Microsoft Purview Capabilities: Data Classification, Data Loss Prevention, and Data Lifecycle Management
Which THREE capabilities are provided by Microsoft Purview? (Choose three.)
Quick Answer
The answer is data loss prevention (DLP), data classification, and data lifecycle management. These three capabilities form the core of Microsoft Purview’s unified data governance and compliance solution, enabling organizations to understand their data, protect sensitive information, and manage data retention and deletion policies. On the SC-900 exam, this question tests your ability to distinguish Purview’s specific portfolio from adjacent Microsoft security products. A common trap is confusing Purview’s data loss prevention with Microsoft Entra’s identity protection features, or mixing up data lifecycle management with Microsoft Defender’s threat protection capabilities. To remember the three pillars, think of the acronym “CDL”: Classification (know your data), DLP (protect your data), and Lifecycle (manage your data from creation to deletion).
⚠ Common exam trap
Many candidates confuse Microsoft Purview's data security capabilities (classification, DLP, retention) with identity or threat management features that belong to Microsoft Entra ID or Microsoft Defender solutions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data classification and labeling
Microsoft Purview provides data classification and labeling (A) through sensitive information types, trainable classifiers, and sensitivity labels that tag and protect content across Microsoft 365 and other sources. It delivers data lifecycle management and retention (B) via retention labels, retention policies, and records management to keep or delete content per compliance requirements. It also includes data loss prevention (C), which detects and blocks risky sharing of sensitive data across Exchange, SharePoint, OneDrive, Teams, and endpoint devices. Identity protection and risk detection (D) belongs to Microsoft Entra ID Protection, not Purview, and threat and vulnerability management (E) is a Microsoft Defender for Endpoint capability, so neither is a Purview feature.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data classification and labeling
Why this is correct
Microsoft Purview applies sensitivity labels and trains classifiers to identify and tag data across locations, forming the foundation for protection and governance. Classification and labelling are core Purview capabilities, distinct from endpoint detection or threat hunting.
- ✓
Data lifecycle management and retention
Why this is correct
Retention and data lifecycle management in Microsoft Purview govern how long content is kept and when it is deleted, satisfying the requirement for capabilities covering the full information lifecycle rather than only classification or investigation.
- ✓
Data loss prevention (DLP)
Why this is correct
Data loss prevention is a core Microsoft Purview capability, identifying and blocking sensitive data movement across Exchange Online, SharePoint, OneDrive, Teams and endpoint devices. It satisfies the stem's requirement by protecting information wherever it lives or travels, using sensitivity labels and trainable classifiers to detect content such as credit card numbers or health records.
- ✗
Identity protection and risk detection
Why it's wrong here
Identity protection and risk detection belong to Microsoft Entra ID Protection, which evaluates sign-in and user risk. Purview governs data estates through classification, sensitivity labels, data maps and audit, so this capability sits outside its data-security and compliance scope.
- ✗
Threat and vulnerability management
Why it's wrong here
Threat and vulnerability management belongs to Microsoft Defender for Endpoint, not Microsoft Purview, so it cannot satisfy a question asking specifically for Purview capabilities. It is tempting because it sounds like a governance or compliance function, and it would be the right answer if the question instead asked which capability Microsoft Defender for Endpoint provides.
Go deeper
Related to this question
Learn chapter
Information Protection and DLP
Key term
Records Management
Records management is the systematic control of an organization's records, from creation or receipt through processing, distribution, maintenance, storage, retrieval, and disposal, ensuring integrity, compliance, and availability.
Key term
Microsoft Defender
Microsoft Defender is a suite of security products that protects devices, data, and identities from cyber threats like malware, phishing, and unauthorized access.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which THREE are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)
medium- A.Automatically classify and label data
- ✓ B.Detect sensitive information in documents and emails
- ✓ C.Block sharing of sensitive data with external users
- D.Manage encryption keys for data at rest
- ✓ E.Provide policy tips to users when they attempt to share sensitive data
Why B: Microsoft Purview DLP is designed to detect sensitive information (e.g., credit card numbers, PII) in documents and emails by using built-in or custom sensitive information types. When a match is found, DLP can enforce policies to block sharing with external users and display policy tips to inform users of the violation, making options B, C, and E correct capabilities.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.