SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email, but allow sharing via Microsoft Teams messages. What should they configure?
⚠ Common exam trap
A common mix-up: candidates assume a single DLP policy with multiple locations can have different actions per location, but in reality, the action is applied uniformly across all selected locations unless separate policies are created.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a DLP policy scoped to Exchange Online with a block action, and a separate DLP policy scoped to Teams with an audit-only action
Microsoft Purview DLP allows you to create separate policies scoped to different workloads. By creating a DLP policy for Exchange Online with a block action, you prevent credit card numbers from being shared via email. A separate DLP policy scoped to Microsoft Teams with an audit-only action allows sharing in Teams while still logging the activity for monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a DLP policy scoped to Exchange Online with a block action, and a separate DLP policy scoped to Teams with an audit-only action
Why this is correct
Microsoft Purview DLP policies offer granular control, allowing administrators to define distinct policies for different service locations. By creating one policy specifically scoped to Exchange Online with a "block" action and a separate policy for Microsoft Teams with an "audit-only" action, the company can precisely meet the requirement. This approach leverages DLP's ability to apply varied enforcement levels based on the communication channel, ensuring sensitive data is protected appropriately in each context.
- ✗
Create a single DLP policy that blocks credit card numbers in both Exchange and Teams
Why it's wrong here
Creating a single DLP policy that applies to both Exchange and Teams with a uniform "block" action would enforce the same restriction across both services. This configuration would prevent the sharing of credit card numbers in Teams, which directly contradicts the requirement to only audit such sharing in Teams. DLP policies need to be tailored to the specific enforcement needs of each location when different actions are desired.
- ✗
Configure an exception in the DLP policy for Teams using a rule exception
Why it's wrong here
DLP policy exceptions are designed to exclude specific items or conditions from a rule's enforcement, such as particular users, sensitivity labels, or file paths. They do not provide functionality to apply a *different action* (e.g., audit instead of block) to an entire service location like Teams, while the main rule applies a block action to another location. To achieve different actions per location, separate policies or rules with distinct scopes are necessary.
- ✗
Use Microsoft Purview Insider Risk Management to block sharing in Teams
Why it's wrong here
Microsoft Purview Insider Risk Management is designed to detect and act on risky user activities, such as data exfiltration or intellectual property theft, by analyzing user behavior patterns. Its primary function is not to block specific data types like credit card numbers based on content inspection. Data Loss Prevention (DLP) is the appropriate solution for content-based blocking of sensitive information across various services.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.