Design security operations, identity, and compliance capabilities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization uses Microsoft Purview and needs to prevent users from copying sensitive data to USB drives. Which solution should you implement?
⚠ Common exam trap
A common mix-up: candidates confuse Insider Risk Management (a detective control) with Endpoint DLP (a preventive control), assuming that risk management can block actions, when in fact it only alerts on suspicious behavior after the fact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Endpoint data loss prevention (DLP)
Endpoint DLP is the correct solution because it extends data loss prevention policies to endpoints, enabling the detection and blocking of sensitive data being copied to removable USB drives. Unlike other controls, Endpoint DLP can monitor and restrict data exfiltration actions at the device level, such as copying files to USB media, based on the content's sensitivity classification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Sensitivity labels with encryption
Why it's wrong here
Sensitivity labels with encryption classify data and restrict access to authorized users, but they do not enforce device-level controls. Even when a file is encrypted, a user with legitimate permissions can decrypt and then copy the content to a USB drive. The label travels with the file but can only block access, not the physical act of extracting data to removable media. Therefore, labeling alone fails to meet the requirement.
- ✗
Insider Risk Management
Why it's wrong here
Insider Risk Management is a detective and investigative solution that uses behavioral signals to identify potential data theft, not an enforcement mechanism. It generates alerts and cases for security teams, but it cannot intercept or block a copy operation in real time as it happens. While it can be integrated with DLP to increase severity, the risk management feature itself lacks the native capability to prevent USB transfers.
- ✓
Endpoint data loss prevention (DLP)
Why this is correct
Endpoint data loss prevention (Endpoint DLP) is the correct choice because it installs an agent on Windows and macOS endpoints that inspects data in real time as users interact with files. It can enforce policies to block the copying of sensitive items, such as those matching sensitive info types or trainable classifiers, to removable USB devices, and optionally show a policy tip to the user. This direct, pre-action enforcement provides the precise control needed to prevent data leakage via USB.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance is designed to scan and monitor corporate communications, such as email and Microsoft Teams messages, for policy violations like harassment or inappropriate sharing. It does not monitor local endpoint file operations, nor does it have any ability to block a user from copying a sensitive document to a USB drive. The solution operates at the communication plane, not the device plane.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.