Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer wants to proactively prevent users from sending emails that contain sensitive personal data (e.g., credit card numbers) to external recipients. When a user attempts to send such an email, they should see a policy tip explaining the restriction and be blocked from sending. Which Microsoft Purview feature should be configured?
⚠ Common exam trap
A common mix-up: candidates confuse Communication Compliance (which reviews messages after they are sent) with DLP (which proactively blocks messages in transit), leading them to select Communication Compliance when the question explicitly requires proactive blocking with a policy tip.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention (DLP) policy
Microsoft Purview Data Loss Prevention (DLP) policy is the correct feature because it is specifically designed to detect sensitive data (e.g., credit card numbers) in transit and enforce actions such as showing a policy tip and blocking the email. DLP policies use sensitive information types (e.g., Credit Card Number) and conditions to inspect email content in Exchange Online, triggering a block action with an end-user notification when a match occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Data Loss Prevention (DLP) policy
Why this is correct
Microsoft Purview DLP policies use built-in sensitive information types (e.g., credit card numbers) to inspect message body and attachments as they are composed, then apply actions such as blocking the send action and displaying customizable policy tips. This prevents the exfiltration of sensitive data before it leaves the organization, satisfying the compliance officer's proactive prevention requirement.
- ✗
Microsoft Purview Information Barriers
Why it's wrong here
Information barriers are used to prevent communication between certain groups (e.g., legal and finance) to avoid conflicts of interest. They do not inspect content for sensitive data or provide policy tips. DLP is the correct solution.
- ✗
Microsoft Purview Records Management
Why it's wrong here
Records Management is centered on declaring documents as records with retention labels, enforcing retention periods, and performing disposition reviews, not on inspecting outbound content for sensitive data. It governs lifecycle and legal preservation but cannot intercept a user's email or Teams message in transit to block it based on PII or PCI content, so it addresses a different compliance concern.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Communication Compliance is built for detecting and investigating employee communications that may violate corporate conduct policies, such as harassment or insider trading, through machine-learning classifiers and alert reviews. While it can flag suspicious messages for human review, it does not provide real-time user action blocks or inline policy tips like DLP, and its primary purpose is workforce misconduct detection rather than data leakage prevention.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
About these practice questions
Courseiva writes every MS-900 question from scratch — 217 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.