Describe the capabilities of Microsoft compliance solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

A company stores HR documents in SharePoint Online. The compliance team wants to automatically apply a sensitivity label that encrypts the document whenever it contains a passport number. They do not want users to be able to override this classification. Which Microsoft Purview solution should they configure?

⚠ Common exam trap

Many candidates confuse DLP policies with auto-labeling, assuming DLP can also apply encryption labels, but DLP only detects and blocks actions—it does not automatically classify or encrypt content.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Auto-labeling policy for sensitivity labels

An auto-labeling policy for sensitivity labels can automatically apply a sensitivity label (e.g., 'Highly Confidential') that encrypts documents when they contain sensitive data like passport numbers. This policy can be configured to enforce mandatory labeling without allowing user override, meeting the compliance team's requirement. In contrast, a DLP policy can detect and block sharing of sensitive data but does not apply encryption labels automatically.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Data Loss Prevention (DLP) policy
Why it's wrong here
A Data Loss Prevention (DLP) policy primarily focuses on identifying, monitoring, and protecting sensitive information across various locations to prevent its unauthorized sharing or exfiltration. While DLP policies can detect sensitive content like HR documents, their core function is to block or alert on sharing activities, not to automatically apply sensitivity labels or encrypt the documents themselves as a primary classification method.
When this WOULD be correct
A DLP policy would be correct if the question asked for a solution to prevent users from sharing documents containing passport numbers via email or external sharing, without requiring encryption or label application.
✓
Auto-labeling policy for sensitivity labels
Why this is correct
An auto-labeling policy for sensitivity labels automatically applies a pre-defined label to content, such as HR documents in SharePoint Online, when specific conditions are met. These conditions often include the detection of sensitive information types like passport numbers or national ID numbers. The applied label can enforce protection actions, including encryption, and can be configured to prevent users from changing or removing the label, ensuring consistent data protection.
✗
Retention policy
Why it's wrong here
A retention policy is designed to manage the lifecycle of content by specifying how long it should be kept or when it should be deleted. It ensures compliance with data retention regulations by preserving data for a defined period or disposing of it after its utility expires. However, retention policies do not automatically classify documents based on their content or apply encryption for real-time data protection.
When this WOULD be correct
A retention policy would be correct if the question asked: 'The compliance team wants to ensure that HR documents are kept for 7 years and then permanently deleted. Which solution should they configure?'
✗
Communication compliance policy
Why it's wrong here
A communication compliance policy is specifically designed to monitor and review electronic communications within an organization, such as emails, Microsoft Teams chats, and Yammer messages, for policy violations. It helps detect and investigate inappropriate content, harassment, or regulatory non-compliance in user interactions. This type of policy does not, however, automatically classify or encrypt documents stored in SharePoint Online.
When this WOULD be correct
A company wants to detect and prevent employees from sharing passport numbers in email or Teams messages, and automatically flag or quarantine such communications for review by a compliance officer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

✓Auto-labeling policy for sensitivity labelsCorrect answer▾

Why this is correct

An auto-labeling policy for sensitivity labels automatically applies a pre-defined label to content, such as HR documents in SharePoint Online, when specific conditions are met. These conditions often include the detection of sensitive information types like passport numbers or national ID numbers. The applied label can enforce protection actions, including encryption, and can be configured to prevent users from changing or removing the label, ensuring consistent data protection.

✗Data Loss Prevention (DLP) policyWrong answer — click to see why▾

Why this is wrong here

A DLP policy can detect passport numbers and block sharing, but it cannot automatically apply sensitivity labels that encrypt documents. The requirement is to apply a sensitivity label with encryption, which is a feature of auto-labeling policies, not DLP.

★ When this WOULD be the correct answer

A DLP policy would be correct if the question asked for a solution to prevent users from sharing documents containing passport numbers via email or external sharing, without requiring encryption or label application.

Why candidates choose this

Candidates often confuse DLP with auto-labeling because both can detect sensitive content; they may assume DLP can also apply labels, but DLP focuses on preventing data loss, not on classification and protection via labels.

✗Retention policyWrong answer — click to see why▾

Why this is wrong here

A retention policy is used to retain or delete content based on time, not to classify or encrypt documents based on content. It cannot automatically apply sensitivity labels or enforce encryption.

★ When this WOULD be the correct answer

A retention policy would be correct if the question asked: 'The compliance team wants to ensure that HR documents are kept for 7 years and then permanently deleted. Which solution should they configure?'

Why candidates choose this

Candidates may confuse retention policies with labeling policies because both involve managing document lifecycle and compliance, but retention policies focus on time-based actions, not content-based classification.

✗Communication compliance policyWrong answer — click to see why▾

Why this is wrong here

Communication compliance policies detect and remediate inappropriate messages (e.g., harassment, sensitive info sharing) in communications like email and Teams, not automatically classify or encrypt documents in SharePoint based on content.

★ When this WOULD be the correct answer

A company wants to detect and prevent employees from sharing passport numbers in email or Teams messages, and automatically flag or quarantine such communications for review by a compliance officer.

Why candidates choose this

Candidates may confuse communication compliance with auto-labeling because both involve detecting sensitive information, but communication compliance focuses on communications rather than document classification and encryption.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Why each option matters

Option-by-option breakdown

Why each answer is right or wrong

Related to this question