Design security solutions for infrastructure →easyMultiple Select

SC-100 Design security solutions for infrastructure Practice Question

Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)

⚠ Common exam trap

SC-100 often tests the distinction between preventive data protection controls (labels, DLP) and detective/investigative tools (Audit, Insider Risk, eDiscovery) — candidates pick Audit or Insider Risk because they sound security-related but do not actually protect data.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Sensitivity labels and policies.

Sensitivity labels and policies (C) are correct because they apply persistent protection to content by classifying data and enforcing encryption, content marking, and usage restrictions that travel with the file or email across Microsoft 365 workloads. Data Loss Prevention (DLP) policies (E) are correct because they detect sensitive information types and take protective actions such as blocking, warning, or encrypting data when it is shared inappropriately in Exchange Online, SharePoint, OneDrive, and Teams. Audit (A) is not a protection solution; it records and searches user and admin activity for investigation and compliance reporting. Insider Risk Management (B) focuses on detecting and remediating risky user behavior rather than directly protecting sensitive data. eDiscovery (D) is used to identify, preserve, collect, and review content for legal or investigative purposes, not to enforce data protection.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Microsoft Purview Audit.
Why it's wrong here
Audit records user and admin activity for investigation and compliance reporting; it does not classify, label or encrypt content. It is tempting because Audit underpins visibility across Microsoft 365, and would be correct if the requirement were detecting and investigating suspicious activity rather than actively protecting sensitive data.
✗
Insider Risk Management.
Why it's wrong here
Insider Risk Management detects risky user behaviour through signals and analytics; it does not apply classification labels, encryption or access restrictions to content. It is tempting because it is a Purview solution addressing data risk, and would be correct if the requirement were identifying and remediating insider threats rather than protecting data at rest.
✓
Sensitivity labels and policies.
Why this is correct
Sensitivity labels apply persistent encryption and visual markings directly to content, satisfying the requirement to protect sensitive data at the item level across Microsoft 365 workloads. Unlike perimeter controls, labels travel with the file, enforcing protection even after it leaves the tenant, which is precisely what the scenario demands.
✗
Microsoft Purview eDiscovery.
Why it's wrong here
eDiscovery identifies, preserves and exports content for legal and investigative workflows; it does not enforce classification, labelling or encryption policies. It is tempting because it operates across Microsoft 365 content, and would be correct if the requirement were responding to litigation or regulatory requests rather than protecting sensitive data.
✓
Data Loss Prevention (DLP) policies.
Why this is correct
DLP policies inspect Exchange, SharePoint, OneDrive and Teams content for sensitive information types and block or warn on risky sharing, satisfying the requirement to protect data at rest and in motion within Microsoft 365 workloads. They enforce policy at the workload layer rather than relying on user judgement or manual classification alone.

Go deeper

SC-100 Design security solutions for infrastructure Practice Question

Why each option matters

Option-by-option breakdown

Related to this question