Question 180
An auditor must review DLP policy activity records without creating new enforcement rules. Which response most directly addresses the stated need?
Explanation
Correct Answer
Read-only audit and reporting do not require DLP policy author privileges. It directly meets the case's requirement to provide DLP audit visibility.
Incorrect Answers
Investigation rights can be separated from policy-change rights. That would let responders inspect DLP alerts; the question instead requires a way to provide DLP audit visibility.
Alert response can be delegated through service role groups. That would permit DLP case triage; the question instead requires a way to provide DLP audit visibility.
Purview role-based authorization separates DLP policy authoring from tenant superuser access. That would delegate DLP configuration; the question instead requires a way to provide DLP audit visibility.





Administering Information Security in Microsoft 365 (SC-401) Practice Tests