SC-100 Certification Practice Question #210

Question

You have a Microsoft 365 tenant that uses Microsoft SharePoint Online and Microsoft Purview. Microsoft Purview has a sensitivity

label named Label1 that is applied to the files stored on SharePoint Online sites.

You need to recommend a Microsoft Purview Data Loss Prevention (DLP) policy that meets the following requirements:

•	Prevents users from uploading the files to third-party external websites
•	Allows users to upload the files to Microsoft OneDrive for Business

To which location should you apply the DLP policy?

Accepted Answer

The question asks specifically for the **Microsoft Purview DLP policy location** that can *prevent uploads to third-party external websites while still allowing uploads to OneDrive for Business*. Endpoint (Devices) DLP is the only DLP location that monitors and controls browser/upload activity on the endpoint: its "Upload to a restricted cloud service domain or access from an unallowed browser" action lets you block uploads to unsanctioned domains while allow-listing trusted corporate destinations like OneDrive. The OneDrive accounts (B) and SharePoint sites (C) locations only evaluate content stored at rest within those services — they cannot govern a browser upload to an external website. Microsoft Defender for Cloud Apps (D) can session-control cloud apps, but it is *not* a location available when configuring a Purview DLP policy (the only DLP locations are Exchange, SharePoint, OneDrive, Teams, Devices, plus on-prem/Fabric/cloud-app connectors), so it cannot be the answer to "to which location should you apply the DLP policy." Suggested Answer, the leading community vote, and several well-reasoned comments align with MS Learn on A; confidence is 84 (not higher) because a sizeable minority pushed D, but that view confuses MDCA session policies with DLP policy locations.

More SC-100 practice questions