Free Microsoft 365 Certified: Administrator Expert (MS-102) Sample Questions

Correct answer: A — Remove-MgUser

• A. Correct. Remove-MgUser is the Microsoft Graph PowerShell cmdlet used to permanently delete a user object from the directory. It can be used in a script to delete multiple users from a CSV file.
• B. Incorrect. Delete-MgUser is not a valid cmdlet in Microsoft Graph PowerShell. The correct cmdlet for deleting a user is Remove-MgUser.
• C. Incorrect. Disable-MgUser is used to disable a user account, preventing sign-in, but it does not remove the user object from the tenant. The account remains and can be re-enabled.
• D. Incorrect. Set-MgUser -AccountEnabled $false disables the user account but does not delete it. The user object persists in Microsoft 365, so this does not meet the requirement to remove users.

Correct answer: C — It automatically assigns licenses to members of the group and removes licenses when members leave.

• A. Incorrect. Group-based licensing in Microsoft Entra ID requires Microsoft Entra ID Premium P1, not Premium P2. It is also available with certain Microsoft 365 licenses.
• B. Incorrect. Group-based licensing works with both security groups and Microsoft 365 Groups. It is not limited to security groups only.
• C. Correct. Group-based licensing automatically assigns licenses to users who are members of the licensed group. When users leave the group, the associated licenses are removed if they are not assigned by another method.
• D. Incorrect. Group-based licensing supports both user-based and device-based license assignment. It is not limited to user-based assignment only.

Correct answer: C — ObjectId

• A. Incorrect. DisplayName is the friendly name shown to users, but it is not guaranteed to be unique. Multiple users can share the same display name across Microsoft 365 services.
• B. Incorrect. UserPrincipalName (UPN) is the primary sign-in name and is intended to be unique within a tenant, but it can be changed and is not immutable. It is commonly used for user identification but is not the definitive unique identifier across all services.
• C. Correct. ObjectId is a unique and immutable identifier assigned to each user object in Microsoft Entra ID. It is used internally across Microsoft 365 services to uniquely identify a user, regardless of changes to other attributes like UPN or DisplayName.
• D. Incorrect. MailNickname is the alias part of an email address and is not guaranteed to be unique across the tenant. It is used for mail-related naming, not as the primary unique user identifier.

Correct answer: B — To view real-time and historical health status of Microsoft 365 services and any active incidents or advisories.

• A. Incorrect. The Service Health dashboard is not used to monitor on-premises servers. It focuses on Microsoft 365 cloud service status, incidents, and advisories rather than local infrastructure.
• B. Correct. The Service Health dashboard provides real-time and historical health status of Microsoft 365 services. It shows active incidents, advisories, and service degradation details, helping administrators stay informed about the status of their services.
• C. Incorrect. While the Service Health dashboard can help identify service issues affecting users, it does not track user-specific issues or generate support tickets automatically. That functionality is handled through support workflows, not Service Health itself.
• D. Incorrect. Third-party application health is not the purpose of the Microsoft 365 Service Health dashboard. It is specifically designed to report on Microsoft 365 service availability and incidents.

Correct answer: C — Microsoft 365 network insights

• A. Incorrect. There is no specific tool called 'Network connectivity insights' in the Microsoft 365 admin center. The correct tool for network connectivity insights is Microsoft 365 network insights.
• B. Incorrect. The Service Health dashboard monitors the health of Microsoft 365 services, such as incidents and advisories, but does not provide detailed network connectivity insights between your organization's locations and Microsoft's network.
• C. Correct. Microsoft 365 network insights is a tool within the Microsoft 365 admin center that provides detailed visibility into network connectivity and performance between your organization's locations and Microsoft's network, including recommendations for improvement.
• D. Incorrect. Azure Network Watcher is an Azure networking monitoring and diagnostics tool, not a feature of the Microsoft 365 admin center. It is used for virtual network analysis in Azure, not for Microsoft 365 tenant network connectivity insights.

Correct answers: A, B, C — Organization information (name, address, phone); Privacy contact; Data location

• A. Correct. Organization information includes the primary contact details such as name, address, and phone number, which are essential for setting up the tenant's organization profile.
• B. Correct. A privacy contact is required for compliance and privacy-related communications, and can be designated in the organization profile settings.
• C. Correct. Data location specifies where core Microsoft 365 services store and process data, which is important for data residency and compliance.
• D. Incorrect. Technical contact is not one of the settings required for primary contact information, data location, or privacy contact. It is a separate setting not directly related to the requirements.
• E. Incorrect. Preferred data location for users is a per-user setting for data residency, not the core organization-level data location setting needed for the tenant profile.
• F. Incorrect. Release preferences control how feature updates are delivered and are not related to contact information, data location, or privacy contact.

