Question

Contoso has deployed an Endpoint DLP policy that detects credit card numbers on onboarded Windows devices. Compliance wants that when a user copies a file containing credit card data to a removable USB drive, the action is allowed to complete but a security incident is generated for the compliance team without notifying or interrupting the user. Which combination of rule actions should you configure in the DLP rule?

Accepted Answer

Set the 'Copy to a USB removable device' action to Audit only, and enable 'Send an alert to admins' with no user notification (policy tip).

Answer

Set the 'Copy to a USB removable device' action to Block, and enable a policy tip that notifies the user.

Answer

Set the 'Copy to a USB removable device' action to Block with override, and require a business justification from the user.

Answer

Enable just-in-time protection for removable devices and disable admin alerts.