Microsoft Purview Data Loss Prevention (DLP) policies protect sensitive information across Microsoft 365 workloads, including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams.
Option B is correct because the policy currently blocks sensitive files in SharePoint but does not prevent credit card information from being shared through email. This strongly indicates that the policy ' s locations do not include Exchange Online, or that Exchange Online is excluded from its scope.
Administrators must configure the DLP policy to include both Exchange email and SharePoint sites. The policy should identify the Credit Card Number sensitive information type and apply appropriate blocking actions to external sharing.
Option A is incorrect because user overrides determine whether users can bypass a DLP restriction. They do not enable protection for additional workloads.
Option C is incorrect because the policy already enforces restrictions in SharePoint, demonstrating that it is functioning for at least one location.
Option D is incorrect because the policy already detects credit card information in SharePoint. Changing the detection conditions alone does not extend enforcement to Exchange Online.
After adding Exchange Online, administrators should verify that the policy ' s rules block the relevant outbound email activity and that users cannot override the restriction.
Therefore, configuring the DLP policy locations is the appropriate solution.
Microsoft Reference: Microsoft Learn — Data Loss Prevention policy reference .
