SC-200 Certification Practice Question #23

Question

You have a Microsoft 365 subscription. The subscription uses Microsoft 365 Defender and has data loss prevention (DLP) policies that have aggregated alerts configured.

You need to identify the impacted entities in an aggregated alert.

What should you review in the DLP alert management dashboard of the Microsoft 365 compliance center?

Accepted Answer

An aggregated alert bundles many events, and the impacted entities (files, users, locations per occurrence) are enumerated on the Events tab, where each event can be opened for entity-level detail. MS Learn explicitly contrasts the Details tab (high-level alert summary) with the Events tab (per-event detail including affected items), matching the 26-👍 top comment and the 58-vote majority. Confidence is 84 rather than 90 because there is a real, repeated community split toward D — the newer Purview UI surfaces an "Impacted entities" field inside an event's Details panel, which several testers reached via the Events tab, so D is a defensible misread. The weight of Suggested Answer + dominant Most Voted + MS Learn keeps A as the answer.

More SC-200 practice questions