SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Highly Confidential' sensitivity label to emails containing a specific credit card pattern. Which solution should they use?
⚠ Common exam trap
Many candidates confuse the automatic labeling capability of Microsoft Purview DLP with Microsoft Sentinel's ability to detect threats, but Sentinel cannot apply sensitivity labels to content based on data patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention
Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically apply sensitivity labels to emails based on content inspection, such as detecting credit card patterns using built-in sensitive info types. DLP policies can be configured to classify and label messages in transit in Exchange Online, ensuring the 'Highly Confidential' label is applied before the email leaves the organization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution designed to collect security data from various sources, detect threats using analytics, and orchestrate automated responses. While it can monitor security events related to data, including access to sensitive information, it does not possess the inherent capability to scan content for sensitive data and then automatically apply Microsoft Purview sensitivity labels to documents, emails, or other files. Its function is threat detection and response, not content classification and labeling.
- ✓
Microsoft Purview Data Loss Prevention
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations within the Microsoft 365 environment and beyond. DLP policies can be configured with rules that detect specific types of sensitive information, such as financial data or personally identifiable information (PII), within content. Upon detection, these policies can be set to automatically apply a designated Microsoft Purview sensitivity label to the content, thereby enforcing predefined protection actions like encryption, access restrictions, or visual markings.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility, control, and threat protection for cloud applications and services. While it can enforce policies on data residing in or traveling through cloud applications and integrate with sensitivity labels for monitoring or blocking actions on already labeled data, its core functionality does not include automatically scanning content for sensitive information and applying Microsoft Purview sensitivity labels. Its primary role is to govern cloud app usage and data flow, not content classification.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit (encompassing Standard and Premium tiers) is a crucial solution for recording and retaining user and administrator activities across Microsoft 365 services. Its primary purpose is to provide an immutable log of events for forensic investigations, compliance reporting, and regulatory requirements, offering insights into who did what, when, and where. However, Microsoft Purview Audit is a logging and reporting service and does not possess any mechanism to actively scan content for sensitive information or automatically apply Microsoft Purview sensitivity labels to documents or emails based on their content.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Exchange Online
Exchange Online is Microsoft's cloud-based email, calendar, and contact hosting service that is part of the Microsoft 365 suite, allowing organizations to manage corporate messaging without maintaining their own mail servers.
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.