How Microsoft Purview Information Protection Provides Encryption, Visual Markings, and Automatic Revocation
A company uses Microsoft 365 and needs to classify and protect sensitive documents by applying encryption and visual markings (headers/footers) based on the content's sensitivity. They also want to automatically revoke access to documents that leave the organization. Which Microsoft Purview solution should they configure?
Quick Answer
The correct answer is Microsoft Purview Information Protection. This solution is the right choice because it uses sensitivity labels to classify and protect sensitive documents, enabling you to enforce encryption and apply visual markings like headers and footers based on the content’s sensitivity level. It also supports automatic revocation of access to documents that leave the organization through integrated rights management and conditional access policies, directly addressing the need to revoke access to documents that leave the organization. On the SC-900 exam, this question tests your understanding of how Purview’s Information Protection differs from other solutions like Data Loss Prevention or Audit; a common trap is confusing it with Azure Information Protection, but remember that Purview Information Protection is the unified, cloud-based service. For a memory tip, think “Labels Lock and Leave”—sensitivity labels lock content with encryption, add visual markings, and let you revoke access when documents leave your control.
⚠ Common exam trap
Many candidates confuse Data Lifecycle Management (retention/deletion) with Information Protection (classification/encryption), or mistakenly think Communication Compliance or Audit can enforce document-level protection and revocation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection
Microsoft Purview Information Protection (B) is the correct solution because it provides the capabilities to classify and protect sensitive documents using sensitivity labels. These labels can enforce encryption and apply visual markings like headers and footers based on content sensitivity. Additionally, Information Protection supports automatic revocation of access to documents that leave the organization through features like rights management and conditional access policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management handles retention and deletion, not classification, encryption, or marking of content.
- ✓
Microsoft Purview Information Protection
Why this is correct
Information Protection uses sensitivity labels to classify, encrypt, and apply visual markings to documents, and can enforce revocation of access for external users.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Communication Compliance monitors internal communications for policy violations, not document classification and protection.
- ✗
Microsoft Purview Audit
Why it's wrong here
Audit provides logging of user and admin activities, not classification or protection capabilities.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Microsoft Purview Information Protection to classify and protect sensitive data. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which should you configure?
medium- A.Use a manual labeling policy requiring users to apply labels
- B.Create a trainable classifier for credit card patterns
- ✓ C.Configure an auto-labeling policy with a sensitive info type for credit card numbers
- D.Set up a data classification activity explorer to monitor credit card usage
Why C: Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents and emails that contain specific sensitive information types, such as credit card numbers. This enables automated classification and protection without requiring user intervention, directly meeting the requirement to automatically apply a label based on the presence of credit card data.
Variation 2. Your organization needs to classify documents containing personally identifiable information (PII) like social security numbers. Which Microsoft Purview solution should you configure?
easy- ✓ A.Information Protection
- B.Records Management
- C.Auditing
- D.Communication Compliance
Why A: Microsoft Purview Information Protection (A) is the correct solution because it provides classification and labeling capabilities specifically designed to identify, label, and protect sensitive data such as PII (e.g., social security numbers). It uses trainable classifiers and exact data match (EDM) to automatically detect sensitive content and apply appropriate protection actions like encryption or access restrictions.
Variation 3. Your organization uses Microsoft Purview to classify documents containing health information. You need to ensure that only users with explicit permission can access these documents. Which Microsoft Purview capability should you use?
easy- A.Audit logs
- B.Retention policies
- C.Data Loss Prevention
- ✓ D.Sensitivity labels with encryption
Why D: Sensitivity labels with encryption are the correct choice because they allow you to classify documents containing health information and apply encryption to restrict access to only users with explicit permissions. This ensures that even if the document is shared or moved, only authorized users can decrypt and read it, meeting the requirement for access control.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.