keywords, regular expressions, and sensitivity labels.
- Can block, quarantine, or notify based on policy matches.
Memory trick: Office 365 needs varied defenses: phish, spam, bad files, and data leaks.