Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Your organization plans to use Microsoft Purview to protect sensitive data in Microsoft 365. The compliance team needs to detect when users share credit card numbers via email and automatically apply encryption. Which solution should you implement?

⚠ Common exam trap

Microsoft often tests the distinction between Information Protection (labeling/classification) and Data Loss Prevention (content inspection and automated enforcement), leading candidates to pick Information Protection because they confuse 'protecting data' with 'detecting and acting on sensitive content.'

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Purview Data Loss Prevention (DLP)

Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data types—such as credit card numbers—in email messages and automatically apply protective actions like encryption. DLP policies can inspect email content in transit via Exchange Online, match patterns against predefined sensitive info types (e.g., credit card number regex), and trigger actions such as 'Encrypt the message' using Azure Rights Management. This directly meets the requirement to detect sharing of credit card numbers and enforce encryption automatically.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit records user and admin activities across Exchange Online, SharePoint Online, and other workloads, providing forensic visibility for compliance reviews. However, Audit is purely a detective control—it captures events and cannot invoke protective actions such as encryption, blocking, or rights management. Since it has no policy engine to alter message content, it cannot automatically encrypt outgoing email.
✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery is designed for legal discovery, allowing you to search, hold, and export content from mailboxes, sites, and Teams for litigation or regulatory investigations. Its purpose is to preserve evidence, not to secure data in transit or at rest. It lacks any real-time content inspection or remediation capability, so it cannot automatically apply encryption based on data sensitivity.
✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection provides sensitivity labels and classification to encrypt and protect documents and emails, but that protection is applied through user selection or classifier-driven labeling, not through transport-level rules. While labels can include encryption, the automatic enforcement for email relies on user action or DLP integration, not on the labeling engine itself. Hence, it does not natively auto-encrypt emails as a standalone feature.
✓
Microsoft Purview Data Loss Prevention (DLP)
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) policies continuously monitor emails for sensitive information types such as credit card numbers or social security numbers, and when a match is detected, the policy can automatically trigger protection actions. In Exchange Online, DLP leverages transport rules to apply IRM encryption to outbound messages, ensuring only intended recipients can read them. This capability directly aligns with the requirement to automatically encrypt emails based on content, making DLP the correct choice.

Go deeper

SC-100 Practice Question: Design solutions that align with security best practices and priorities

Why each option matters

Option-by-option breakdown

Related to this question