SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to receive alerts when a user attempts to share a file containing personally identifiable information (PII) via email. Which DLP rule component is used to define the notification action?
⚠ Common exam trap
It's easy for candidates to confuse 'Conditions' with 'Actions', mistakenly thinking that defining what data to detect (Conditions) inherently includes the notification response, but in DLP rules, Conditions only specify the match criteria, while Actions separately define the enforcement and alerting behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Actions
In Microsoft Purview DLP, the 'Actions' component defines what happens when a DLP rule is triggered, including sending notifications or alerts to administrators. For the scenario of receiving alerts when a user attempts to share PII via email, the notification action is configured within the rule's Actions section. Conditions define what data to match, Locations specify where to monitor, and Exceptions refine rule scope, but only Actions contain the notification settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Actions
Why this is correct
Actions are the core component of a Microsoft Purview DLP policy that dictates the response when content matches the defined conditions. These actions can include blocking access to the content, notifying users or administrators, encrypting the data, or applying retention labels. For instance, a DLP policy might be configured to block sharing of documents containing sensitive data externally and simultaneously send an alert to the security team. This directly addresses what happens when a DLP match occurs.
- ✗
Conditions
Why it's wrong here
In Microsoft Purview DLP policies, conditions specify the criteria that must be met for a rule to trigger, such as the presence of specific sensitive information types (e.g., credit card numbers, national ID numbers), keywords, or content properties. While essential for identifying sensitive data, conditions solely define *what* to look for within content, not *what happens* after that content is identified as matching the policy. Therefore, conditions do not define the action taken when a DLP match occurs.
- ✗
Location
Why it's wrong here
The location setting in a Microsoft Purview DLP policy determines the specific services or repositories where the policy will be enforced. This includes common locations like Exchange email, SharePoint sites, OneDrive accounts, Microsoft Teams chats and channels, and even endpoint devices. While crucial for defining the scope of protection, specifying a location merely indicates *where* the DLP policy is active, not the specific remedial or preventative steps that are executed when a policy match is detected within that environment.
- ✗
Exceptions
Why it's wrong here
Exceptions in a Microsoft Purview DLP policy define specific conditions under which a rule, even if its primary conditions are met, will *not* be applied. For example, an exception might be configured to allow specific users or groups to share sensitive information externally, or to ignore certain file types. These exceptions serve to refine the policy's application by creating carve-outs, but they do not define the proactive or reactive measures taken when a policy *is* enforced and a match occurs.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.