SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A financial services company uses Microsoft 365 and must prevent employees from emailing credit card numbers in plain text. The compliance team wants to automatically detect credit card numbers in outgoing emails and block them before delivery. They also want to allow users to override the block with a business justification. Which Microsoft Purview solution should they configure?
⚠ Common exam trap
Watch out — candidates often confuse Information Protection (labeling) with DLP (enforcement), thinking that applying a sensitivity label automatically blocks emails, but DLP is required for the blocking and override functionality described in the scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention (DLP)
Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data, such as credit card numbers, in transit (e.g., email) and enforce actions like blocking the message. DLP policies can be configured with user override options that require a business justification, meeting the compliance team's requirement for automatic detection and conditional blocking.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Data Loss Prevention (DLP)
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including Exchange Online emails. These policies use sensitive information types (SITs) to detect content like credit card numbers in real-time as emails are sent. Upon detection, DLP can block the email, notify administrators, and offer users the option to override the block with a business justification, directly preventing unauthorized data egress.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection (MIP) provides a framework for classifying and protecting sensitive data using sensitivity labels, which can apply encryption, visual markings, and access restrictions directly to files and emails. While MIP ensures data remains protected wherever it travels, it primarily focuses on persistent data protection and access control rather than actively scanning email content in transit to prevent its initial transmission based on detected sensitive information.
When this WOULD be correct
A company wants to automatically apply a 'Confidential' label to all emails containing credit card numbers and encrypt them before sending, but does not need to block the email. In that scenario, Information Protection would be the correct solution.
- ✗
Microsoft Purview Records Management
Why it's wrong here
Microsoft Purview Records Management focuses on the lifecycle governance of organizational data, ensuring that information is retained for required periods and then properly disposed of according to regulatory and internal policies. It enables organizations to declare content as a record, apply retention labels, and manage legal holds, but it does not actively scan email content in transit to prevent the immediate loss or unauthorized sharing of sensitive data.
When this WOULD be correct
An organization needs to automatically retain emails containing financial data for 7 years and then delete them. Records Management would be the correct solution to apply retention labels and disposition reviews based on content.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management is engineered to detect and mitigate internal risks by identifying unusual or suspicious user activities that could indicate data theft, leakage, or policy violations. It analyzes behavioral patterns, such as excessive downloads or unusual sharing, to alert security teams to potential insider threats. However, it does not perform real-time content inspection and blocking of sensitive information within emails as they are being sent.
When this WOULD be correct
A scenario where the compliance team needs to detect and investigate employees who are exfiltrating sensitive data via email, such as sending credit card numbers to personal accounts, and require alerts and case management for HR action. The question would specify 'detect and investigate risky behavior' rather than 'automatically block with override'.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview Data Loss Prevention (DLP)Correct answer▾
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including Exchange Online emails. These policies use sensitive information types (SITs) to detect content like credit card numbers in real-time as emails are sent. Upon detection, DLP can block the email, notify administrators, and offer users the option to override the block with a business justification, directly preventing unauthorized data egress.
✗Microsoft Purview Information ProtectionWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Information Protection focuses on classifying and protecting documents and emails with sensitivity labels, not on blocking outbound emails containing sensitive data like credit card numbers. It does not provide the automatic blocking and override capability for emails in transit that DLP does.
★ When this WOULD be the correct answer
A company wants to automatically apply a 'Confidential' label to all emails containing credit card numbers and encrypt them before sending, but does not need to block the email. In that scenario, Information Protection would be the correct solution.
Why candidates choose this
Candidates may confuse the ability to detect sensitive data (which both DLP and Information Protection can do) with the enforcement action of blocking emails, assuming that labeling and protection also include blocking capabilities.
✗Microsoft Purview Records ManagementWrong answer — click to see why▾
Why this is wrong here
Records Management focuses on managing retention and disposition of records, not on detecting and blocking sensitive data like credit card numbers in emails.
★ When this WOULD be the correct answer
An organization needs to automatically retain emails containing financial data for 7 years and then delete them. Records Management would be the correct solution to apply retention labels and disposition reviews based on content.
Why candidates choose this
Candidates may confuse 'Records Management' with managing sensitive information, thinking it includes data classification and protection, but it is actually about lifecycle management.
✗Microsoft Purview Insider Risk ManagementWrong answer — click to see why▾
Why this is wrong here
Insider Risk Management is designed to detect and investigate risky user activities (e.g., data theft, policy violations) but does not block emails based on content patterns like credit card numbers. It cannot enforce real-time email blocking with override capabilities.
★ When this WOULD be the correct answer
A scenario where the compliance team needs to detect and investigate employees who are exfiltrating sensitive data via email, such as sending credit card numbers to personal accounts, and require alerts and case management for HR action. The question would specify 'detect and investigate risky behavior' rather than 'automatically block with override'.
Why candidates choose this
Candidates may confuse 'insider risk' with data loss prevention because both deal with sensitive data misuse. They might think that blocking credit card emails is a risk management function, overlooking that DLP is the specific tool for content-based enforcement.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.