SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Automatically classify and label data

  Why it's wrong here

  Automatically classifying and labeling data is primarily a capability of Microsoft Purview Information Protection (MPIP) auto-labeling policies, not a core function of Data Loss Prevention (DLP). While DLP policies can leverage existing sensitivity labels to enforce rules, their direct role is to detect sensitive content and prevent its unauthorized sharing, rather than performing the initial classification and application of labels to documents or emails themselves. This distinction highlights the different but complementary roles within the broader Purview suite.

• ✓

  Detect sensitive information in documents and emails

  Why this is correct

  Detecting sensitive information in documents and emails is a fundamental capability of Microsoft Purview Data Loss Prevention. DLP policies are meticulously configured to identify specific sensitive information types (SITs), such as credit card numbers, national ID numbers, or custom patterns, within content across various locations like Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. This precise detection mechanism forms the essential prerequisite for any subsequent enforcement actions, ensuring that policies target the correct data.

• ✓

  Block sharing of sensitive data with external users

  Why this is correct

  Blocking the sharing of sensitive data with external users is a core enforcement capability of Microsoft Purview Data Loss Prevention. Once a DLP policy identifies sensitive information within a document or email, it can be configured to prevent specific actions, such as sharing that content with individuals or organizations outside the defined organizational boundaries. This directly mitigates the risk of data exfiltration and helps maintain compliance by strictly controlling the flow of sensitive data beyond the enterprise perimeter.

• ✗

  Manage encryption keys for data at rest

  Why it's wrong here

  Managing encryption keys for data at rest is not a capability of Microsoft Purview Data Loss Prevention; this function typically falls under services like Azure Key Vault or specific features within Microsoft Purview Information Protection (MPIP) for encryption. DLP's focus is on preventing the unauthorized disclosure or transfer of sensitive data through user actions, not on the cryptographic lifecycle management of the encryption keys used to protect data when it is stored. Key management is a distinct security control separate from DLP's operational scope.

• ✓

  Provide policy tips to users when they attempt to share sensitive data

  Why this is correct

  Providing policy tips to users when they attempt to share sensitive data is a crucial user-facing feature of Microsoft Purview Data Loss Prevention. These real-time notifications appear directly within applications like Outlook, Word, or SharePoint, informing users that their intended action violates a DLP policy. Policy tips serve to educate users about data protection policies, allowing them to either correct their action, override the policy with a business justification, or report a false positive, thereby fostering a culture of compliance and responsible data handling.

Go deeper

Related to this question