Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped
Automatically Label Sensitive Data in SharePoint Online Using Microsoft Purview Auto-Labeling Policies
Your organization is migrating to Microsoft 365 and wants to implement a data classification strategy. The compliance team needs to automatically detect and label documents containing personal data (e.g., Social Security numbers) in SharePoint Online. Which Microsoft Purview solution should you use?
Quick Answer
The answer is auto-labeling policies in Microsoft Purview. This solution is correct because it automatically detects sensitive data types, such as Social Security numbers, using built-in or custom sensitive information types and then applies the appropriate sensitivity labels to documents in SharePoint Online without requiring any user intervention, directly meeting the compliance team’s need for automated detection and labeling. On the Microsoft Cybersecurity Architect exam, this scenario tests your understanding of how Purview’s auto-labeling differs from manual or default labeling policies—a common trap is confusing it with retention labels or DLP policies, which do not apply sensitivity labels. Remember: if the requirement is to automatically detect and label data at rest in SharePoint, think “auto-labeling policies.” A useful memory tip is “Auto for At-rest”—auto-labeling handles data already stored, while DLP focuses on data in motion.
⚠ Common exam trap
Watch out — candidates often confuse Data Loss Prevention (DLP) policies with auto-labeling policies, as both can detect sensitive data, but DLP policies enforce protective actions (block/alert) while auto-labeling policies apply sensitivity labels for classification and downstream protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-labeling policies
Auto-labeling policies in Microsoft Purview are designed to automatically detect sensitive data types (e.g., Social Security numbers) using built-in or custom sensitive information types and apply sensitivity labels to documents in SharePoint Online. This meets the requirement for automatic detection and labeling without user intervention, as the compliance team needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Auto-labeling policies
Why this is correct
Auto-labeling uses sensitive info types to automatically apply labels.
- ✗
Records Management
Why it's wrong here
Records Management manages retention, not classification.
- ✗
eDiscovery
Why it's wrong here
eDiscovery finds content but doesn't apply labels automatically.
- ✗
Data Loss Prevention policies
Why it's wrong here
DLP policies act on labeled data, they don't automatically classify.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company uses Microsoft Purview to classify and label sensitive data. The data protection team needs to automatically apply a 'Confidential' label to documents that contain a custom sensitive info type for employee IDs. Which should you create?
medium- A.A trainable classifier
- B.A sensitivity label
- C.A retention label
- ✓ D.A custom sensitive information type and an auto-labeling policy
Why D: To automatically apply a 'Confidential' label based on the presence of a custom sensitive info type (employee IDs), you need both a custom sensitive information type (SIT) to define the pattern and an auto-labeling policy to trigger the label application. The auto-labeling policy uses the SIT to scan documents and automatically applies the specified sensitivity label when a match is found. This is the only option that combines the detection mechanism with automated labeling.
Variation 2. Your organization uses Microsoft Purview Information Protection to classify and protect sensitive data. The compliance team wants to automatically apply a 'Highly Confidential' sensitivity label to emails that contain credit card numbers. Which solution should you configure?
hard- ✓ A.Microsoft Purview auto-labeling policy
- B.Microsoft Defender for Office 365 Safe Attachments policy
- C.Microsoft 365 Data Loss Prevention (DLP) policy
- D.Microsoft Endpoint DLP
Why A: Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to emails containing credit card numbers based on sensitive information types. Option B (Microsoft Defender for Office 365 Safe Attachments) is incorrect because it focuses on scanning email attachments for malware, not on classification. Option C (Microsoft 365 DLP policy) is incorrect because DLP policies can block or warn but do not directly apply sensitivity labels. Option D (Microsoft Endpoint DLP) is incorrect because it applies to data on endpoints, not to emails.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.