Manage compliance by using Microsoft Purview →easyMultiple ChoiceObjective-mapped

MS-102 Manage compliance by using Microsoft Purview Practice Question

A compliance officer needs to automatically detect documents in SharePoint Online that contain a custom pattern (e.g., employee ID in the format EMP-12345). The pattern will be used to apply a sensitivity label. Which Microsoft Purview feature should the officer use to define the pattern?

⚠ Common exam trap

It's easy for candidates to confuse DLP policies with pattern definition, but DLP policies only consume pre-defined sensitive information types and cannot create them.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Sensitive information types

Sensitive information types (SITs) in Microsoft Purview are specifically designed to define custom patterns, such as regular expressions for employee IDs like EMP-12345. Once defined, these SITs can be used in sensitivity labels to automatically classify and protect documents in SharePoint Online. This is the correct feature because it directly supports pattern-based detection for labeling.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Sensitive information types
Why this is correct
Sensitive information types define the detection logic itself, using built-in or custom regex patterns, keywords, and confidence thresholds to identify data like employee IDs. After you define a custom sensitive information type, it becomes a reusable condition that purge policies, auto-labeling, and DLP rules rely on. This is the correct answer because the compliance officer's requirement to 'automatically detect' a specific pattern starts with creating that type, not with a policy that merely consumes it.
✗
Data Loss Prevention (DLP) policies
Why it's wrong here
DLP policies are enforcement wrappers, not detection engines. They reference sensitive information types as conditions and then apply actions such as blocking or warning when content matches, but they never define the underlying regex or keyword structure needed to detect something like an employee ID. Without a pre-existing or custom sensitive information type, a DLP policy has nothing to evaluate, so it cannot be used as the primary mechanism to define and detect new document patterns.
✗
Content search
Why it's wrong here
Content search is an interactive, on-demand eDiscovery tool that queries indexed exchange, SharePoint, and Teams content for keywords, properties, or sensitive info types. It returns a point-in-time result set and requires a user to manually run and review it; it provides no continuous, automatic detections and no way to define a reusable pattern. Therefore, while it can find documents, it does not satisfy an automated detection requirement and is not the place to create pattern definitions.
✗
Data classification reports
Why it's wrong here
Data classification reports are an analytics and visibility feature that aggregates results from existing sensitive information types and retention labels across the tenant, showing where classified data resides. They do not contain any authoring interface for defining custom regex patterns, and they operate only on metadata already generated by other classification mechanisms. This option is wrong because the officer needs to create the detection criteria Upfront, whereas reports merely reflect what other systems have already detected.

Go deeper

MS-102 Manage compliance by using Microsoft Purview Practice Question

Why each option matters

Option-by-option breakdown

Related to this question