SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A financial services company is required by regulation to prevent sensitive customer financial information from being shared externally via email. The compliance team wants to automatically scan all outgoing emails for patterns that match credit card numbers or account numbers. If a match is found, the email should be blocked and the sender should receive a policy tip. Which Microsoft Purview solution should be configured?
⚠ Common exam trap
Watch out — candidates often confuse DLP with eDiscovery or Audit because all three involve compliance, but only DLP provides proactive, real-time blocking and notification for outbound sensitive data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention (DLP)
Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive information—such as credit card numbers and account numbers—in outgoing emails. DLP policies can scan email content and attachments for predefined sensitive information types, and when a match is found, the email can be blocked and a policy tip sent to the sender, meeting the compliance requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides a comprehensive record of user and administrator activities within Microsoft 365 services, enabling forensic investigations and compliance reviews. It logs events like file access, mailbox operations, and policy changes, creating an immutable trail for accountability. However, Audit is a reactive logging service designed for post-incident analysis and does not actively scan content in transit or prevent data from being shared in real-time.
When this WOULD be correct
When the requirement is to investigate a security incident by reviewing detailed logs of who accessed or sent sensitive data, such as tracking a data breach after it occurred.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management (DLM) governs the retention and disposal of data throughout its lifecycle, ensuring compliance with regulatory requirements and internal policies. It applies retention labels and policies to content, automatically preserving data for specified periods and then defensibly deleting it when no longer needed. DLM focuses on managing data's lifespan and storage efficiency, rather than actively preventing the unauthorized sharing or exfiltration of sensitive information.
When this WOULD be correct
A company needs to automatically retain emails containing financial data for 7 years and delete them after that period. The compliance team wants to set policies for data retention and deletion based on content classification.
- ✓
Microsoft Purview Data Loss Prevention (DLP)
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) proactively identifies, monitors, and protects sensitive information across Microsoft 365 services like Exchange Online, SharePoint Online, and OneDrive for Business. It uses policies to detect specific sensitive information types, such as credit card numbers or financial account details, within content. Upon detection, DLP can automatically block sharing, encrypt files, notify administrators, or provide policy tips to users, thereby preventing unauthorized data exfiltration and ensuring regulatory compliance.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery is a specialized tool designed to identify, preserve, collect, process, review, and export electronically stored information (ESI) for legal or regulatory investigations. It supports legal hold requirements by ensuring relevant data is immutable and discoverable for litigation or compliance inquiries. While crucial for legal processes, eDiscovery does not proactively prevent sensitive data from being shared or leaving the organization; its function is retrospective data retrieval.
When this WOULD be correct
A legal team needs to search for all emails containing a specific client's account number as part of a lawsuit discovery request. eDiscovery would be the correct tool to perform this search and export the results for legal review.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview Data Loss Prevention (DLP)Correct answer▾
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) proactively identifies, monitors, and protects sensitive information across Microsoft 365 services like Exchange Online, SharePoint Online, and OneDrive for Business. It uses policies to detect specific sensitive information types, such as credit card numbers or financial account details, within content. Upon detection, DLP can automatically block sharing, encrypt files, notify administrators, or provide policy tips to users, thereby preventing unauthorized data exfiltration and ensuring regulatory compliance.
✗Microsoft Purview AuditWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Audit logs user and admin activities but does not scan or block outgoing emails for sensitive content like credit card numbers.
★ When this WOULD be the correct answer
When the requirement is to investigate a security incident by reviewing detailed logs of who accessed or sent sensitive data, such as tracking a data breach after it occurred.
Why candidates choose this
Candidates may confuse auditing (monitoring) with prevention (blocking), assuming that logging email activity can also enforce policy tips and blocks.
✗Microsoft Purview Data Lifecycle ManagementWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Data Lifecycle Management manages retention and deletion of data, not real-time scanning and blocking of outbound emails for sensitive content like credit card numbers.
★ When this WOULD be the correct answer
A company needs to automatically retain emails containing financial data for 7 years and delete them after that period. The compliance team wants to set policies for data retention and deletion based on content classification.
Why candidates choose this
Candidates may confuse lifecycle management with data loss prevention because both involve data governance and policies, but lifecycle management focuses on retention/deletion rather than blocking transmission.
✗Microsoft Purview eDiscoveryWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview eDiscovery is used for searching and exporting content from Exchange, SharePoint, and Teams for legal investigations, not for real-time scanning and blocking of outgoing emails containing sensitive data.
★ When this WOULD be the correct answer
A legal team needs to search for all emails containing a specific client's account number as part of a lawsuit discovery request. eDiscovery would be the correct tool to perform this search and export the results for legal review.
Why candidates choose this
Candidates may confuse eDiscovery's content search capabilities with DLP's content scanning, thinking that eDiscovery can also block emails, or they may mistakenly believe that eDiscovery includes policy enforcement features.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.