SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
As a compliance administrator for Contoso Ltd., you are responsible for implementing Microsoft Purview solutions to meet regulatory requirements. The organization operates in the healthcare sector and handles Protected Health Information (PHI). Your key objectives are: (1) Automatically detect PHI in documents stored in SharePoint Online and OneDrive for Business using built-in sensitive information types. (2) Apply a 'Highly Confidential - PHI' sensitivity label that encrypts the content and adds a custom header. (3) Ensure that the label is automatically applied when PHI is detected, with a policy that allows users to override the label with justification. (4) Audit all label application activities for compliance reporting. (5) Retain documents containing PHI for a minimum of 7 years. You have access to Microsoft Purview compliance portal. Which action should you take FIRST to achieve these objectives?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a sensitivity label named 'Highly Confidential - PHI' with encryption and header, and publish it to users and groups.
The first step is to create the sensitivity label with the required encryption and header settings and publish it so that it can be used in auto-labeling policies. Auto-labeling policies can then be configured to apply the label based on sensitive info types, with user override. Retention labels and policies are separate and can be configured later. Audit is enabled by default but should be verified. Therefore, option C is the correct first action.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create an auto-labeling policy in Microsoft Purview that applies the sensitivity label to documents containing PHI.
Why it's wrong here
Creating an auto-labeling policy prematurely is ineffective because the target sensitivity label, 'Highly Confidential - PHI', does not yet exist or has not been made available to users and services. An auto-labeling policy relies on a pre-defined and published sensitivity label to correctly identify and apply the specified classification and protection settings to content. Therefore, defining the label itself is a necessary preceding action before configuring its automatic application.
- ✗
Enable auditing in Microsoft Purview by turning on Audit logging.
Why it's wrong here
Enabling auditing is not the initial step for implementing sensitivity labels or auto-labeling policies. Microsoft 365 audit logging is typically enabled by default for most organizations with appropriate licenses, providing a record of user and admin activities. While auditing is essential for monitoring compliance and label usage, it is a separate operational concern from the foundational task of creating and deploying the data classification mechanism itself.
- ✓
Create a sensitivity label named 'Highly Confidential - PHI' with encryption and header, and publish it to users and groups.
Why this is correct
The creation of a sensitivity label, such as 'Highly Confidential - PHI' with specific protection settings like encryption and header, is the fundamental first step. This label defines the classification and the associated protective actions for the data. Subsequently, publishing the label makes it available for users to apply manually and for auto-labeling policies to utilize, establishing the core data protection framework.
- ✗
Create a retention label and policy to retain documents containing PHI for 7 years.
Why it's wrong here
Creating a retention label and policy addresses data lifecycle management, focusing on how long data should be kept or deleted, which is a distinct compliance requirement from data classification and protection. While important for PHI, retention policies do not establish the immediate classification and protective measures, such as encryption, that sensitivity labels provide. The primary objective of classifying and protecting PHI must be addressed first by creating the sensitivity label.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.