Correct answer: A — Assign the custom role to the support engineers in Microsoft Defender XDR permissions.

• A. Correct. After creating a custom role in Microsoft Defender XDR, you must assign it to the support engineers through Defender XDR permissions. This grants only the specific permissions included in the custom role, such as managing Defender for Endpoint settings and performing live response actions, without granting broader Microsoft 365 security access.
• B. Incorrect. The Security Administrator role in Microsoft Entra ID grants broad security management permissions across Microsoft 365 security features. This would exceed the requirement because the support engineers must be limited to Defender for Endpoint-specific tasks only.
• C. Incorrect. The Security Operator role in Microsoft Entra ID is a built-in directory role that provides broader permissions than a custom, scoped Defender XDR role assignment. It would not provide the least-privilege, Defender-only access required in this scenario.
• D. Incorrect. Microsoft Purview compliance portal role assignments are used for compliance-related functions, not Defender XDR permission management. Assigning the role there would not grant the required Defender for Endpoint settings and live response capabilities.

Correct answer: A — Groups Administrator

• A. Correct. The Groups Administrator role is specifically designed to manage Microsoft 365 groups, including creating, deleting, and managing membership. It does not grant permissions to manage other directory objects such as users or devices.
• B. Incorrect. The User Administrator role has broader permissions, including managing user accounts and groups, but it is not limited to Microsoft 365 groups and can manage other directory objects.
• C. Incorrect. Directory Writers is not a standard role in Microsoft Entra ID; it is a legacy role or not applicable for this purpose.
• D. Incorrect. The Intune Administrator role focuses on managing Microsoft Intune and mobile device management, not Microsoft 365 groups.

Correct answer: C — Information Protection

• A. Incorrect. The DLP Compliance Management role group does not exist in Microsoft Purview. The correct role group for managing DLP policies is Information Protection.
• B. Incorrect. Compliance Data Administrator is a broader compliance role that does not specifically grant permissions to manage DLP policies. It focuses on compliance data management rather than DLP administration.
• C. Correct. The Information Protection role group in Microsoft Purview includes permissions to manage data loss prevention (DLP) policies. This role group is designed for tasks related to information protection, including DLP policy management.

Correct answer: C — Password writeback

• A. Incorrect. Password hash synchronization synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID for cloud authentication, but it does not allow users to reset or change their on-premises password from the cloud.
• B. Incorrect. Pass-through authentication validates passwords against on-premises Active Directory in real time for cloud sign-ins, but it does not provide the ability to write password changes back to on-premises AD.
• C. Correct. Password writeback enables users to reset or change their password in Microsoft Entra ID and have that password written back to their on-premises Active Directory. This feature is essential for self-service password reset in hybrid environments.
• D. Incorrect. Seamless single sign-on provides a frictionless sign-in experience for domain-joined devices, but it does not facilitate password resets back to on-premises Active Directory.

Correct answer: B — False

• A. The statement is false because SSPR cannot reset passwords for on-premises Active Directory users without password writeback. Password writeback is required to synchronize the new password from Microsoft Entra ID back to the on-premises directory.
• B. The statement is false because without password writeback, SSPR can only change the password in Microsoft Entra ID and cannot update the on-premises Active Directory account. Hybrid users need writeback enabled for the reset to apply to their local AD password.

Correct answer: A — DC

• A. Correct. The Microsoft Entra Password Protection DC agent is installed directly on domain controllers. It enforces the banned password list by intercepting password change events and validating them against the global and custom banned password lists. The term 'DC' stands for Domain Controller, and this agent is specifically named the DC agent.
• B. Incorrect. The Proxy agent is a separate component that is installed on a member server, not on domain controllers. Its role is to communicate with Microsoft Entra ID to download the banned password lists and forward them to the DC agents. It does not directly enforce password policies on domain controllers.
• C. Incorrect. 'Connect' refers to Microsoft Entra Connect, which is used for hybrid identity synchronization, not for password protection enforcement. There is no 'Connect agent' in the context of Microsoft Entra Password Protection.
• D. Incorrect. 'Health' refers to Microsoft Entra Connect Health, which monitors the health of your on-premises identity infrastructure. It is not involved in password protection enforcement.

