SC-100 Practice Question: Design security operations, identity, and compliance capabilities
A multinational company uses Microsoft Purview for data governance. They need to automatically classify sensitive data in Microsoft 365 and apply retention labels. The solution must use pattern-based detection for credit card numbers and support custom keywords. What should they configure?
⚠ Common exam trap
A common mix-up: candidates confuse the configuration of a custom sensitive info type (which defines the detection logic) with the policy that uses it (DLP or auto-labeling), assuming DLP or auto-labeling policies can directly define regex patterns and keywords without a separate sensitive info type.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom sensitive info type with a regex pattern and keyword list.
The requirement specifies pattern-based detection for credit card numbers and support for custom keywords. A custom sensitive info type in Microsoft Purview allows you to define a regex pattern (e.g., for credit card numbers) and associate a custom keyword list, enabling precise auto-classification and retention label application. Trainable classifiers use machine learning, not pattern-based detection, and DLP policies or retention label auto-labeling policies do not directly create the pattern and keyword logic needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a trainable classifier for credit card numbers.
Why it's wrong here
Trainable classifiers use machine learning to identify content by examples and seed files, not by fixed formats. Credit card numbers have a deterministic structure (prefix ranges, length, Luhn checksum), so a trainable classifier would be slower, less precise, and far more prone to false positives/negatives than a regex-based sensitive info type. Microsoft Purview itself recommends trainable classifiers for content like contracts or resumes, not for well-defined numeric patterns.
- ✓
Create a custom sensitive info type with a regex pattern and keyword list.
Why this is correct
A custom sensitive info type is the right mechanism because it lets you define a regular expression to match the credit card number format, optionally with the Luhn checksum validation, plus a keyword list (e.g., 'VISA', 'MasterCard', 'card number') to raise confidence and reduce false positives. Purview uses these custom SITs in DLP policies, auto-labeling, and retention label conditions. This directly gives you a detectable classification without depending on built-in types.
- ✗
Configure a DLP policy with a rule for credit card numbers.
Why it's wrong here
A DLP policy does not detect patterns by itself; it only enforces actions like block, restrict, or notify after content is already classified. To have a rule 'for credit card numbers,' you must first select an existing sensitive info type or a custom SIT. Creating a DLP policy without a matching SIT will simply do nothing, because the condition cannot evaluate unclassified content.
- ✗
Create a retention label with auto-labeling policy.
Why it's wrong here
Retention labels and auto-labeling policies apply labels based on existing classifications (e.g., sensitive info types, trainable classifiers) or manual/user action. Auto-labeling will not invent a credit card pattern; it requires you to specify a classifier or SIT as the trigger. Therefore, creating a retention label before having a custom sensitive info type for credit card numbers puts the cart before the horse and would not classify the data.
Go deeper
Related to this question
About these practice questions
One of 605 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.