Design security operations, identity, and compliance capabilities →hardMultiple SelectObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to design a solution that automatically applies a 'Confidential' sensitivity label to documents that contain credit card numbers and are shared externally. The solution should also generate an alert when this occurs. Which two configurations should you implement? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Microsoft Purview auto-labeling policy that includes the 'Credit Card Number' sensitive info type and specifies the 'Confidential' label.
Options D and E are correct because an auto-labeling policy in Microsoft Purview can scan for sensitive info types (credit card numbers) and automatically apply the 'Confidential' label to documents. A Microsoft Defender for Cloud Apps app governance policy can monitor file sharing and trigger an alert when a document with the 'Confidential' label is shared externally. Option A (Microsoft Sentinel analytics rule) could generate alerts but is not the primary mechanism for labeling, and option B (Conditional Access) controls access, not labeling. Option C (Data Loss Prevention) is for blocking, not labeling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Microsoft Sentinel analytics rule that queries audit logs for external sharing of labeled documents and generates an incident.
Why it's wrong here
A Microsoft Sentinel analytics rule can only alert on external sharing events that have already occurred and been written to audit logs; it is a reactive detection control, not a mechanism for applying sensitivity labels to documents. The rule would require an already-applied 'Confidential' label and an existing sharing event, so it fails to address the requirement to automatically classify content containing credit card numbers. Auto-labeling, by contrast, inspects content at creation or modification time and assigns the label proactively.
- ✗
Create a Conditional Access policy in Microsoft Entra ID that requires device compliance when accessing documents labeled 'Confidential'.
Why it's wrong here
A Conditional Access policy in Microsoft Entra ID enforces access conditions (such as device compliance) when users attempt to access a labeled document, but it does not apply labels to files nor does it alert on external sharing. Since the label must already be present on the document, this option is orthogonal to the stated requirement of automatic classification based on credit card numbers. Conditional Access governs authentication and access context, not content inspection or label assignment.
- ✗
Configure a Microsoft Purview Data Loss Prevention (DLP) policy that blocks the sharing of documents containing credit card numbers.
Why it's wrong here
A Microsoft Purview Data Loss Prevention (DLP) policy can block the sharing of content that matches a sensitive info type like credit card numbers, but it does not apply sensitivity labels to that content. DLP is a separate protection control that makes decisions based on content inspection and policies, whereas auto-labeling is specifically designed to assign classification metadata (labels) based on the same types of matching. These two features complement each other, but only auto-labeling fulfills the requirement to label the documents.
- ✓
Create a Microsoft Purview auto-labeling policy that includes the 'Credit Card Number' sensitive info type and specifies the 'Confidential' label.
Why this is correct
A Microsoft Purview auto-labeling policy directly meets the requirement by using Microsoft 365 built-in sensitive info types (e.g., 'Credit Card Number') to inspect content and automatically assign the 'Confidential' sensitivity label. This is an automated classification control that runs in the background, scanning files in SharePoint, OneDrive, Exchange, and other supported workloads, and can be configured with a simulation mode before enforcement. It is the only option that both detects the sensitive data and applies the label as an end result.
- ✓
Create a Microsoft Defender for Cloud Apps app governance policy that monitors file sharing and triggers an alert when a document with a 'Confidential' label is shared externally.
Why this is correct
A Microsoft Defender for Cloud Apps app governance policy monitors file activity and can generate alerts when a document with an existing 'Confidential' label is shared externally, but this is a monitoring and alerting control, not a labeling mechanism. It requires the label to already be applied by another process such as auto-labeling or manual classification, so it does not satisfy the core requirement of labeling documents containing credit card numbers. While this option could serve as a complementary alerting layer, it cannot replace the need for an auto-labeling policy.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.