What should an administrator do if DLP policies are generating too many false positives?

Excessive false positives indicate that a policy’s detection criteria are broader or less precise than the actual business requirement. The correct response is to tune the policy by reviewing representative incidents, identifying the rules that generate irrelevant matches, and replacing broad keywords or patterns with higher-confidence detection techniques. Exact Data Matching and document fingerprinting can improve precision because they compare inspected content with authoritative structured records or known protected documents. Administrators can also adjust occurrence thresholds, validators, exceptions, proximity settings, and contextual conditions. Ignoring incidents leaves the underlying problem unresolved, disabling all policies removes necessary protection, and relying on manual user approval does not correct inaccurate detection. Therefore, refining the detection methods and policy logic, as described in option D, is the correct administrative action.