Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A company wants to prevent users from sharing documents that contain credit card numbers via email. When a user attempts to share such a document, they should see a policy tip explaining the restriction and the share should be blocked. Which Microsoft Purview solution should the compliance team configure?
⚠ Common exam trap
Microsoft often tests the distinction between DLP (which inspects content for sensitive data and blocks actions) and Sensitivity labels (which apply classification and protection but do not natively scan for specific data patterns like credit card numbers to enforce blocking with policy tips).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policy
Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to detect sensitive information types—such as credit card numbers—in documents and emails, and then automatically block sharing while displaying a policy tip to the user. This matches the requirement exactly: DLP can inspect content for credit card patterns using built-in sensitive info types (e.g., Credit Card Number), enforce actions like 'Block' with an overridable policy tip, and apply to Exchange Online, SharePoint, OneDrive, and Teams. Retention policies only manage data lifecycle, not content-based blocking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retention policy
Why it's wrong here
Retention policies in Microsoft Purview govern data lifecycle management by retaining or permanently deleting content after a specified period, typically to meet legal, regulatory, or business requirements. They are evaluated based on the age and metadata of the item, not on its contents, and they never perform real-time content inspection for sensitive patterns. Because a credit card number would be invisible to a retention rule, it can neither detect nor block a user from sharing such a document.
- ✓
Data Loss Prevention (DLP) policy
Why this is correct
Data Loss Prevention (DLP) policies in Microsoft Purview are designed to identify, monitor, and protect sensitive information by inspecting content for predefined sensitive info types, such as credit card numbers, using pattern matching and validation. When a match is detected, DLP can enforce sophisticated actions like blocking the email or sharing attempt, notifying the user with a policy tip, and optionally encrypting the item. DLP works across Exchange, SharePoint, OneDrive, Teams, and devices, making it the correct control for preventing the exfiltration of documents containing credit card data.
- ✗
Sensitivity label
Why it's wrong here
Sensitivity labels are designed to classify and protect documents and emails by applying encryption, visual markings, or access restrictions, either automatically based on conditions or manually by the user. However, a label itself does not scan for or react to the presence of sensitive data like credit card numbers at the moment of a sharing action; its protection is tied to the label's configuration and the user's assignment of that label. Even if a label is applied, the label does not intercept and block the act of sharing a document that happens to contain a credit card number, so it fails to meet the requirement.
- ✗
Information Barriers
Why it's wrong here
Information Barriers in Microsoft Purview are organizational policies that restrict communication and collaboration between two specific user groups to prevent conflicts of interest, such as between trading and research teams. They operate on user/group segments and, once configured, silently block conversations, sharing, or collaboration between those segments—regardless of the content in the files. Since these barriers only look at who is communicating with whom and never inspect document contents, they cannot detect a credit card number or prevent a user from sharing such a document with someone outside the segmented relationship.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.