SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company uses Microsoft 365 and wants to automatically classify documents based on sensitive information types like Social Security numbers. Which Microsoft Purview feature should be used?
⚠ Common exam trap
Test-takers frequently confuse the feature that performs the initial classification (Data Classification) with the downstream enforcement tools (DLP) or the labeling mechanism (Sensitivity Labels), leading them to select DLP or Sensitivity Labels instead of the correct classification service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Classification
Microsoft Purview Data Classification is the correct feature because it automatically scans and classifies documents based on sensitive information types (e.g., Social Security numbers) using built-in or custom classifiers. This enables organizations to identify and label content without manual intervention, directly addressing the requirement for automatic classification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is designed to help organizations detect and remediate policy violations within user communications, such as harassment, insider trading, or regulatory compliance breaches. It leverages machine learning and predefined or custom policies to scan emails, Microsoft Teams chats, and other communication channels for specific content or patterns. While it can identify sensitive information within these communications, its primary function is monitoring and remediation of policy violations, not the initial automatic classification of data at rest or in transit for general data governance.
- ✓
Microsoft Purview Data Classification
Why this is correct
Microsoft Purview Data Classification provides the foundational capabilities for identifying, categorizing, and understanding the data within an organization's digital estate. It leverages a robust set of built-in sensitive information types (SITs), named entities, and trainable classifiers to automatically detect specific content patterns, such as credit card numbers, national ID numbers, or industry-specific data. This service is crucial for automatically tagging and labeling data based on its content, forming the basis for subsequent protection and governance actions.
- ✗
Microsoft Purview Data Loss Prevention
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) is primarily focused on preventing the unauthorized sharing, transfer, or use of sensitive information. DLP policies are configured to detect sensitive data, often identified by Data Classification, and then enforce actions like blocking, auditing, or notifying users when that data attempts to leave a defined boundary. While DLP relies on data classification to identify what to protect, its core function is protection and enforcement of data movement rules, not the initial automatic categorization of data itself.
- ✗
Microsoft Purview Sensitivity Labels
Why it's wrong here
Microsoft Purview Sensitivity Labels are a mechanism for applying persistent protection and visual markings to sensitive data, regardless of where it's stored or who it's shared with. These labels can be applied manually by users or automatically based on policies that leverage the output of Data Classification. While sensitivity labels are a direct result or action taken based on classification, they are not the underlying engine that performs the automatic content analysis and categorization to determine what *is* sensitive.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.