The answer is a Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected. This is correct because Microsoft Purview DLP can automatically scan outbound emails for sensitive data like credit card numbers using built-in sensitive information types, then apply encryption—either via Transport Layer Security (TLS) or Information Rights Management (IRM)—at the transport level in Exchange Online, fulfilling the requirement for automatic encryption without user intervention. On the MS-102 exam, this scenario tests your understanding of how DLP policies enforce compliance controls at the mail flow level, often appearing as a distractor against manual encryption methods like Outlook rules or third-party gateways. A common trap is choosing “Exchange mail flow rules” instead, but remember: DLP policies natively integrate sensitive data detection and encryption in one rule. Memory tip: “DLP detects, then protects”—if the trigger is a sensitive info type, think DLP first.
MS-102 Manage compliance by using Microsoft Purview Practice Question
This MS-102 practice question tests your understanding of manage compliance by using microsoft purview. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A compliance officer needs to ensure that all outbound emails containing credit card numbers sent to external recipients are automatically encrypted without requiring user intervention. Which Microsoft Purview feature should be configured?
Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.
DLP can detect sensitive info and enforce encryption using Rights Management, all without user action.
B
Sensitivity label with auto-labeling based on credit card numbers.
Why wrong: Sensitivity labels can encrypt but auto-labeling for email is not as straightforward as DLP for outbound mail; DLP is the recommended approach.
C
Retention policy for Exchange Online.
Why wrong: Retention policies preserve or delete email, they do not encrypt content.
D
eDiscovery case for content search.
Why wrong: eDiscovery is used for legal discovery, not for automatic encryption of outgoing emails.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.
Option A is correct because a Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with a rule that automatically detects credit card numbers (using a built-in sensitive info type) and applies encryption via Transport Layer Security (TLS) or Information Rights Management (IRM) to outbound emails sent to external recipients. This meets the compliance officer's requirement for automatic encryption without user intervention, as the DLP rule triggers encryption at the transport level in Exchange Online.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected.
Why this is correct
DLP can detect sensitive info and enforce encryption using Rights Management, all without user action.
Related concept
Read the scenario before looking for a memorised answer.
✗
Sensitivity label with auto-labeling based on credit card numbers.
Why it's wrong here
Sensitivity labels can encrypt but auto-labeling for email is not as straightforward as DLP for outbound mail; DLP is the recommended approach.
✗
Retention policy for Exchange Online.
Why it's wrong here
Retention policies preserve or delete email, they do not encrypt content.
✗
eDiscovery case for content search.
Why it's wrong here
eDiscovery is used for legal discovery, not for automatic encryption of outgoing emails.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse auto-labeling with sensitivity labels (Option B) as a direct encryption mechanism, but auto-labeling does not automatically encrypt outbound emails at the transport layer—it only applies labels, and encryption requires additional configuration (e.g., via a DLP policy or a label's protection settings) that may not trigger without user action or client-side processing.
Detailed technical explanation
How to think about this question
Under the hood, a DLP policy in Exchange Online uses transport rules (mail flow rules) to inspect message content against sensitive information types like credit card numbers (defined by regex patterns and checksum validation). When a match occurs, the rule can apply 'Encrypt the message' action, which uses Microsoft Purview Message Encryption (a service based on Azure Rights Management) to wrap the email in an encrypted envelope, ensuring only authorized recipients can decrypt it. In a real-world scenario, this ensures that even if an email is intercepted during transit, the credit card data remains unreadable without the encryption key.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Manage compliance by using Microsoft Purview — This question tests Manage compliance by using Microsoft Purview — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Data Loss Prevention (DLP) policy with a rule that encrypts the message when credit card numbers are detected. — Option A is correct because a Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with a rule that automatically detects credit card numbers (using a built-in sensitive info type) and applies encryption via Transport Layer Security (TLS) or Information Rights Management (IRM) to outbound emails sent to external recipients. This meets the compliance officer's requirement for automatic encryption without user intervention, as the DLP rule triggers encryption at the transport level in Exchange Online.
What should I do if I get this MS-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A compliance officer needs to ensure that all emails containing payment card information (PCI) are automatically encrypted when sent to external recipients. The encryption should occur without user intervention. Which two features should be configured together? (Choose two.)
hard
✓ A.Data Loss Prevention (DLP) policy with encryption action
✓ B.Sensitivity label with encryption
C.Microsoft Purview Message Encryption
D.Transport rule with encryption
Why A: Option A is correct because a Data Loss Prevention (DLP) policy in Microsoft Purview can be configured with an encryption action that automatically encrypts emails containing sensitive information, such as payment card information (PCI), when sent to external recipients. This encryption occurs without user intervention, meeting the compliance officer's requirement. The DLP policy uses built-in sensitive information types (e.g., Credit Card Number) to detect PCI and applies rights management protection via Azure Information Protection.
Variation 2. A compliance officer needs to ensure that all emails containing sensitive information (e.g., passport numbers) are automatically encrypted when sent to external recipients. The encryption should be enforced without requiring users to manually select an option. Which Microsoft Purview feature should they configure?
hard
✓ A.Data Loss Prevention (DLP) policy with encryption action
B.Sensitivity labels with auto-labeling
C.Message Encryption (OME) policies
D.Communication Compliance
Why A: A Data Loss Prevention (DLP) policy with encryption action is correct because it automatically detects sensitive information (e.g., passport numbers) using sensitive info types and enforces encryption via Microsoft Purview Message Encryption (OME) as a rule action. This ensures that when an email containing such data is sent to an external recipient, the email is automatically encrypted without requiring user intervention, meeting the compliance officer's requirement.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.