Correct answer: B — A Conditional Access policy with the condition 'Locations' configured to block anonymous IP addresses

• A. Incorrect. A sign-in risk policy in Identity Protection evaluates the probability that a sign-in is risky, but it does not specifically target anonymous IP addresses. Blocking anonymous IPs is handled through Conditional Access location-based conditions, not sign-in risk policies.
• B. Correct. Conditional Access supports named locations and can treat anonymous IP addresses as a location condition to block. This is the appropriate control to automatically deny sign-ins from anonymous IPs.
• C. Incorrect. A user risk policy evaluates risk associated with the user account over time, not the source IP address of a sign-in. It is not designed to detect or block anonymous IP addresses.
• D. Incorrect. 'Use app enforced restrictions' is a session control used to limit access within supported apps, such as enforcing restrictions in Microsoft Defender for Cloud Apps. It does not block sign-ins based on anonymous IP addresses.

Correct answer: A — Microsoft Entra admin center > Sign-in logs

• A. Correct. The Sign-in logs in the Microsoft Entra admin center provide detailed information about each sign-in attempt, including Conditional Access policy evaluation and the reason a sign-in was blocked. You can open the specific sign-in record to see which policy applied and what control caused the failure.
• B. Incorrect. Audit logs track administrative and directory changes, such as policy updates or user management actions. They do not provide per-sign-in evaluation details for Conditional Access decisions.
• C. Incorrect. Identity Protection > Risky sign-ins is used to investigate sign-ins flagged as risky based on identity risk detections. It is not the primary place to see why a Conditional Access policy blocked a sign-in.
• D. Incorrect. Conditional Access > Policies is where you create and manage policies, but it does not show individual sign-in results. To investigate a blocked sign-in, you need the sign-in log entry that includes the applied policy details.

Correct answer: A — True

• A. The statement is true because Conditional Access policies in Microsoft Entra ID can be configured to require Multi-Factor Authentication (MFA) based on conditions such as group membership. This allows administrators to enforce MFA for specific groups of users, such as privileged or sensitive populations.
• B. The statement is false because Conditional Access policies do support group membership as a condition for requiring MFA. Since policies can be scoped to groups, they can require MFA for users based on the groups they belong to, making the statement true.

Correct answer: B — Microsoft Entra Cloud Sync

• A. Incorrect. Microsoft Entra Connect Sync is the traditional synchronization server-based solution that requires a dedicated server to run the sync engine. While it supports complex topologies, it does not meet the requirement to avoid a full Connect Sync server.
• B. Correct. Microsoft Entra Cloud Sync is a lightweight provisioning agent that does not require a full Microsoft Entra Connect Sync server. It supports complex multi-forest topologies and can provision from multiple disconnected on-premises AD forests to Microsoft Entra ID via cloud provisioning agents.
• C. Incorrect. Microsoft Entra Connect Health is a monitoring and diagnostics service used to monitor the health of identity infrastructure. It does not perform directory synchronization or provisioning.
• D. Incorrect. Microsoft Identity Manager is an on-premises identity lifecycle and provisioning platform. It is not the recommended cloud sync solution for direct synchronization to Microsoft Entra ID and is more complex to deploy.

Correct answer: B — To identify and remediate errors in on-premises Active Directory before synchronization

• A. Incorrect. IdFix is not used for real-time monitoring of synchronization errors. Its role is to scan Active Directory data for issues that could prevent successful synchronization to Microsoft Entra ID.
• B. Correct. IdFix is specifically designed to identify and remediate errors in on-premises Active Directory before synchronization with Microsoft Entra ID. It checks for common problems such as duplicate values, invalid characters, and formatting issues that can block or break synchronization, ensuring the directory data is clean and ready for synchronization.
• C. Incorrect. Synchronization rules are configured in Microsoft Entra Connect Sync, not by IdFix. IdFix is a preparation and cleanup tool, not a synchronization rule management tool.
• D. Incorrect. IdFix does not migrate users between Microsoft Entra tenants. Tenant-to-tenant migration is handled by other Microsoft solutions and processes, not by IdFix.

Correct answer: D — Group-based filtering

• A. Domain-based filtering is a valid method in Microsoft Entra Connect Sync. It allows you to include or exclude entire Active Directory domains from synchronization.
• B. OU-based filtering is a valid method in Microsoft Entra Connect Sync. It allows you to scope synchronization to specific organizational units in on-premises Active Directory.
• C. Attribute-based filtering is a valid method in Microsoft Entra Connect Sync. It can be used to filter objects based on specific attribute values.
• D. Group-based filtering is not a valid filtering method in Microsoft Entra Connect Sync. The valid methods are domain-based, OU-based, and attribute-based filtering.

