Secure compute practice questions

The Protect tab of a data risk assessment offers four remediations: restrict access by label (DLP for Copilot), restrict all items (Restricted Content Discovery), auto-labeling, and retention.

Two separate problems need two controls. For labelled items, 'Restrict access by label' creates a DLP policy for the Microsoft 365 Copilot location that stops Copilot and agents summarizing items with that label, so it targets only the Highly Confidential files. For unlabelled sensitive files, an auto-labeling policy applies a label based on the detected credit card numbers. 'Restrict all items' would also stop Copilot summarizing the labelled files, but it removes the whole site from Copilot, which the requirement forbids. Retention and access reviews address stale content and permissions, not labels or Copilot processing.

1. Split the requirement: block Copilot on one label, and label unlabelled sensitive files.
2. Copilot block by label is the DLP-based 'Restrict access by label'.
3. Automatic labelling is an auto-labeling policy.
4. Reject 'Restrict all items' because it hides the whole site.

Exam tip: Data risk assessment remediations: label-scoped DLP for Copilot, site-wide Restricted Content Discovery, auto-labeling, retention. Pick by scope.

DSPM creates a default data risk assessment for Microsoft 365 that runs weekly on the top 100 SharePoint sites by usage.

The default assessment is automatic: it scans the 100 most-used SharePoint sites every week, and the first results appear after a few days. Custom assessments are what you create to target other users, specific sites or (with an Entra app) item-level scanning. The default one is not organisation-wide and is not driven by sensitive item counts.

1. Recall that the default assessment is created automatically.
2. Its scope is usage-based: the top 100 SharePoint sites.
3. Its cadence is weekly.
4. Anything narrower or targeted is a custom assessment.

Exam tip: Default data risk assessment = top 100 SharePoint sites by usage, weekly. Need other sites? Create a custom assessment.

Custom data risk assessments can scan at item level (SharePoint only, with a registered Entra app) and remediate individual overshared items.

Only a custom assessment with the Item-level scan option shows potentially overshared items, those with external or anonymous sharing links, together with their labels and owners. From the results you can resolve an item, apply a label, notify the site owner or remove the sharing link. It needs a one-time Entra app authentication and supports up to 10 SharePoint sites. The default assessment and the SharePoint reports work at site level, and a Copilot DLP policy doesn't touch links.

1. Note the granularity: individual files, not sites.
2. Note the tool: Purview, with remediation actions.
3. Item-level work needs a custom assessment with Item-level scan.
4. Use Remove sharing link and Notify from its results.

Exam tip: File-level oversharing fixes in Purview = custom data risk assessment with item-level scanning (SharePoint only, Entra app required).

Different AI apps reach DSPM by different routes: Copilot via the audit log, third-party AI websites via onboarded devices and the browser.

The working Copilot data proves that auditing is on, so the gap is specific to third-party sites. Purview sees what users paste into third-party generative AI sites only from devices onboarded to Microsoft Purview, and on Windows with Chrome the Microsoft Purview browser extension is also needed to detect visits and enforce endpoint DLP. Data security for AI interactions is a Defender for AI Services setting for Foundry traffic, and Copilot licences only matter for Copilot.

1. Use the evidence: Copilot data appears, so auditing works.
2. Third-party AI websites are observed from the endpoint, so devices must be onboarded.
3. Chrome on Windows needs the Purview browser extension.
4. Discard controls that apply to Foundry or to Copilot only.

Exam tip: Copilot interactions need auditing; third-party AI sites need onboarded devices (plus the Purview extension for Chrome).

Copilot Studio external threat detection is configured per environment in Power Platform admin center, and its error behavior decides what happens on timeout.

Two facts decide this. First, external threat detection has no tenant-wide or inherited setting: each environment, including ones created later, must be set up under Security > Threat detection > Additional threat detection. Second, if the provider doesn't return a decision within one second, the default error behavior, Allow the agent to respond, lets the tool run. Choosing Block the query meets the fail-closed requirement. A new app registration alone doesn't connect an environment.

1. Find why Sales isn't covered: the configuration is per environment.
2. Set up Additional threat detection for the Sales environment.
3. Check the timeout rule: the default allows the tool to run.
4. Change Set error behavior to Block the query.

Exam tip: Copilot Studio threat detection: set up every environment separately; default on timeout is allow, so choose Block the query to fail closed.

External threat detection runs when the generative orchestrator considers invoking a tool, so it applies only to generative agents.

The provider is called each time the orchestrator plans a tool invocation. Classic agents, which follow authored topics and triggers, skip external threat detection entirely. Because the connection works for other agents, the cause is the agent's orchestration mode, not the Entra app, endpoint or error setting.

1. Note that other agents are evaluated, so the connection works.
2. Note the odd one out uses classic topics.
3. Recall that threat detection only runs for generative orchestration.
4. Switch the agent to generative orchestration.

Exam tip: Copilot Studio external threat detection evaluates generative agents only; classic agents are skipped.