SC-100 Practice Question: Design security solutions for applications and data

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create Data Loss Prevention (DLP) policies.

  Why it's wrong here

  Data Loss Prevention (DLP) policies are enforcement mechanisms that inspect content in transit and at rest to block email or sharing that violates rules, but they do not embed classification metadata into documents, so Copilot cannot infer the intended sensitivity level from them. Without sensitivity labels, Copilot lacks the data map it needs to apply least-privilege access. Therefore, DLP alone fails to define sensitivity, making this option incorrect.

• ✓

  Configure sensitivity labels in Microsoft Purview Information Protection.

  Why this is correct

  Sensitivity labels in Microsoft Purview Information Protection apply persistent, tamper-proof metadata to content—such as confidentiality, encryption, and visual markings—which Copilot for Microsoft 365 explicitly consumes to determine whether it may summarize, extract, or generate from the underlying data. Because the labels are honored inside the Microsoft 365 ecosystem, they provide the granular, per-item control needed to govern AI responses. This is the correct answer as it establishes classification at the source.

• ✗

  Use Azure Information Protection.

  Why it's wrong here

  Azure Information Protection (AIP) was the previous standalone classification and labeling solution, but Microsoft has converged that functionality into Microsoft Purview Information Protection and the unified sensitivity label infrastructure, with the AIP client being deprecated for built-in labeling in Microsoft 365 apps. Using AIP today is effectively using an out-of-date tool that lacks the integrated classification pipeline that Copilot requires. Thus, while AIP is conceptually related, it is the wrong implementation for a modern Copilot deployment.

• ✗

  Apply retention labels to documents.

  Why it's wrong here

  Retention labels are lifecycle controls that specify how long content must be kept or when it should be deleted, and they are not intended to convey confidentiality or access rights to AI systems. Copilot does not treat retention labels as a signal for sensitivity; instead, it relies on sensitivity labels, which encode the actual classification of data. Accordingly, applying retention labels without sensitivity labels leaves Copilot unaware of which content is privileged, so this approach is incorrect for the stated requirement.

Go deeper

Related to this question