Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A healthcare provider must ensure that patient health information (PHI) is not accidentally shared outside the organization. They want to automatically detect if an email contains PHI (such as diagnosis codes) and block it from being sent externally. Additionally, the sender should receive a notification explaining the block. Which Microsoft Purview solution should be configured?
⚠ Common exam trap
Many exam-takers confuse Information Protection (labeling) with DLP (enforcement), assuming that applying a sensitivity label alone will block external sharing, when in fact DLP is required to enforce the block and notification action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention (DLP)
Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive information—such as patient health information (PHI) with diagnosis codes—in emails and automatically block external transmission while sending a notification to the sender. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) and rules to enforce actions like blocking and policy tips.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection (MIP) is incorrect because it is a classification and labeling solution, not a real-time content enforcement engine. MIP lets administrators apply sensitivity labels and encryption to documents and emails, and it can define rights-management usage restrictions. However, it does not independently scan outbound email content for sensitive patterns like patient health records and automatically block the message before it leaves the organization. DLP is the Microsoft 365 service that performs that inline mail-flow inspection and blocking action.
- ✓
Microsoft Purview Data Loss Prevention (DLP)
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) is correct because it is designed precisely for this scenario: identifying sensitive information types (such as U.S. HIPAA data or generic health record patterns) and enforcing protective actions on outbound messages. When a DLP policy is applied to Exchange Online, the service scans email content and attachments in transit, matches against defined conditions, and can block the email, send a policy tip to the sender, or generate an incident report. For a healthcare provider, DLP can use regulatory templates (like HIPAA) to automatically prevent accidental or deliberate leakage of patient health information via email.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management is incorrect because it is an investigation and detection tool for risky user behavior rather than an automatic content-blocking control. It analyzes user activities across Microsoft 365—such as inappropriately downloading patient files, copying data to USB drives, or uploading to personal cloud services—and scores them to identify patterns of potential data theft or accidental leakage. While it can raise alerts and support forensic review, it does not intercept outbound email messages and block them based on sensitive content in real time. Thus, it cannot proactively ensure that a patient health email is never sent.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit is incorrect because it provides after-the-fact logging and forensic visibility, not preventive control. Audit logs record events such as an email being sent, a DLP rule being matched, or a user accessing a file, but they do not inspect content or block messages at the moment of transmission. For a healthcare provider's requirement to ensure patient health data is not leaked through email, auditing can help prove what happened later but cannot stop the email from leaving the organization. Only an inline enforcement technology like DLP can meet that need.
Go deeper
Related to this question
About these practice questions
This MS-900 question is part of Courseiva's 217-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.