SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A global company uses Microsoft Teams and SharePoint Online. They need to automatically detect and prevent sharing of intellectual property files containing 'Project X' with external users. What should they configure?
⚠ Common exam trap
It's easy for candidates to confuse Sensitivity Labels (which classify and protect data) with DLP policies (which enforce actions like blocking sharing), but DLP is the correct tool for automatic detection and prevention of specific content sharing with external users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention policy for SharePoint and OneDrive
Microsoft Purview Data Loss Prevention (DLP) policies for SharePoint and OneDrive can be configured to automatically detect files containing sensitive content (e.g., 'Project X') and block sharing with external users. DLP policies inspect content at rest and during sharing actions, applying rules to prevent unauthorized external access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Access Reviews
Why it's wrong here
Microsoft Entra ID Access Reviews are designed for identity governance, enabling organizations to periodically review and certify user access to groups, applications, and roles. While essential for ensuring appropriate access permissions are maintained, they do not possess the capability to scan content within SharePoint Online or Microsoft Teams to detect sensitive information and subsequently block its sharing based on content policies.
- ✗
Microsoft Purview Sensitivity Labels
Why it's wrong here
Microsoft Purview Sensitivity Labels classify data, applying visual markings, encryption, or access restrictions based on the content's sensitivity. Although labels are a fundamental component of data governance and can be *used* by other policies, they do not automatically detect sensitive content or enforce blocking actions on their own without an accompanying Data Loss Prevention (DLP) policy configured to act upon those labels or specific sensitive information types.
- ✓
Microsoft Purview Data Loss Prevention policy for SharePoint and OneDrive
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) policies for SharePoint and OneDrive are specifically engineered to identify, monitor, and protect sensitive information across these services. These policies utilize sensitive information types (SITs), keywords, and trainable classifiers to detect specific data patterns, such as credit card numbers or national IDs, and can then automatically block sharing, notify administrators, or apply encryption to prevent unauthorized data exfiltration.
- ✗
Microsoft Defender for Cloud Apps Session Policy
Why it's wrong here
Microsoft Defender for Cloud Apps (MDCAS) Session Policies are used to monitor and control user activities in real-time *during* a cloud app session, often by routing traffic through a reverse proxy. While effective for preventing actions like downloading sensitive files to unmanaged devices or copying content during an active session, they do not proactively scan content at rest in SharePoint or OneDrive to prevent sharing based on the content's sensitivity, which is the primary function of a DLP policy.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.