AZ-400 Develop a security and compliance plan Practice Question
Your company uses Microsoft Purview to manage data governance. You need to classify a new dataset containing personally identifiable information (PII) and apply a data loss prevention (DLP) policy. What should you do first?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Register and scan the data source in Microsoft Purview
To classify a new dataset containing PII and apply a DLP policy, the first step is to register and scan the data source in Microsoft Purview. Scanning automatically discovers and classifies sensitive data using built-in classifiers. Only after classification can you create sensitivity labels (option A) or define a DLP policy (option C). Adding to an Azure service tag (option B) is unrelated to data classification. Therefore, option D is the correct first step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a sensitivity label in Microsoft Purview
Why it's wrong here
Sensitivity labels classify and protect documents and emails after content has been discovered and understood, but they are a downstream action—you must first identify what data you have. In Microsoft Purview, applying a sensitivity label manually to an unregistered data source is ineffective because the label cannot attach to an asset that has not been scanned and mapped. Scanning is the prerequisite that enables label auto-classification based on matched file types and content patterns.
- ✗
Add the data source to an Azure service tag
Why it's wrong here
Azure service tags are network security constructs used to define inbound or outbound rules for Azure resources, such as allowing traffic from a specific Azure service's IP range. They have no role in data governance, classification, or cataloging, and adding a data source to a service tag would not cause Purview to inspect or index any files or schemas. This option confuses network access controls with data discovery and classification, so it cannot satisfy the requirement to manage data governance.
- ✗
Define a DLP policy in Microsoft Purview
Why it's wrong here
A DLP policy in Microsoft Purview is designed to monitor and prevent data loss by acting on content that has already been classified and labeled, not to discover unknown data sources. Without a scanned and registered source, there is nothing for the DLP policy to inspect—it can only evaluate data that Purview knows about. Therefore, defining a DLP policy before scanning the source would result in empty or ineffective coverage, making it a premature step in the data governance workflow.
- ✓
Register and scan the data source in Microsoft Purview
Why this is correct
Registering the data source in Microsoft Purview establishes a metadata connection, and scanning it is the action that performs automated inspection to classify data using built-in classifiers such as credit card numbers or personally identifiable information. A scan extracts the resource's schema, lineage, and technical metadata, and it applies the registered source's classification rules to produce a searchable data catalog. This is the foundational first step because all other Purview governance features—including labels and DLP policies—depend on the cataloged assets derived from scanning.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.