The answer is Microsoft Purview Information Protection. This solution is correct because it enables organizations to automatically detect protected health information (PHI) like medical record numbers using sensitive information types or trainable classifiers, then apply a sensitivity label that enforces encryption and prevents users from removing that label—directly meeting the HIPAA requirement for automated detection, encryption, and label persistence on SharePoint Online documents. On the SC-900 exam, this scenario tests your understanding of how Purview Information Protection differs from other solutions like Data Loss Prevention or Audit; a common trap is confusing automatic labeling with manual labeling or assuming encryption is handled by Azure Information Protection alone. Remember the key phrase: "detect, encrypt, lock"—if the question involves automatically finding sensitive data, encrypting it, and preventing label removal, the answer is always Purview Information Protection.
SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
This SC-900 practice question tests your understanding of describe the capabilities of microsoft compliance solutions. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: information Protection uses sensitivity labels for classification and protection.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A healthcare organization must comply with HIPAA regulations. They store patient health information (PHI) in SharePoint Online documents. The compliance team needs to automatically detect PHI (e.g., medical record numbers) in documents, apply a sensitivity label that encrypts the document, and prevent users from removing that label. Which Microsoft Purview solution should they configure?
Why wrong: Data Lifecycle Management manages retention and deletion policies, not automatic classification and protection through labeling.
B
Microsoft Purview Information Protection
Information Protection provides sensitivity labels that can be automatically applied based on sensitive data types (like PHI) and includes encryption and label protection settings to prevent removal.
C
Microsoft Purview Communication Compliance
Why wrong: Communication Compliance monitors communications for policy violations, not for classifying and protecting stored documents.
D
Microsoft Purview Audit
Why wrong: Audit records user and admin activities but does not automatically classify or protect data.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection
Microsoft Purview Information Protection (option B) is correct because it provides the ability to automatically detect sensitive data types (such as PHI) using trainable classifiers or sensitive information types, apply a sensitivity label that enforces encryption, and configure label protection settings to prevent users from removing the label. This directly meets the HIPAA compliance requirement for automated detection, encryption, and label persistence on SharePoint Online documents.
Key principle: Information Protection uses sensitivity labels for classification and protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management manages retention and deletion policies, not automatic classification and protection through labeling.
✓
Microsoft Purview Information Protection
Why this is correct
Information Protection provides sensitivity labels that can be automatically applied based on sensitive data types (like PHI) and includes encryption and label protection settings to prevent removal.
Related concept
Information Protection uses sensitivity labels for classification and protection.
✗
Microsoft Purview Communication Compliance
Why it's wrong here
Communication Compliance monitors communications for policy violations, not for classifying and protecting stored documents.
✗
Microsoft Purview Audit
Why it's wrong here
Audit records user and admin activities but does not automatically classify or protect data.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse Microsoft Purview Information Protection (which handles labeling and encryption) with Microsoft Purview Data Lifecycle Management (which handles retention and deletion), because both involve document policies, but only Information Protection can detect PHI and enforce encryption labels.
Detailed technical explanation
How to think about this question
Under the hood, Microsoft Purview Information Protection uses sensitive information types (e.g., U.S. medical record number regex patterns) and trainable classifiers to scan content in SharePoint Online via the Microsoft 365 built-in data classification service. When a match is found, the service applies a sensitivity label that can enforce encryption using Azure Information Protection (AIP) rights management, and the label can be configured with a 'marking' action and a protection setting that disables user removal via the 'Remove header/footer/watermark' or 'Do not allow users to remove the label' policy. In a real-world scenario, if a user tries to strip the label, the system either blocks the action or logs an audit event, depending on the label policy configuration.
KKey Concepts to Remember
Information Protection uses sensitivity labels for classification and protection.
Sensitivity labels can automatically apply encryption to documents.
Labels can be configured to prevent users from removing them.
Automatic labeling relies on sensitive information types (SITs) to detect specific data.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Information Protection uses sensitivity labels for classification and protection.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Information Protection uses sensitivity labels for classification and protection. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-900 question in full detail.
Review information Protection uses sensitivity labels for classification and protection., then practise related SC-900 questions on the same topic to reinforce the concept.
Describe the capabilities of Microsoft compliance solutions — This question tests Describe the capabilities of Microsoft compliance solutions — Information Protection uses sensitivity labels for classification and protection..
What is the correct answer to this question?
The correct answer is: Microsoft Purview Information Protection — Microsoft Purview Information Protection (option B) is correct because it provides the ability to automatically detect sensitive data types (such as PHI) using trainable classifiers or sensitive information types, apply a sensitivity label that enforces encryption, and configure label protection settings to prevent users from removing the label. This directly meets the HIPAA compliance requirement for automated detection, encryption, and label persistence on SharePoint Online documents.
What should I do if I get this SC-900 question wrong?
Review information Protection uses sensitivity labels for classification and protection., then practise related SC-900 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Information Protection uses sensitivity labels for classification and protection.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A healthcare organization must comply with HIPAA regulations. They need to classify and protect medical records stored in Microsoft 365. Which Microsoft Purview solution should they use?
easy
A.Microsoft Purview Audit
B.Microsoft Purview Priva
C.Microsoft Purview Data Lifecycle Management
✓ D.Microsoft Purview Information Protection
Why D: Option B is correct because Microsoft Purview Information Protection includes sensitivity labels and data classification for regulatory compliance. Option A is wrong because Data Lifecycle Management focuses on retention, not classification. Option C is wrong because Audit is for logging. Option D is wrong because Priva is for privacy management.
Variation 2. A healthcare organization must comply with HIPAA regulations. They need to automatically detect and classify sensitive health information such as medical record numbers stored in SharePoint Online and OneDrive. When detected, the solution should apply encryption and restrict access to only authorized personnel. Which Microsoft Purview solution should they configure?
medium
✓ A.Information Protection
B.Data Lifecycle Management
C.Audit
D.eDiscovery
Why A: Microsoft Purview Information Protection (specifically sensitivity labels and auto-labeling policies) can automatically detect sensitive health information like medical record numbers using built-in sensitive information types (e.g., U.S. HIPAA-defined types). When detected, it can apply encryption via Rights Management and restrict access to authorized personnel, meeting HIPAA compliance requirements.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.