SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
An organization needs to automatically apply a 'Highly Confidential' sensitivity label to all documents that contain a specific custom sensitive information type. The label should be applied when the document is created or modified. Which feature of Microsoft Purview Information Protection should be used?
⚠ Common exam trap
Watch out — candidates often confuse auto-labeling policies with DLP policies, mistakenly thinking DLP can apply labels, when in fact DLP only monitors and protects data in transit or at rest without modifying the label itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-labeling policies
Auto-labeling policies in Microsoft Purview Information Protection are designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types. This feature supports both simulation and real-time enforcement, and it can be triggered when documents are created or modified, meeting the organization's requirement exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Manual sensitivity labeling
Why it's wrong here
Manual sensitivity labeling requires direct user interaction to classify and apply a label to a document or email. This process involves the user actively selecting the appropriate label from a predefined list, which inherently relies on human action rather than automated system logic. Therefore, it does not fulfill the organization's requirement for *automatic* application of a highly confidential label.
- ✗
Data Loss Prevention (DLP) policies
Why it's wrong here
Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information across various locations by preventing its unauthorized sharing or transfer. While DLP can detect content with specific sensitive information types, its primary function is to enforce protective actions like blocking sharing or notifying administrators, not to automatically apply sensitivity labels to the content itself. Therefore, DLP policies address data egress control rather than content classification and labeling.
- ✓
Auto-labeling policies
Why this is correct
Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content based on predefined conditions, such as the presence of specific sensitive information types, keywords, or patterns. These policies can be configured to apply labels to files at rest in SharePoint and OneDrive, or to emails and documents in Exchange, ensuring consistent classification without manual intervention. This direct application of labels fulfills the requirement for automatically classifying highly confidential information.
- ✗
Communication Compliance policies
Why it's wrong here
Communication Compliance policies are designed to help organizations detect, investigate, and act on inappropriate messages or policy violations within internal and external communications, such as harassment or insider trading. These policies focus on monitoring communication channels like Microsoft Teams, Exchange, and Yammer for specific content or patterns, and then flagging them for review. They do not, however, possess the functionality to automatically apply sensitivity labels to documents or emails for data classification purposes.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Sensitivity label
A sensitivity label is a metadata tag applied to digital content that classifies the content's level of confidentiality and governs how it can be shared, protected, and accessed.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.