Auto-Encrypt Outbound Emails with Credit Card Numbers Using DLP
A compliance officer needs to ensure that all outbound emails containing credit card numbers sent to external recipients are automatically encrypted without requiring user intervention. Which Microsoft Purview feature should be configured?
Quick Answer
The answer is a Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected. This is correct because Microsoft Purview DLP can automatically scan outbound emails for sensitive data like credit card numbers using built-in sensitive information types, then apply encryption—either via Transport Layer Security (TLS) or Information Rights Management (IRM)—at the transport level in Exchange Online, fulfilling the requirement for automatic encryption without user intervention. On the MS-102 exam, this scenario tests your understanding of how DLP policies enforce compliance controls at the mail flow level, often appearing as a distractor against manual encryption methods like Outlook rules or third-party gateways. A common trap is choosing “Exchange mail flow rules” instead, but remember: DLP policies natively integrate sensitive data detection and encryption in one rule. Memory tip: “DLP detects, then protects”—if the trigger is a sensitive info type, think DLP first.
⚠ Common exam trap
It's easy for candidates to confuse auto-labeling with sensitivity labels (Option B) as a direct encryption mechanism, but auto-labeling does not automatically encrypt outbound emails at the transport layer—it only applies labels, and encryption requires additional configuration (e.g., via a DLP policy or a label's protection settings) that may not trigger without user action or client-side processing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.
A Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with a rule that automatically detects credit card numbers (using a built-in sensitive info type) and applies encryption via Transport Layer Security (TLS) or Information Rights Management (IRM) to outbound emails sent to external recipients. This meets the compliance officer's requirement for automatic encryption without user intervention, as the DLP rule triggers encryption at the transport level in Exchange Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.
Why this is correct
DLP can detect sensitive info and enforce encryption using Rights Management, all without user action.
- ✗
Sensitivity label with auto-labeling based on credit card numbers.
Why it's wrong here
Sensitivity labels can encrypt but auto-labeling for email is not as straightforward as DLP for outbound mail; DLP is the recommended approach.
- ✗
Retention policy for Exchange Online.
Why it's wrong here
Retention policies preserve or delete email, they do not encrypt content.
- ✗
eDiscovery case for content search.
Why it's wrong here
eDiscovery is used for legal discovery, not for automatic encryption of outgoing emails.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on MS-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A compliance officer needs to ensure that all emails containing payment card information (PCI) are automatically encrypted when sent to external recipients. The encryption should occur without user intervention. Which two features should be configured together? (Choose two.)
hard- ✓ A.Data Loss Prevention (DLP) policy with encryption action
- ✓ B.Sensitivity label with encryption
- C.Microsoft Purview Message Encryption
- D.Transport rule with encryption
Why A: A compliance officer should configure a sensitivity label with encryption (option B) that defines the encryption settings, and a DLP policy (option A) that detects PCI data and automatically applies that sensitivity label. In the DLP policy, the action is to apply the sensitivity label, not a direct encryption action. The DLP rule uses built-in sensitive information types (e.g., Credit Card Number) to trigger the label application. The label then encrypts the message, satisfying the requirement without user intervention.
Variation 2. A compliance officer needs to ensure that all emails containing sensitive information (e.g., passport numbers) are automatically encrypted when sent to external recipients. The encryption should be enforced without requiring users to manually select an option. Which Microsoft Purview feature should they configure?
hard- ✓ A.Data Loss Prevention (DLP) policy with encryption action
- B.Sensitivity labels with auto-labeling
- C.Message Encryption (OME) policies
- D.Communication Compliance
Why A: A Data Loss Prevention (DLP) policy with encryption action is correct because it automatically detects sensitive information (e.g., passport numbers) using sensitive info types and enforces encryption via Microsoft Purview Message Encryption (OME) as a rule action. This ensures that when an email containing such data is sent to an external recipient, the email is automatically encrypted without requiring user intervention, meeting the compliance officer's requirement.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.