The correct answer is that this pattern is intended to automatically apply sensitivity labels to resources matching the pattern. In Microsoft Purview, a Data Map pattern defines a set of scanning rules that target specific resource locations—here, all *.onmicrosoft.com resources in Global and USGov regions—and the pattern’s primary action is to assign sensitivity labels based on content inspection, not merely to scan or classify. This tests your understanding of how Purview Data Map patterns bridge scanning and labeling, a key concept for the Microsoft Cybersecurity Architect exam where you must distinguish between automated labeling, blocking access, and retention enforcement. A common trap is confusing pattern-based labeling with simple scanning or data loss prevention; remember that a pattern’s purpose is to apply labels automatically, not to enforce policies. Memory tip: think of the pattern as a “labeling trigger” that fires on matched resources, not a firewall or retention rule.
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
This SC-100 practice question tests your understanding of design security operations, identity, and compliance capabilities. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Automatically apply sensitivity labels to resources matching the pattern.
Option C is correct because the pattern targets all *.onmicrosoft.com resources in Global and USGov regions and applies sensitivity labels. Option A is wrong because it applies labels, not just scans. Option B is wrong because it does not block access. Option D is wrong because it does not enforce retention.
Key principle: NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Scan all resources in the onmicrosoft.com domain for classification.
Why it's wrong here
It also applies labels.
✗
Block access to resources in USGov regions.
Why it's wrong here
No blocking action.
✓
Automatically apply sensitivity labels to resources matching the pattern.
Why this is correct
The pattern specifies sensitivity labels to apply.
Related concept
Static NAT maps one inside address to one outside address.
✗
Enforce retention policies on scanned resources.
Why it's wrong here
No retention specified.
Common exam traps
Common exam trap: NAT rules depend on direction and matching traffic
NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.
Detailed technical explanation
How to think about this question
NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.
KKey Concepts to Remember
Static NAT maps one inside address to one outside address.
PAT allows many inside hosts to share one public address using ports.
Inside local and inside global describe the private and translated addresses.
NAT ACLs identify traffic for translation, not always security filtering.
TExam Day Tips
→Identify inside and outside interfaces first.
→Check whether the scenario needs static NAT, dynamic NAT or PAT.
→Do not confuse NAT matching ACLs with normal packet-filtering intent.
Key takeaway
NAT direction and interface roles matter as much as the IP address mapping. Inside/outside designation controls which traffic is translated.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-100 question in full detail.
Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related SC-100 NAT questions on configuration and troubleshooting.
Design security operations, identity, and compliance capabilities — This question tests Design security operations, identity, and compliance capabilities — Static NAT maps one inside address to one outside address..
What is the correct answer to this question?
The correct answer is: Automatically apply sensitivity labels to resources matching the pattern. — Option C is correct because the pattern targets all *.onmicrosoft.com resources in Global and USGov regions and applies sensitivity labels. Option A is wrong because it applies labels, not just scans. Option B is wrong because it does not block access. Option D is wrong because it does not enforce retention.
What should I do if I get this SC-100 question wrong?
Review the four NAT address types (inside local, inside global, outside local, outside global), PAT port overload, and static vs dynamic NAT use cases. Then practise related SC-100 NAT questions on configuration and troubleshooting.
What is the key concept behind this question?
Static NAT maps one inside address to one outside address.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Purview to manage data governance. You need to design a solution that allows data owners to classify sensitive data in their Microsoft SharePoint Online sites and generate a data catalog. Which Purview tool should you use?
medium
A.Microsoft Purview Information Protection
B.Microsoft Purview Audit
C.Microsoft Purview Data Loss Prevention
✓ D.Microsoft Purview Data Map
Why D: Option A is correct because Microsoft Purview Data Map is used to scan data sources, classify sensitive information, and build a data catalog. Option B (Data Loss Prevention) is for policy enforcement, not cataloging. Option C (Information Protection) is for labeling and protection. Option D (Audit) is for logging activities.
Variation 2. Your organization uses Microsoft Purview to manage data governance. You need to create a unified data catalog that automatically classifies and labels data across Azure SQL Database, Amazon S3, and on-premises SQL Server. What should you configure?
medium
✓ A.Microsoft Purview account with scans for all data sources.
B.Azure Data Catalog with custom classification.
C.Azure Purview (legacy) with multi-cloud scanning.
D.Microsoft Information Protection scanner on each source.
Why A: Option A is correct because Microsoft Purview (the unified data governance service) supports scanning and classifying data across multi-cloud and on-premises sources. Option B is wrong because Microsoft Information Protection is for labeling, not scanning. Option C is wrong because Azure Purview (now part of Microsoft Purview) is the correct service. Option D is wrong because Azure Data Catalog is legacy and limited.
Variation 3. Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?
hard
✓ A.Microsoft Purview Data Map
B.Microsoft Purview Information Protection
C.Microsoft Purview Records Management
D.Microsoft Defender for Cloud Apps
Why A: Microsoft Purview Data Map is the correct choice because it provides unified data governance across hybrid and multi-cloud environments, including Microsoft 365, Azure SQL Database, and Amazon S3. It automatically scans, classifies, and labels sensitive data using built-in classifiers and sensitivity labels, enabling consistent DLP policies across these disparate data sources.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.