Design security operations, identity, and compliance capabilities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your company uses Microsoft Purview to protect sensitive data. You need to automatically apply a retention label to documents containing credit card numbers detected in SharePoint Online. What should you configure?
⚠ Common exam trap
Many exam-takers confuse retention labels with sensitivity labels, or assume DLP policies can apply retention labels directly, when in fact DLP applies sensitivity labels and auto-labeling policies are the correct mechanism for retention labels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an auto-labeling policy for retention labels targeting sensitive info types.
Auto-labeling policies in Microsoft Purview can automatically apply retention labels to documents based on sensitive info types, such as credit card numbers. This allows you to enforce retention rules without manual intervention, directly targeting the detected sensitive data in SharePoint Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Data Loss Prevention (DLP) policy to apply the label.
Why it's wrong here
Microsoft Purview DLP policies are enforcement mechanisms that detect sensitive data and apply protective actions such as blocking, restricting, or encrypting content; they do not assign retention labels. DLP policies rely on rules and conditions, but their actions are limited to access-related controls rather than lifecycle governance. Applying a retention label is inherently a labeling action, which DLP does not support as an outcome—DLP can merely suggest or use labels, not create them. Therefore, this option incorrectly conflates security enforcement with records retention management.
- ✗
Create a sensitivity label with auto-labeling for SharePoint.
Why it's wrong here
Sensitivity labels in Microsoft Purview are designed for classification and protection—enforcing encryption, permissions, or visual markings—not for retention decisions. While auto-labeling for SharePoint can automatically apply sensitivity labels based on sensitive info types, that action does not satisfy the need to retain data for a specific period or trigger disposition reviews. Retention labels, on the other hand, control deletion and retention, which is precisely what the scenario requires. Thus, this option addresses the wrong category of label, even though it correctly identifies auto-labeling as a valid mechanism.
- ✗
Use a trainable classifier to detect credit card numbers and apply the label.
Why it's wrong here
Trainable classifiers are not the appropriate mechanism for detecting credit card numbers, as these are pre-defined sensitive information types (SITs) within Microsoft Purview. A built-in SIT provides accurate, out-of-the-box detection for such structured data patterns. This option is tempting because trainable classifiers are indeed used for content classification and label application, but they are designed for identifying custom, unstructured data types based on examples, such as specific project documents or HR records, where no pre-defined pattern exists.
- ✓
Create an auto-labeling policy for retention labels targeting sensitive info types.
Why this is correct
An auto-labeling policy for retention labels is the correct solution because it natively supports automatic application of retention labels to content that matches sensitive info types, such as credit card numbers. These policies run across a tenant and can target SharePoint sites, OneDrive accounts, and Exchange mailboxes, evaluating content against built-in sensitive information types and applying the designated retention label. This approach directly aligns with the requirement to protect sensitive data while ensuring it is retained appropriately. Auto-labeling for retention labels is distinct from sensitivity-label auto-labeling, as it specifically governs data lifecycle rather than classification.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.