SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A privacy officer at Woodgrove Bank needs to automatically detect and classify documents containing personally identifiable information (PII) across SharePoint Online, OneDrive, and Exchange Online. They want to apply a sensitivity label to these documents and ensure the label is applied even if users do not manually label them. The label should also encrypt the content. Which Microsoft Purview feature should they use?
⚠ Common exam trap
The trap here is assuming DLP can apply sensitivity labels automatically; DLP can detect and act on labeled content, but it does not assign labels itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-labeling policies for sensitivity labels
Auto-labeling policies for sensitivity labels are designed to automatically apply labels to content that matches specified conditions, such as containing PII. The labels can be configured with encryption. This feature works across Exchange, SharePoint, and OneDrive, and it does not require users to manually apply labels, satisfying the automatic classification and protection requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention (DLP) policies with a sensitivity label condition
Why it's wrong here
DLP policies can detect sensitive information and take actions like blocking or warning, but they do not automatically apply sensitivity labels to content. They can use labels as conditions, but they do not assign them. DLP is for preventing sharing, not for classification and encryption.
- ✗
Information barriers policies
Why it's wrong here
Information barriers are used to restrict communication and collaboration between certain groups, not to classify or encrypt documents. They do not detect PII or apply labels. This feature is unrelated to the requirement for automatic labeling and encryption.
- ✗
Retention policies with a sensitive information type condition
Why it's wrong here
Retention policies can retain or delete content based on conditions, but they do not apply sensitivity labels or encryption. They are for lifecycle management, not classification and protection. Using retention policies would not satisfy the need to label and encrypt PII documents.
- ✓
Auto-labeling policies for sensitivity labels
Why this is correct
Auto-labeling policies can automatically apply sensitivity labels to content that matches conditions, such as containing sensitive information types for PII. They work across Exchange, SharePoint, and OneDrive, and the label can include encryption. This meets the requirement for automatic classification and protection without user intervention.
Go deeper
Related to this question
Learn chapter
Microsoft Entra Password Protection
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Privacy
Privacy in IT is the control over how personal data is collected, stored, used, and shared by systems and organizations.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.