Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer needs to automatically detect when an employee attempts to send an email containing a social security number (SSN) to an external recipient. The solution should block the email from being sent and notify the employee with a policy tip. Which Microsoft Purview solution should be configured?
⚠ Common exam trap
It's easy for candidates to confuse Information Protection (labeling) with Data Loss Prevention (enforcement), assuming that applying a sensitivity label automatically blocks data exfiltration, when in fact DLP policies are required to enforce actions like blocking and policy tips.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention (DLP)
Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive information (such as social security numbers) in emails and other data in transit. When a DLP policy is configured with a rule that matches the SSN condition and an action to block the message, it automatically prevents the email from being sent and displays a policy tip to the user, notifying them of the violation. This aligns directly with the requirement to both block the email and provide real-time user notification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Data Loss Prevention (DLP)
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) in Exchange Online includes policies that scan email content in transit for sensitive information types such as social security numbers. When a match occurs, DLP can enforce an action like blocking the message from being sent and generating a policy tip to the sender, which satisfies the automatic detection and remediation requirement.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection focuses on classifying and labeling data based on sensitivity and retention, using sensitivity labels and document markings. While it integrates with DLP to apply labels, it does not natively perform real-time scanning or blocking of email messages in transit — that enforcement capability resides in DLP policies.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery is designed for legal and investigative workflows, allowing users to search across Exchange mailboxes, SharePoint sites, and OneDrive for content that may be relevant to a case, place holds, and export results. It operates on a query basis after content exists and does not scan or block outbound emails at the moment of transmission, so it cannot prevent a compliance violation proactively.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit (Premium or Standard) records user and admin activities like email sends, logon events, and file accesses into the unified audit log, providing a forensic trail for investigation. However, it is a passive telemetry feature — it detects activities after they occur and cannot apply conditional rules to intercept and block an email based on its content in real time.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
About these practice questions
This MS-900 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.