SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization uses Microsoft 365. They need to prevent employees from sharing emails or documents that contain patient medical record numbers (MRNs) with external recipients. If an attempt is made, the message should be blocked and the sender should receive a policy tip notification. Which Microsoft Purview solution should they configure?
⚠ Common exam trap
It's easy for candidates to confuse Information Protection (sensitivity labels) with DLP, but labels alone do not block sharing or provide policy tips—they require DLP policies for enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP)
Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as patient medical record numbers (MRNs), with external recipients. DLP policies can be configured to scan emails and documents for patterns (e.g., regex for MRNs), block the transmission, and display a policy tip notification to the sender, meeting all requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management (DLM) primarily focuses on governing the retention and deletion of data across its entire lifecycle, ensuring compliance with regulatory requirements for how long data is kept or when it must be disposed of. While crucial for data governance, DLM does not provide real-time content scanning capabilities to detect sensitive information like Medical Record Numbers (MRNs) and prevent their unauthorized sharing with external recipients. Its scope is about data longevity and disposition, not proactive sharing prevention.
- ✗
Records Management
Why it's wrong here
Records Management is a specialized component within Microsoft 365 that focuses on managing high-value, immutable records to meet stringent legal, regulatory, and business-critical retention obligations. It ensures that designated records are preserved in an unalterable state for their required retention period, preventing premature deletion or modification. However, Records Management does not offer capabilities to actively scan content for sensitive data patterns, such as MRNs, and automatically block sharing attempts with external parties.
- ✓
Data Loss Prevention (DLP)
Why this is correct
Data Loss Prevention (DLP) is the correct solution because it is specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including email, SharePoint, and OneDrive. DLP policies leverage sensitive information types (SITs) to detect patterns like Medical Record Numbers (MRNs) within content. Upon detection, these policies can be configured to automatically block sharing with external recipients, provide policy tips to users, and generate alerts for administrators, thereby preventing unauthorized data exfiltration.
- ✗
Information Protection
Why it's wrong here
Microsoft Purview Information Protection (MPIP) primarily focuses on classifying and labeling data, then applying protective measures such as encryption and access controls based on those labels. While labels can restrict who can access or share information, MPIP itself does not inherently perform real-time content scanning to detect specific sensitive data patterns, like MRNs, and automatically block sharing attempts. Its strength lies in persistent protection applied to the data itself, rather than proactive content-based sharing prevention.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.