Correct answer: A — Add the users to the 'Protected users' list under impersonation protection

• A. Correct. The 'Protected users' list under impersonation protection is specifically designed to safeguard high-value users, such as executives, from impersonation attacks. Adding users to this list enables Defender for Office 365 to monitor and block emails that attempt to impersonate them.
• B. Incorrect. Mailbox intelligence helps detect suspicious messages based on user communication patterns and relationship history. While useful for identifying anomalies, it does not directly protect specific users from impersonation attacks.
• C. Incorrect. Spoof intelligence is used to detect and block spoofed emails that appear to come from trusted domains or senders. It focuses on spoofing detection, not on protecting named users from impersonation.
• D. Incorrect. The 'Safe senders' list is a mailbox-level setting that allows messages from trusted senders to bypass spam filtering. It does not provide impersonation protection for specific users.

Correct answer: B — Email & collaboration > Review > Quarantine

• A. Incorrect. The 'Review > Quarantine' path is not specific enough; the correct navigation for email quarantine requires starting from 'Email & collaboration'.
• B. Correct. In Microsoft 365 Defender, quarantined email messages are managed under 'Email & collaboration > Review > Quarantine'. This page allows filtering by quarantine reason, such as malware, and by time range, enabling the analyst to view emails quarantined due to malware in the last 24 hours.
• C. Incorrect. 'Threat management > Quarantine' is not a valid path for email quarantine; email quarantine is specifically under the 'Email & collaboration' section.
• D. Incorrect. 'Incidents & alerts > Quarantine' is not where quarantined emails are listed; incidents and alerts are for investigating detections, while quarantine is accessed separately under 'Email & collaboration'.

Correct answer: A — Credential harvest

• A. Credential harvest is the correct technique. It simulates a phishing email that directs users to a fake login page to capture their credentials, exactly matching the described scenario.
• B. Malware attachment simulates an email with a malicious file attachment. It does not involve a fake login page or credential collection.
• C. Link to malware simulates a URL that downloads or leads to malware. The goal is malware delivery, not credential theft via a fake login page.
• D. Drive-by URL refers to a link that exploits browser vulnerabilities to deliver malware. It does not mimic a fake login page for credential harvesting.

Correct answer: D — Co-management with Intune and Configuration Manager

• A. Incorrect. Intune alone can onboard devices it manages, but this does not provide a unified onboarding method across both Intune and Configuration Manager-managed devices in a hybrid environment. The question specifically asks for a method that works across the mixed management model.
• B. Incorrect. Configuration Manager only would similarly exclude devices managed by Microsoft Intune. This method does not provide a unified approach for the hybrid environment.
• C. Incorrect. The Microsoft Defender for Endpoint connector in Intune is used to connect Intune with Defender for Endpoint for compliance and risk-based workflows, not as the primary unified onboarding mechanism for both Intune and Configuration Manager devices. It helps integrate the services, but it is not the onboarding method itself.
• D. Correct. Co-management with Intune and Configuration Manager allows for a unified approach to onboard devices to Microsoft Defender for Endpoint. This method ensures that all devices, regardless of whether they are managed by Intune or Configuration Manager, are included.

Correct answer: B — Local script

• A. Incorrect. Group Policy is a Windows-specific feature used for managing Windows-based systems in Active Directory environments. It is not supported for onboarding Linux servers to Microsoft Defender for Endpoint.
• B. Correct. A local script is a supported onboarding method for Linux servers. The onboarding package or script can be downloaded from the Microsoft Defender portal and run directly on the Linux server to install and configure the necessary components.
• C. Incorrect. Microsoft Intune supports onboarding for Windows, macOS, and mobile platforms, but it is not the standard method for onboarding Linux servers. Linux onboarding relies on script- or package-based methods.
• D. Incorrect. Configuration Manager is primarily used for managing Windows-based systems and is not a supported onboarding method for Linux servers in Microsoft Defender for Endpoint. Linux onboarding uses local scripts or other Linux-specific deployment approaches.

