SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Exhibit
{
"DataSource": "Exchange",
"Filter": {
"Recipients": ["external@contoso.com"],
"SensitivityLabel": "Confidential"
},
"AlertThreshold": {
"Type": "Volume",
"Value": 10
}
}Refer to the exhibit. A Microsoft Purview Data Loss Prevention (DLP) policy is configured. What does this policy do?
⚠ Common exam trap
Candidates often assume that any DLP policy that detects sensitive data sent externally will block the transmission. However, this policy is configured to generate an alert, not block, as shown by the alert action in the exhibit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It generates an alert if more than 10 emails with the Confidential label are sent to an external recipient.
The DLP policy rule shown in the exhibit specifies an action to 'Send an alert' when the condition 'Number of emails sent to external recipients with label Confidential exceeds 10' is met. This means the policy generates an alert (e.g., via email or incident report) when more than 10 emails containing the Confidential label are sent to external recipients, without blocking the emails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It generates an alert if more than 10 emails with the Confidential label are sent to an external recipient.
Why this is correct
This statement accurately describes the policy's behavior. The policy is configured to detect emails tagged with the 'Confidential' sensitivity label that are sent to external recipients. Crucially, it includes a threshold condition, triggering an alert only when the volume exceeds 10 such emails, indicating a potential bulk data exfiltration attempt rather than a single accidental share. This design allows for monitoring and investigation without immediately disrupting business operations for minor incidents.
- ✗
It blocks all emails sent to external recipients with the Confidential label.
Why it's wrong here
This statement is incorrect because the policy's defined action is to generate an alert, not to block the transmission of emails. Microsoft Purview DLP policies offer a range of enforcement actions, from passive monitoring and alerting to active blocking or encryption. The 'exhibit' (implied policy configuration) clearly indicates an alert-based response, allowing the emails to be sent while flagging the activity for review by security or compliance teams.
- ✗
It prevents internal users from sending Confidential emails to each other.
Why it's wrong here
This option is incorrect because the policy's scope is specifically limited to emails sent to 'external recipients.' Data Loss Prevention policies are highly granular, and this particular configuration explicitly excludes internal communications. Therefore, emails exchanged between users within the same organization, even if they carry the 'Confidential' label, would not trigger this specific policy's conditions, as the recipient criterion is not met.
- ✗
It automatically applies the Confidential label to emails sent to external recipients.
Why it's wrong here
This statement is inaccurate as the policy's function is to detect and respond to emails *already* classified with the 'Confidential' label, not to apply labels itself. Sensitivity label application is typically handled by separate auto-labeling policies, manual user action, or other classification mechanisms within Microsoft Purview Information Protection. A DLP policy acts as a protective layer that enforces rules based on existing data classifications or content analysis, rather than performing the classification itself.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
DLP policy
A DLP policy is a set of rules that an organization uses to prevent sensitive data from being lost, stolen, or accidentally exposed, whether it is in use, in motion, or at rest.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.