SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization uses Microsoft Purview. You need to design a solution that automatically detects and classifies sensitive data such as passport numbers stored in Microsoft OneDrive. The solution should apply a 'Highly Confidential' sensitivity label without user intervention. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an auto-labeling policy in Microsoft Purview that targets OneDrive and includes the 'Passport Number' sensitive info type.
Option A is correct because an auto-labeling policy in Microsoft Purview is the feature designed to automatically detect sensitive information types (such as 'Passport Number') in locations like OneDrive and apply a sensitivity label like 'Highly Confidential' without user intervention. Auto-labeling policies use the sensitive info type as a condition and can apply the label directly to matching content. Option B is incorrect because a DLP policy blocks or restricts sharing; it does not apply sensitivity labels. Option C is incorrect because auditing only records activity and does not classify or label data. Option D is incorrect because manual labeling requires user action, which contradicts the no-user-intervention requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an auto-labeling policy in Microsoft Purview that targets OneDrive and includes the 'Passport Number' sensitive info type.
Why this is correct
An auto-labeling policy in Microsoft Purview is designed to automatically evaluate content against sensitive info types like 'Passport Number' and apply the corresponding sensitivity label without user interaction. By targeting OneDrive locations, the policy continuously scans files, and when a match is found, it assigns the label and can enforce encryption or protection. This directly fulfills the requirement because classification happens automatically based on content inspection, not on user discretion or manual workflow.
- ✗
Create a Data Loss Prevention (DLP) policy that blocks sharing of files with passport numbers.
Why it's wrong here
A Data Loss Prevention (DLP) policy is a control that monitors and blocks risky sharing or transfer of sensitive information, such as files containing passport numbers. While DLP uses the same sensitive info types for detection, its purpose is to enforce protective actions—like blocking sharing or applying encryption to external recipients—rather than to apply sensitivity labels for identification and governance. Therefore, a DLP policy would not satisfy the requirement to automatically label documents; it would only restrict their distribution.
- ✗
Enable auditing in Microsoft Purview to track where passport numbers are stored.
Why it's wrong here
Enabling auditing in Microsoft Purview records user and administrative activities across the environment, including file access, sharing, and label changes. Auditing is a detective control that helps you investigate and report on where passport numbers might be stored or accessed, but it does not perform content inspection or classification. Since auditing never scans the actual contents of files to identify sensitive data types, it cannot automatically apply sensitivity labels to the documents that contain passport numbers.
- ✗
Configure a manual sensitivity label and train users to apply it.
Why it's wrong here
Configuring a manual sensitivity label and training users to apply it relies entirely on end-user behavior, which the requirement explicitly does not allow because the solution must be automatic. Manual labeling introduces inconsistency, is error-prone, and scales poorly across large repositories of documents, leaving sensitive data unclassified when users forget or mislabel. In contrast, an automatic labeling policy inspects content and labels it deterministically, so manual labeling is neither reliable nor compliant with the stated need to automatically label files with passport numbers.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 605 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.