Microsoft Purview DLP: Configuring Policies for Credit Card Numbers Across Email, Teams, and Endpoints
A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from copying credit card numbers from an internal web application to a personal cloud storage app. Which DLP policy setting should they configure?
Quick Answer
The answer is Endpoint DLP with clipboard control. This setting is correct because it specifically governs how sensitive data, such as credit card numbers, can be copied from one application to another on a managed device, including blocking transfers to unauthorized personal cloud storage apps. On the Microsoft Security, Compliance, and Identity Fundamentals SC-900 exam, this question tests your understanding of how Purview DLP policies are scoped by workload—Endpoint DLP covers device-level actions like clipboard operations, while browser, email, and Teams DLP each protect only their respective channels. A common trap is to confuse browser DLP with endpoint controls, but remember that clipboard monitoring is an endpoint-only feature. For a quick memory tip: think of the clipboard as a physical bridge—only an endpoint guard can stop what crosses it.
⚠ Common exam trap
Test-takers frequently confuse Browser DLP (which only controls data within the browser) with the broader endpoint-level clipboard control needed to prevent cross-application data transfer, leading them to select Option A instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Endpoint DLP with clipboard control
Endpoint DLP with clipboard control is the correct setting because it monitors and restricts data movement at the device level, specifically preventing users from copying sensitive content (like credit card numbers) from a web application and pasting it into an unauthorized personal cloud storage app. This policy enforces restrictions on clipboard operations between different applications on the endpoint, directly addressing the cross-application data exfiltration scenario described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Browser DLP
Why it's wrong here
Browser DLP monitors browser-based actions, not copying from web apps to other apps.
- ✗
Exchange DLP
Why it's wrong here
Exchange DLP covers email, not clipboard operations.
- ✗
Teams DLP
Why it's wrong here
Teams DLP covers Teams messaging, not clipboard operations.
- ✓
Endpoint DLP with clipboard control
Why this is correct
Endpoint DLP can restrict clipboard operations on Windows devices.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
Key term
DLP policy
A DLP policy is a set of rules that an organization uses to prevent sensitive data from being lost, stolen, or accidentally exposed, whether it is in use, in motion, or at rest.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email, but allow sharing via Microsoft Teams messages. What should they configure?
hard- ✓ A.Create a DLP policy scoped to Exchange Online with a block action, and a separate DLP policy scoped to Teams with an audit-only action
- B.Create a single DLP policy that blocks credit card numbers in both Exchange and Teams
- C.Configure an exception in the DLP policy for Teams using a rule exception
- D.Use Microsoft Purview Insider Risk Management to block sharing in Teams
Why A: Microsoft Purview DLP allows you to create separate policies scoped to different workloads. By creating a DLP policy for Exchange Online with a block action, you prevent credit card numbers from being shared via email. A separate DLP policy scoped to Microsoft Teams with an audit-only action allows sharing in Teams while still logging the activity for monitoring.
Variation 2. Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?
hard- A.Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.
- ✓ B.Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.
- C.Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.
- D.Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.
Why B: Microsoft Purview DLP allows you to configure a policy that blocks external sharing of sensitive data (credit card numbers) while permitting internal sharing, and user notifications can be enabled to alert users when they attempt to share externally. This meets the requirement to prevent external sharing, allow internal sharing, and notify the user.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.