SC-100 Practice Question: Design solutions that align with security best practices and priorities
A company is implementing Microsoft Purview to protect sensitive data in SharePoint Online. They need to automatically apply a 'Highly Confidential' label to documents that contain credit card numbers. What should they create?
⚠ Common exam trap
A common mix-up: candidates confuse DLP rules (which detect and protect data) with auto-labeling policies (which apply sensitivity labels), but the question specifically asks for automatic label application, not just detection or blocking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An auto-labeling policy for sensitivity labels
Microsoft Purview auto-labeling policies for sensitivity labels can automatically detect sensitive data types (e.g., credit card numbers) in SharePoint Online documents and apply a 'Highly Confidential' label without user intervention. This meets the requirement for automatic, policy-driven labeling based on content inspection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A communication compliance policy
Why it's wrong here
Communication compliance policies in Microsoft Purview are designed to evaluate inbound and outbound messages for inappropriate content, policy violations, or regulatory compliance using predefined and custom templates. They do not perform file-level classification or apply sensitivity labels; their purpose is to detect and remediate risky communication patterns, not to assign metadata to content. Thus, they cannot automate the labeling of sensitive documents.
- ✗
A data loss prevention (DLP) rule
Why it's wrong here
A DLP rule within Purview enforces protective actions such as blocking, blocking with override, or alerting when content traverses outbound channels, often by matching sensitive information types or a sensitivity label already applied. However, DLP rules lack the capability to write metadata by assigning or changing a sensitivity label on a document; they operate on existing classification to prevent loss, not to classify new content. Therefore, a DLP rule cannot substitute for auto-labeling.
- ✗
A manual labeling policy
Why it's wrong here
Manual labeling policies in Purview permit users to select a sensitivity label themselves, either through Office apps or cloud-based exploration, but do not automate detection or classification. The question seeks a capability that automatically scans and labels sensitive data, and a manual policy places the onus on end users, which is error-prone and inconsistent. Since auto-labeling is explicitly the desired behavior, manual labeling is insufficient for this requirement.
- ✓
An auto-labeling policy for sensitivity labels
Why this is correct
An auto-labeling policy for sensitivity labels in Microsoft Purview lets you define rules that automatically inspect documents and emails for sensitive content (e.g., sensitive info types, patterns, or trainable classifiers) and apply the appropriate sensitivity label without user intervention. These policies run in simulation mode initially to gauge accuracy, then can be enforced in production to assign the label, enforce encryption, and trigger subsequent DLP. This is the only option that directly and automatically classifies content at scale, meeting the stated goal.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 605 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.