SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company uses Microsoft Purview Information Protection to classify and protect sensitive data. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which should you configure?
⚠ Common exam trap
Many exam-takers confuse trainable classifiers with sensitive info types, leading candidates to choose Option B because they think 'trainable' implies automatic detection, but trainable classifiers are for broader content categories, not specific regex-based patterns like credit card numbers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure an auto-labeling policy with a sensitive info type for credit card numbers
Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents and emails that contain specific sensitive information types, such as credit card numbers. This enables automated classification and protection without requiring user intervention, directly meeting the requirement to automatically apply a label based on the presence of credit card data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a manual labeling policy requiring users to apply labels
Why it's wrong here
Using a manual labeling policy requires individual users to actively select and apply a sensitivity label to their documents or emails. This approach relies entirely on user diligence and awareness, making it unsuitable for ensuring consistent, automatic protection of highly sensitive data like credit card numbers across an entire organization, as it is prone to human error and oversight.
- ✗
Create a trainable classifier for credit card patterns
Why it's wrong here
Trainable classifiers are designed to identify types of content based on examples and context, learning patterns to classify subjective or less structured data (e.g., 'resumes' or 'legal documents'). They are not optimized for detecting specific, highly structured numerical patterns like credit card numbers, which require precise pattern matching, keyword dictionaries, and checksum validation for accurate identification, a capability best provided by sensitive information types.
- ✓
Configure an auto-labeling policy with a sensitive info type for credit card numbers
Why this is correct
Configuring an auto-labeling policy with a sensitive information type for credit card numbers is the most effective and accurate method for automatic protection. This approach leverages Microsoft Purview's built-in capabilities to scan content for specific patterns, keywords, and checksums associated with credit card numbers, then automatically applies the appropriate sensitivity label and its associated protection actions (e.g., encryption, access restrictions) without any user intervention.
- ✗
Set up a data classification activity explorer to monitor credit card usage
Why it's wrong here
The Data Classification Activity Explorer is a monitoring and reporting tool within Microsoft Purview that provides visibility into where sensitive data resides and how it is being accessed, modified, or shared. While it offers valuable insights for auditing and compliance, it is purely a reactive observation mechanism and does not possess the functionality to automatically apply sensitivity labels or enforce protection policies on content.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Information protection
Information protection refers to the policies, procedures, and technologies used to safeguard data from unauthorized access, disclosure, alteration, or destruction.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.