SC-100 Practice Question: Design security operations, identity, and compliance capabilities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a trainable classifier to detect credit cards

  Why it's wrong here

  A trainable classifier in Microsoft Purview is a machine-learning model that recognizes content patterns, such as credit card numbers, but it is purely a detection mechanism. By itself, it cannot apply a sensitivity label or trigger encryption; it only identifies content that can be used as a condition in other policies. To protect the detected data, you must pair the classifier with an auto-labeling policy that takes the action of applying an encrypted label. Thus, while this is a valid detection method, it does not meet the requirement for automatic protection on its own.

• ✓

  Create an auto-labeling policy that applies a label with encryption for external sharing

  Why this is correct

  An auto-labeling policy in Microsoft Purview can automatically detect credit card numbers using sensitive information types or classifiers and then apply a sensitivity label that is configured with encryption. By specifying that the label be applied only when content is shared externally, the policy ensures that documents containing credit card data are encrypted upon external sharing, while internal collaboration remains unaffected. This satisfies the requirement for automatic, content-aware protection without user intervention, making it the correct solution.

• ✗

  Create a default label policy for SharePoint

  Why it's wrong here

  A default label policy for SharePoint assigns a specified sensitivity label to every document in a site or library, regardless of its content. Because it does not evaluate whether credit card numbers are present, it either over-encrypts all documents (if the label has encryption) or leaves sensitive data unprotected (if the label lacks encryption). This static approach fails to target only documents that contain credit card information, and it does not react to external sharing events. Therefore, it cannot fulfill the requirement for content-based, automatic protection.

• ✗

  Create a manual sensitivity label that users apply

  Why it's wrong here

  Manual sensitivity labeling depends entirely on users to recognize and classify documents containing credit card numbers. This approach is inherently error-prone and inconsistent, as users may forget to apply a label, misinterpret the content, or apply an incorrect label without encryption. Even if a manual label includes encryption, it is not automatically triggered by external sharing, and enforcement relies on user compliance. Consequently, manual labeling does not provide the automatic, reliable protection required for sensitive credit card data.

Go deeper

Related to this question