Microsoft Certified: Information Security Administrator Associate SC-401 Reddit Questions

EDM does not store raw data; instead, it requires hashed versions of sensitive data for privacy and security. To upload the hashed data, Microsoft provides the EDM upload agent. This ensures that the data is securely processed and recognized by the EDM service in Microsoft 365.

Adding a folder path to the file path exclusions in Microsoft 365 Endpoint DLP does not prevent Tailspin_scanner.exe from accessing protected sensitive information. Instead, it would exclude those files from DLP protection, which is not the intended outcome.

To block Tailspin_scanner.exe from accessing sensitive documents while allowing it to access other files, the correct solution is to use Microsoft Purview Endpoint Data Loss Prevention (Endpoint DLP) and add Tailspin_scanner.exe to the Restricted Apps list.

Endpoint DLP allows you to block specific applications from accessing sensitive files while keeping general access available. Restricted Apps List in Endpoint DLP ensures that Tailspin_scanner.exe cannot open, copy, or process protected documents, but it can still function normally for non-sensitive content.

You need to prevent users from sharing sensitive information with third-party generative AI websites.

A. Information Protection → Classifies and labels data but does not block sharing with external AI sites.

B. Information Barriers → Restricts communication between groups of users (e.g., compliance walls), not web uploads.

C. Insider Risk Management → Detects risky behavior (like data exfiltration), but does not actively block data sharing.

D. Data Loss Prevention (DLP) → Detects and prevents sensitive data being copied to browsers, USBs, or uploaded to restricted domains (like ChatGPT, Bard, etc.).

Create one service domain group (Allow list) containing Site1 and Site2 and configure the policy action “Allow upload only to sensitive service domains”.

Create a second service domain group (Block list) containing Search1 and Search2 and configure the policy action to block paste (clipboard) to these domains.

A single Endpoint DLP policy can enforce multiple activities (upload to cloud service domains + clipboard to specific domains), so only one policy is required.

Refs: Microsoft Learn – Endpoint DLP: Configure service domains and policy actions (upload/clipboard restrictions) (Purview > Data loss prevention > Endpoint DLP settings and policies).