SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft 365 E5 and wants to implement information protection for sensitive data. They need to automatically apply sensitivity labels to documents stored in SharePoint Online based on the presence of credit card numbers. Which Microsoft Purview feature should they use?
⚠ Common exam trap
Many exam-takers confuse DLP, which blocks sharing, with auto-labeling, which applies classification labels to content at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels with auto-labeling policies
Auto-labeling policies for sensitivity labels in Microsoft Purview are designed to automatically classify and label content in SharePoint Online and other locations when it matches sensitive information types. This provides persistent protection and meets the requirement. DLP prevents sharing but does not label, retention manages lifecycle, and insider risk management detects risky behavior, so none of those automatically apply labels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sensitivity labels with auto-labeling policies
Why this is correct
Sensitivity labels with auto-labeling policies in Microsoft Purview can automatically apply labels to documents in SharePoint Online when they match sensitive information types like credit card numbers. This feature scans content and applies the configured label, enabling persistent protection. It directly fulfills the requirement to automatically classify and label data based on content.
- ✗
Data loss prevention (DLP) policies
Why it's wrong here
DLP policies in Microsoft Purview are designed to prevent the sharing of sensitive information, such as blocking emails or file uploads containing credit card numbers. However, DLP does not automatically apply sensitivity labels to documents at rest. It enforces protective actions but does not classify content with labels, so it does not meet the requirement for automatic labeling.
- ✗
Retention labels and retention policies
Why it's wrong here
Retention labels and policies define how long content is kept or when it is deleted, not how it is classified. They help with compliance and data lifecycle management but do not apply sensitivity labels based on content inspection. Therefore, they cannot automatically label documents containing credit card numbers; they focus on retention, not protection.
- ✗
Insider risk management policies
Why it's wrong here
Insider risk management identifies and investigates risky user activities, such as data theft or leaks, but it does not apply sensitivity labels to documents. Its purpose is to detect and remediate insider threats, not to classify content. It cannot automatically label files in SharePoint Online based on credit card numbers, so it is not the correct tool.
Go deeper
Related to this question
Learn chapter
Named Locations in Conditional Access
Key term
Information protection
Information protection refers to the policies, procedures, and technologies used to safeguard data from unauthorized access, disclosure, alteration, or destruction.
Key term
Insider Risk Management
Insider Risk Management is the practice of identifying, assessing, and mitigating threats that originate from within an organization, such as employees, contractors, or partners who have legitimate access to systems and data.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.