Design solutions that align with security best practices and priorities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Your company uses Microsoft Purview to classify and label sensitive data. The data protection team needs to automatically apply a 'Confidential' label to documents that contain a custom sensitive info type for employee IDs. Which should you create?
⚠ Common exam trap
It's easy for candidates to confuse the role of a sensitivity label (which is just the label definition) with the auto-labeling policy (which provides the detection and automation), leading them to select only the sensitivity label without the necessary policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A custom sensitive information type and an auto-labeling policy
To automatically apply a 'Confidential' label based on the presence of a custom sensitive info type (employee IDs), you need both a custom sensitive information type (SIT) to define the pattern and an auto-labeling policy to trigger the label application. The auto-labeling policy uses the SIT to scan documents and automatically applies the specified sensitivity label when a match is found. This is the only option that combines the detection mechanism with automated labeling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A trainable classifier
Why it's wrong here
A trainable classifier applies machine learning to identify content based on curated positive and negative examples, which is suitable for broad document types like resumes or contracts. However, an employee ID with a precise alphanumeric pattern (e.g., a regex) is best detected by an exact data-match engine, not by ML, because ML cannot reliably enforce a fixed pattern without deterministic validation. Additionally, trainable classifiers in Microsoft Purview do not provide a native mechanism to define a custom pattern or trigger an immediate auto-labeling action based on a specific identifier.
- ✗
A sensitivity label
Why it's wrong here
A sensitivity label itself is purely a metadata container that specifies classification (e.g., Confidential) and optional protection actions like encryption or watermarks. It has no built-in detection logic to scan file content for an employee ID pattern, so it cannot autonomously identify which documents contain that data. To apply it automatically, you must pair it with an auto-labeling policy that references a sensitive information type — on its own, a sensitivity label is inert and requires manual or policy-driven assignment.
- ✗
A retention label
Why it's wrong here
A retention label is designed to govern data lifecycle management — for example, how long to keep content, when it should be disposed, or whether to apply a legal hold. It does not classify or protect content based on sensitivity, nor does it contain any pattern-matching rules to detect employee IDs. Therefore, using a retention label would only address record-keeping requirements, not the need to identify and label sensitive employee data automatically.
- ✓
A custom sensitive information type and an auto-labeling policy
Why this is correct
A custom sensitive information type (SIT) lets you define a precise regex or keyword-based pattern for the employee ID, giving Purview deterministic detection logic for that exact structure. An auto-labeling policy then continuously scans documents in SharePoint, OneDrive, and Exchange for that SIT and automatically applies a sensitivity label when matches are found. Together, these two components provide end-to-end, content-based discovery and labeling — the correct combination for classifying files based on a custom employee ID pattern.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.