Courseiva

Microsoft Purview DLP: Configuring Policies for Credit Card Numbers Across Email, Teams, and Endpoints

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from copying credit card numbers from an internal web application to a personal cloud storage app. Which DLP policy setting should they configure?

Quick Answer

The answer is Endpoint DLP with clipboard control. This setting is correct because it specifically governs how sensitive data, such as credit card numbers, can be copied from one application to another on a managed device, including blocking transfers to unauthorized personal cloud storage apps. On the Microsoft Security, Compliance, and Identity Fundamentals SC-900 exam, this question tests your understanding of how Purview DLP policies are scoped by workload—Endpoint DLP covers device-level actions like clipboard operations, while browser, email, and Teams DLP each protect only their respective channels. A common trap is to confuse browser DLP with endpoint controls, but remember that clipboard monitoring is an endpoint-only feature. For a quick memory tip: think of the clipboard as a physical bridge—only an endpoint guard can stop what crosses it.

⚠ Common exam trap

Test-takers frequently confuse Browser DLP (which only controls data within the browser) with the broader endpoint-level clipboard control needed to prevent cross-application data transfer, leading them to select Option A instead of D.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Endpoint DLP with clipboard control

Endpoint DLP with clipboard control is the correct setting because it monitors and restricts data movement at the device level, specifically preventing users from copying sensitive content (like credit card numbers) from a web application and pasting it into an unauthorized personal cloud storage app. This policy enforces restrictions on clipboard operations between different applications on the endpoint, directly addressing the cross-application data exfiltration scenario described.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Browser DLP

    Why it's wrong here

    Browser DLP monitors browser-based actions, not copying from web apps to other apps.

  • Exchange DLP

    Why it's wrong here

    Exchange DLP covers email, not clipboard operations.

  • Teams DLP

    Why it's wrong here

    Teams DLP covers Teams messaging, not clipboard operations.

  • Endpoint DLP with clipboard control

    Why this is correct

    Endpoint DLP can restrict clipboard operations on Windows devices.

About these practice questions

This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on SC-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email, but allow sharing via Microsoft Teams messages. What should they configure?

hard
  • A.Create a DLP policy scoped to Exchange Online with a block action, and a separate DLP policy scoped to Teams with an audit-only action
  • B.Create a single DLP policy that blocks credit card numbers in both Exchange and Teams
  • C.Configure an exception in the DLP policy for Teams using a rule exception
  • D.Use Microsoft Purview Insider Risk Management to block sharing in Teams

Why A: Microsoft Purview DLP allows you to create separate policies scoped to different workloads. By creating a DLP policy for Exchange Online with a block action, you prevent credit card numbers from being shared via email. A separate DLP policy scoped to Microsoft Teams with an audit-only action allows sharing in Teams while still logging the activity for monitoring.

Variation 2. Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?

hard
  • A.Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.
  • B.Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.
  • C.Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.
  • D.Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.

Why B: Microsoft Purview DLP allows you to configure a policy that blocks external sharing of sensitive data (credit card numbers) while permitting internal sharing, and user notifications can be enabled to alert users when they attempt to share externally. This meets the requirement to prevent external sharing, allow internal sharing, and notify the user.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.