Microsoft Purview Auto-Labeling Policy: Block Access for Credit Card Data
Exhibit
Refer to the exhibit.
```json
{
"policy": {
"name": "GDPR Policy",
"labels": [
{
"name": "Confidential",
"settings": {
"encryption": {
"enabled": true,
"templateId": "dummy-encryption-template"
}
}
}
],
"rules": [
{
"condition": {
"sensitivityLabel": "Confidential",
"contains": "Credit Card Number"
},
"action": "blockAccess"
}
]
}
}
```You are reviewing a Microsoft Purview auto-labeling policy configuration. Based on the exhibit, what happens when a document contains a credit card number and is labeled 'Confidential'?
Quick Answer
The answer is that access is blocked. This occurs because the Microsoft Purview auto-labeling policy rule explicitly combines the condition of detecting a credit card number with the action 'blockAccess' when the document already carries the 'Confidential' label, overriding any default behavior like encryption or notification. On the SC-900 exam, this scenario tests your understanding of how auto-labeling policies enforce conditional access based on sensitive data types and existing labels, often appearing as a trick where candidates assume encryption is the default action. A common trap is confusing 'blockAccess' with 'applyEncryption' or misreading the rule’s priority. Remember the memory tip: “Block the card, not the label”—the action targets the sensitive data condition, not the label itself, so when both a credit card number and the Confidential label are present, the policy blocks access outright.
⚠ Common exam trap
A common mix-up: candidates confuse the action of 'applying a label' with the label's default protection settings, assuming encryption is always applied, when in fact the policy's specific action (e.g., block access) determines the outcome.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Access is blocked
The exhibit shows a Microsoft Purview auto-labeling policy configured to apply the 'Confidential' label when a credit card number is detected. The policy's action for this label is set to 'Block access,' meaning that when the condition is met, the document's access is blocked. Therefore, option D is correct because the policy explicitly blocks access to the document.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Access is allowed
Why it's wrong here
The action is blockAccess.
- ✗
Encryption is applied to the document
Why it's wrong here
The rule blocks access, does not apply encryption.
- ✗
An administrator is notified
Why it's wrong here
No notification action is configured.
- ✓
Access is blocked
Why this is correct
The rule blocks access when condition met.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to classify and label documents in SharePoint automatically based on sensitive content like social security numbers. Which Microsoft Purview solution should they use?
easy- A.eDiscovery
- ✓ B.Auto-labeling policy
- C.Audit log
- D.Data loss prevention policy
Why B: Auto-labeling policies in Microsoft Purview can automatically detect sensitive content such as social security numbers in SharePoint documents and apply the appropriate sensitivity label. This enables consistent classification and protection without manual user intervention, directly meeting the company's requirement.
Variation 2. A company wants to automatically classify documents containing credit card numbers and apply encryption at rest in SharePoint Online. Which Microsoft Purview feature should be used?
medium- ✓ A.Sensitivity labels with auto-classification
- B.eDiscovery
- C.Microsoft Purview Audit
- D.Data Loss Prevention (DLP) policies
Why A: Sensitivity labels with auto-classification can automatically detect sensitive data types such as credit card numbers using built-in or custom sensitive info types, and then apply a label that enforces encryption at rest in SharePoint Online. This meets the requirement of both automatic classification and encryption enforcement without manual user intervention.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.