Design solutions that align with security best practices and priorities →hardMultiple SelectObjective-mapped
Top Three Purview Capabilities for GDPR and CCPA Compliance
You are designing a Microsoft Purview data security solution for a multinational organization subject to GDPR and CCPA. Which THREE Purview capabilities should you include to meet regulatory requirements?
Quick Answer
The answer is Data classification and sensitivity labels, Data Loss Prevention (DLP) policies, and Microsoft Purview Audit. These three capabilities are correct because they form the core of a data security solution that meets GDPR and CCPA compliance requirements: classification and labels identify and tag sensitive data like PII, DLP policies enforce protective actions such as blocking unauthorized sharing of that data across email and endpoints, and Audit provides the detailed logging of access and processing activities necessary to demonstrate regulatory accountability. On the Microsoft Cybersecurity Architect exam, this question tests your ability to map Purview’s technical controls to specific regulatory mandates rather than just listing features; a common trap is selecting Information Protection alone without the enforcement layer of DLP or the logging layer of Audit. Remember the mnemonic “C-D-A” for Compliance: Classify, Defend, Audit.
⚠ Common exam trap
Watch out — candidates often confuse 'detective' controls (like eDiscovery) with 'preventive' controls (like DLP and sensitivity labels), or they mistakenly think retention policies alone satisfy data security requirements, when in fact GDPR and CCPA demand active protection against data breaches and unauthorized disclosure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policies
Data Loss Prevention (DLP) policies are correct because they allow the organization to detect and prevent the accidental or intentional sharing of sensitive data—such as personally identifiable information (PII) covered under GDPR and CCPA—across email, SharePoint, OneDrive, and endpoints. By scanning content for sensitive information types (e.g., credit card numbers, EU passport numbers) and applying protective actions (e.g., blocking transmission, showing policy tips), DLP directly enforces data protection mandates required by these regulations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Loss Prevention (DLP) policies
Why this is correct
Prevents unauthorized sharing of personal data.
- ✗
Advanced eDiscovery
Why it's wrong here
Used for legal investigation, not ongoing data security compliance.
- ✓
Microsoft Purview Audit (Premium) and Activity Explorer
Why this is correct
Provides detailed logging for compliance evidence.
- ✓
Data classification and sensitivity labels
Why this is correct
Required to identify and protect personal data.
- ✗
Data Lifecycle Management (retention policies)
Why it's wrong here
Important for governance but not a direct security control for CCPA/GDPR.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE of the following are valid ways to protect sensitive data in Microsoft 365 using Microsoft Purview? (Choose three.)
hard- ✓ A.Sensitivity labels
- ✓ B.Data Loss Prevention (DLP) policies
- ✓ C.Data Lifecycle Management (retention policies)
- D.Conditional Access policies
- E.Microsoft Defender for Endpoint
Why A: Sensitivity labels are a core Microsoft Purview Information Protection capability that allows you to classify and protect data at the item level. They can apply encryption, visual markings (headers/footers/watermarks), and enforce rights management (Azure RMS) directly on documents and emails, ensuring protection persists even when data leaves Microsoft 365.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.