Correct answer: B — Endpoint protection

• A. Incorrect. A Device configuration profile in Microsoft Intune is used to manage various settings on devices, but it is not specifically used for onboarding devices to Microsoft Defender for Endpoint. Onboarding is handled through the Endpoint protection profile.
• B. Correct. In Microsoft Intune, onboarding Windows devices to Microsoft Defender for Endpoint is done by creating an Endpoint protection profile. This profile includes the Microsoft Defender for Endpoint onboarding configuration and other security settings.
• C. Incorrect. Device compliance profiles define rules and settings that devices must meet to be considered compliant, such as password requirements or encryption. They do not onboard devices into Microsoft Defender for Endpoint.
• D. Incorrect. Security baseline profiles apply preconfigured security settings based on industry best practices, but they are not used for Defender for Endpoint onboarding. The onboarding task specifically uses an Endpoint protection profile.

Correct answer: A — A governance action in the policy

• A. Correct. In Microsoft Defender for Cloud Apps, governance actions can be configured within a policy to automatically take remediation steps when an alert is triggered. Suspending a user account is a supported governance action, making this the appropriate choice.
• B. Incorrect. While a playbook in Azure Logic Apps can automate responses to alerts, it is not the native feature within Defender for Cloud Apps for direct user remediation. The question asks what to configure in response to the policy alert, and the native governance action is the correct answer.
• C. Incorrect. A Conditional Access policy controls access to cloud apps based on conditions like device compliance or sign-in risk. It does not have the capability to suspend a user account based on a Defender for Cloud Apps file-sharing alert.
• D. Incorrect. An OAuth app policy is used to detect and govern risky OAuth applications and their permissions. It is unrelated to suspending a user account based on external file sharing activity.

Correct answer: A — IP address filter

• A. Correct. The IP address filter allows you to scope the activity log to events originating from a specific source IP address. This is the appropriate filter when you need to identify all activities associated with one IP address.
• B. Incorrect. The User filter narrows results to activities performed by a specific user account, not by a network address. It would not directly identify all activities from a given IP address unless you already know which user to target.
• C. Incorrect. The App filter is used to show activity related to a specific cloud app, such as Microsoft 365 or Salesforce. It does not isolate actions based on the source IP address.
• D. Incorrect. The Activity type filter limits results to certain kinds of actions, such as file upload or login events. It does not filter the log by the IP address that generated the activity.

Correct answer: A — OAuth app investigation

• A. Correct. The OAuth app investigation feature in Microsoft Defender for Cloud Apps is specifically designed to analyze OAuth apps, including the permissions they have been granted and associated risks. It provides detailed insights into the app's permission scope, usage, and potential threats, making it the appropriate tool for investigating the app's permissions after a consent event.
• B. Incorrect. The activity log filter is used to narrow down and view specific activities within the log, but it does not provide detailed investigation capabilities for OAuth app permissions. It can help locate the event but not analyze the app itself.
• C. Incorrect. The file policy report is used for monitoring and reporting on file policies and file-related activities. It is not intended for examining OAuth app consent or permissions.
• D. Incorrect. The Cloud Discovery dashboard is used to discover cloud app usage and assess shadow IT patterns. It does not provide the detailed OAuth app permission investigation needed in this scenario.

Correct answer: A — It allows you to create custom detection rules that automatically generate alerts based on KQL queries.

• A. Correct. Microsoft Defender XDR advanced hunting enables you to create custom detection rules using Kusto Query Language (KQL) queries. When the query matches specific activity, an alert is automatically generated, supporting proactive threat detection.
• B. Incorrect. Advanced hunting is query-based and does not include a graphical playbook builder. Playbooks are typically created using Microsoft Sentinel or Azure Logic Apps, not within the advanced hunting feature.
• C. Incorrect. Advanced hunting does not automatically block outbound traffic. Such actions are handled by network security controls, firewall policies, or other enforcement mechanisms, not by hunting queries.
• D. Incorrect. Advanced hunting is primarily an interactive threat-hunting and custom detection tool, not a reporting feature. Executive summary reports are generated by other tools within Microsoft Defender XDR or Microsoft Sentinel.

Correct answer: B — It provides context about threat actors, their tools, and indicators of compromise to enrich alerts.

• A. Incorrect. Defender TI is a threat intelligence enrichment tool, not an automatic prevention control. Blocking malicious IPs at the firewall is typically handled by other security solutions or manual intervention.
• B. Correct. Defender TI provides contextual intelligence about threat actors, their infrastructure, tactics, tools, and indicators of compromise (IOCs). This enriches alerts, improves triage, and helps analysts understand the scope and relevance of suspicious activity.
• C. Incorrect. Defender TI does not replace a SIEM solution. It complements investigation and detection workflows, but SIEM platforms are used for centralized log aggregation, correlation, and broader security operations.
• D. Incorrect. Defender TI is not designed to generate compliance documentation. Its purpose is to provide threat intelligence and investigation context, not to produce audit reports or compliance evidence.

