Question

Contoso's compliance team created an Endpoint DLP policy that blocks copying files containing credit card numbers to USB removable storage. Before enforcing the block, security leadership wants to understand how often this activity currently occurs across onboarded Windows devices, without disrupting any user's work. Which configuration should you apply to the policy?

Accepted Answer

Set the policy mode to 'Test it out (audit)' and review matches in Activity explorer before switching to enforcement

Answer

Set the rule action to 'Block' but enable the 'Allow overrides' option so users can bypass with a business justification

Answer

Set the rule action to 'Block' and disable user notifications so users are unaware of the restriction

Answer

Turn the policy off and instead create a retention label to track credit card content on endpoints