Courseiva

SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Exhibit

{
  "LabelId": "d9b2d4c9-4c8e-4f3a-9a7e-1b2c3d4e5f6a",
  "DisplayName": "Highly Confidential",
  "Tooltip": "This label is for highly confidential data.",
  "Color": "Red",
  "Priority": 1,
  "SensitiveInfoTypes": [
    {
      "Name": "Credit Card Number",
      "Id": "50842eb7-edc8-4019-85dd-5a5c1f2bb085"
    }
  ]
}

Refer to the exhibit. The JSON snippet shows a sensitivity label configuration. What is the purpose of the 'SensitiveInfoTypes' property in this label?

⚠ Common exam trap

Many candidates confuse the 'SensitiveInfoTypes' property with encryption or retention settings, because all three are configurable within a sensitivity label's wizard, but each serves a distinct purpose and is located in separate sections of the label configuration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

It specifies the sensitive information types that trigger automatic labeling.

The 'SensitiveInfoTypes' property in a sensitivity label configuration specifies which built-in or custom sensitive information types (e.g., credit card numbers, passport numbers) should be detected in content. When these types are matched, the label can be applied automatically through auto-labeling policies, ensuring consistent protection without requiring manual user action.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • It sets the retention period for content with this label.

    Why it's wrong here

    This property does not set the retention period for content. Retention periods are typically configured within the separate retention settings of a sensitivity label or, more commonly, through dedicated retention labels and their associated policies. While a sensitivity label can trigger a retention policy, the `sensitiveInfoTypes` property specifically defines the conditions for automatic classification, not the duration for which content should be preserved or deleted.

  • It defines the user groups that can apply this label manually.

    Why it's wrong here

    This property does not define the user groups that can manually apply the label. The ability for specific users or groups to see and manually apply a sensitivity label is controlled by the label policy, which is published to designated users or security groups. The label definition itself focuses on the label's characteristics and actions, such as its name, visual markings, protection settings, and auto-labeling conditions, not its deployment scope.

  • It specifies the sensitive information types that trigger automatic labeling.

    Why this is correct

    This property precisely specifies the sensitive information types (SITs) that, when detected in content, will trigger the automatic application of this sensitivity label. These SITs act as conditions, allowing the system to identify and classify documents or emails containing specific patterns, such as credit card numbers or national identification numbers, without requiring manual user intervention, thereby enforcing data protection policies automatically.

  • It configures the encryption settings for the label.

    Why it's wrong here

    This property does not configure the encryption settings for the label. Encryption and access control settings, including who can access the content and what rights they have (e.g., view, edit, copy), are defined within the 'Protection' section of a sensitivity label's configuration. The `sensitiveInfoTypes` property, in contrast, is solely dedicated to defining the criteria for automatic classification based on content analysis, separate from the protective actions the label enforces.

About these practice questions

This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.