SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A multinational corporation needs to restrict data sharing in Microsoft Teams to comply with regional regulations. Users must not be able to share files with external domains from specific departments. What should the administrator configure?
⚠ Common exam trap
It's easy for candidates to confuse DLP policies (which block sensitive content) with container-level sharing restrictions, not realizing that DLP cannot block all external sharing from a specific department—it only acts on content patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels with container management in Microsoft Purview
Sensitivity labels with container management in Microsoft Purview allow administrators to configure external sharing restrictions for Microsoft Teams, SharePoint, and Groups. By applying a sensitivity label to a team, you can block external sharing for specific departments, ensuring compliance with regional regulations. This is the correct solution because it directly controls sharing behavior at the container level based on the label's settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Intune device compliance policy
Why it's wrong here
Microsoft Intune device compliance policies are designed to enforce security standards and configurations on devices, such as requiring encryption, specific OS versions, or PINs. While they determine if a device is compliant to access corporate resources, these policies do not directly control or restrict data sharing permissions within applications like Microsoft Teams or SharePoint based on the content itself or the intended recipient. Their scope is limited to the device's security posture, not the granular sharing behavior of data.
- ✗
Microsoft Defender for Cloud Apps session policy
Why it's wrong here
Microsoft Defender for Cloud Apps (MDCAS) session policies offer real-time, granular control over user actions within cloud applications, often by routing traffic through a reverse proxy. While these policies can monitor and block activities like downloads or uploads, they are primarily focused on controlling user sessions and app behavior across various cloud services. They are not specifically designed for the intricate, persistent, and content-aware external sharing controls required for Microsoft Teams or SharePoint containers, which are more effectively managed natively within Microsoft Purview.
- ✗
Data Loss Prevention (DLP) policy in Microsoft Purview
Why it's wrong here
Data Loss Prevention (DLP) policies in Microsoft Purview are engineered to identify, monitor, and protect sensitive information across various locations by detecting specific content, such as credit card numbers or personally identifiable information. While DLP can effectively prevent the sharing of sensitive data externally based on its content, its primary mechanism is content inspection and blocking, not managing the inherent external sharing capabilities of a container (e.g., a Teams channel or SharePoint site) for specific departments or groups. It acts on the data, not the container's fundamental sharing settings.
- ✓
Sensitivity labels with container management in Microsoft Purview
Why this is correct
Sensitivity labels with container management in Microsoft Purview are specifically designed to classify and protect data by applying predefined policies to content and its containers. When a sensitivity label is applied to a Microsoft Teams, SharePoint site, or Microsoft 365 Group, it can automatically enforce specific sharing and access policies, including blocking external sharing for all content within that labeled container. This ensures that data belonging to a particular department or project, once labeled, adheres to predefined organizational sharing restrictions, providing granular control at the container level.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.