Correct answer: C — Label reports

• A. Incorrect. Activity explorer tracks user and admin activities related to data and labels, such as when labels are applied or changed. It does not provide a dashboard showing where sensitivity and retention labels are applied across workloads.
• B. Incorrect. Content explorer allows you to inspect content that has been discovered and classified, including labels on specific items. It is useful for drilling into data but is not the reporting dashboard for label application across workloads.
• C. Correct. Label reports provide a dashboard view of how sensitivity labels and retention labels are applied across Microsoft 365 workloads such as Exchange, SharePoint, OneDrive, and Teams. This feature is used to understand label distribution and coverage.
• D. Incorrect. The data classification dashboard provides an overview of labeled data and sensitive information types, but it does not specifically show the application of sensitivity and retention labels across services.

Correct answer: B — To monitor user and admin activities related to labeled content.

• A. Incorrect. Viewing where sensitivity labels are applied across your data estate is the role of label analytics or data classification reports, not Activity explorer. Activity explorer focuses on tracking events and actions, such as when labels are applied or changed.
• B. Correct. Activity explorer is used to monitor user and admin activities related to labeled content, including actions like labeling, relabeling, and file access events. It provides visibility into activity over time and helps investigate how sensitivity labels are being used.
• C. Incorrect. Label usage trends are typically shown in reports or analytics views, not Activity explorer. Activity explorer is event-centric rather than trend-centric, so it is better suited for tracking specific actions than producing usage summaries.
• D. Incorrect. Auto-labeling policies are configured in Microsoft Purview's Information Protection section, not in Activity explorer. Activity explorer is for monitoring and auditing activity after policies are in place, not for creating them.

Correct answer: B — False

• A. The statement is false because a retention label configured as a regulatory record is immutable and cannot be removed by any user, including a global administrator, until the retention period expires and any disposition review is completed. This ensures compliance with legal and regulatory requirements.
• B. The statement is false because regulatory records are designed to be immutable and cannot be deleted or modified, even by a global administrator. This ensures that critical data is retained for compliance purposes.

Correct answer: B — To review and manage DLP policy matches and incidents

• A. Incorrect. Creating new sensitive information types is done in the Microsoft Purview compliance portal under Sensitive info types, not in the DLP alert management dashboard. The dashboard is focused on monitoring and responding to DLP alerts and incidents.
• B. Correct. The DLP alert management dashboard is specifically designed to review, investigate, and manage DLP policy matches and incidents. It provides a centralized location for compliance administrators to triage alerts, see affected users and locations, and take action on policy violations.
• C. Incorrect. Configuring endpoint DLP settings is done in the Endpoint DLP section of the Microsoft Purview compliance portal, not in the alert management dashboard. The dashboard is for visibility into alerts rather than defining endpoint controls.
• D. Incorrect. User activity reports for SharePoint Online are typically found in audit logs, activity reports, or related reporting tools, not in the DLP alert management dashboard. That dashboard is specifically designed for DLP alert review and incident handling.

Correct answer: B — To display a policy tip in the application

• A. Incorrect. The 'Notify user' action does not send an email to the user when a policy match occurs. Email notifications are configured separately, not through this action.
• B. Correct. The 'Notify user' action is designed to display a policy tip in the application. This tip informs the user about the potential policy violation and provides guidance on how to comply with the policy.
• C. Incorrect. Blocking the user from sharing content is handled by enforcement actions such as blocking access or restricting sharing, not by the 'Notify user' action. Notification is meant to inform the user rather than stop the action.
• D. Incorrect. Generating an incident report is associated with incident reporting or alerting to administrators, not the 'Notify user' action. User notification is focused on informing the end user at the time of the policy match.

Correct answer: B — DLP incidents report

• A. Incorrect. The DLP policy matches report shows policy match activity but does not specifically summarize incidents and top sensitive info types. The question describes the DLP incidents report.
• B. Correct. The DLP incidents report provides an overview of DLP policy matches, including incident counts and the top sensitive info types detected. It helps administrators quickly see where policies are triggering and what kinds of sensitive data are involved.
• C. Incorrect. The DLP false positive and override report focuses on user overrides and false positives, not on the overall number of incidents and top sensitive info types. It is used to review cases where users bypassed or disputed DLP actions.
• D. Incorrect. The DLP activity report tracks DLP-related actions and events broadly, but it does not specifically provide the incidents summary and top sensitive info types described in the question.