Describe the capabilities of Microsoft compliance solutions →mediumMultiple ChoiceObjective-mapped

How to Prevent External Sharing of Credit Card Numbers Using Microsoft Purview DLP

A company uses Microsoft 365 and needs to identify and protect sensitive data, such as credit card numbers, stored in SharePoint Online and OneDrive for Business. They also want to prevent users from sharing this data externally. Which Microsoft Purview solution should they use?

Quick Answer

The answer is Data Loss Prevention (DLP) in Microsoft Purview. This solution is correct because it uses built-in sensitive information types, such as the Credit Card Number classifier, to automatically detect and protect sensitive data across SharePoint Online and OneDrive for Business, and its policies can be configured to block or restrict external sharing of that data, directly fulfilling the requirement to prevent external sharing of credit card numbers. On the SC-900 exam, this question tests your understanding of how Purview solutions map to specific data protection scenarios; a common trap is confusing DLP with Microsoft Information Protection (MIP) or Azure Information Protection (AIP), but remember that DLP is the enforcement engine for sharing controls, while MIP handles classification and labeling. For a quick memory tip, think "DLP blocks the share, MIP labels the care."

⚠ Common exam trap

It's easy for candidates to confuse Information Protection (sensitivity labels) with DLP, assuming labels alone can prevent external sharing, but labels require DLP policies to enforce sharing restrictions based on the label's classification.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Data Loss Prevention (DLP)

Data Loss Prevention (DLP) in Microsoft Purview is the correct solution because it is specifically designed to identify, monitor, and automatically protect sensitive data like credit card numbers (using built-in sensitive information types such as Credit Card Number) across Microsoft 365 services, including SharePoint Online and OneDrive for Business. DLP policies can enforce rules to block or restrict external sharing of such data, directly meeting the requirement to prevent users from sharing sensitive data externally.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Data Loss Prevention (DLP)
Why this is correct
Correct. DLP policies can identify sensitive data such as credit card numbers and automatically block actions like sharing externally. It also provides policy tips to educate users.
✗
Data Lifecycle Management (DLM)
Why it's wrong here
Incorrect. DLM focuses on retention and deletion of data over time, not on preventing sharing of sensitive data.
✗
Information Protection (sensitivity labels)
Why it's wrong here
Incorrect. While sensitivity labels can classify and protect data with encryption or watermarks, they are not primarily designed to enforce blocking of external sharing based on content. DLP is the appropriate solution for that.
✗
Audit (Standard)
Why it's wrong here
Incorrect. Audit logs record user and admin activities but does not proactively detect or prevent data sharing.

Go deeper

2 more ways this is tested on SC-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to create a policy that prevents users from sharing credit card numbers via email to external recipients. The policy should only apply to users in the Finance department. Which action should you take?

medium

A.Create a retention label and apply auto-labeling for Finance
B.Create a sensitivity label and publish it to Finance users
C.Copy the default DLP template for financial data and modify it
✓ D.Create a DLP policy, select the Finance user location, and add the credit card number condition

Why D: To apply a DLP policy to specific users, you select their group (e.g., Finance) as a location when creating the policy. This ensures only Finance users are affected. Option A is wrong because auto-labeling with retention labels does not enforce DLP rules. Option B is wrong because sensitivity labels classify data but do not block sharing. Option C is wrong because copying a default template may not allow precise scoping to Finance users; creating a new policy from scratch with location selection is more accurate.

Variation 2. Your company needs to detect and prevent employees from sharing confidential product plans via email with external parties. Which Microsoft Purview solution should you configure?

easy

A.Sensitivity labels
B.Communication compliance
✓ C.Data Loss Prevention (DLP)
D.Retention policies

Why C: Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive information, such as confidential product plans, via email and other channels. DLP policies can inspect email content and attachments for sensitive data types (e.g., custom keywords or patterns) and automatically block or quarantine the message if it is sent to external recipients. This aligns directly with the requirement to prevent employees from sharing confidential plans externally.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.

How to Prevent External Sharing of Credit Card Numbers Using Microsoft Purview DLP

Why each option matters

Option-by-option breakdown

Related to this question

2 more ways this is tested on SC-900