SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Which TWO Microsoft Purview features can be used to classify and label sensitive data in Microsoft 365?
⚠ Common exam trap
Many exam-takers confuse Data Loss Prevention policies with classification and labeling, but DLP policies only enforce actions based on existing labels or sensitive info types, not create or apply the labels themselves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-labeling policies
Auto-labeling policies (A) are correct because they allow organizations to automatically apply sensitivity labels to data based on conditions such as sensitive information types or pattern matching, enabling classification and labeling without manual user intervention. Sensitivity labels (D) are correct because they are the core mechanism in Microsoft Purview for classifying and protecting sensitive data by applying persistent labels that can enforce encryption, access restrictions, and visual markings across Microsoft 365 services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Auto-labeling policies
Why this is correct
Auto-labeling policies in Microsoft Purview are powerful tools that automatically apply sensitivity labels to content based on predefined conditions. These conditions often include the detection of specific sensitive information types, keywords, or regular expressions within documents and emails. By automatically assigning labels, these policies effectively classify data at scale, ensuring consistent application of classification without requiring manual user intervention.
- ✗
Data Loss Prevention policies
Why it's wrong here
Data Loss Prevention (DLP) policies are designed primarily to prevent the unauthorized sharing or exfiltration of sensitive information. While DLP policies can identify sensitive data based on specific criteria, their core function is to enforce protective actions like blocking, auditing, or notifying, rather than applying a persistent classification label or metadata to the content itself for ongoing management or categorization.
- ✗
Retention policies
Why it's wrong here
Retention policies in Microsoft Purview are used to manage the lifecycle of data by defining how long content should be kept or deleted to meet regulatory, legal, or business requirements. Although these policies can be applied to content that has already been classified, their purpose is focused on data governance (retention and deletion schedules), not the initial act of identifying, categorizing, or assigning a classification level to the data itself.
- ✓
Sensitivity labels
Why this is correct
Sensitivity labels are a fundamental classification mechanism within Microsoft Purview, allowing organizations to classify and protect their data. These labels apply persistent metadata to content, indicating its sensitivity level and enabling associated protective actions such as encryption, visual markings (headers, footers, watermarks), or access restrictions. They serve as the primary means to categorize data based on its business impact or confidentiality requirements.
- ✗
Audit policies
Why it's wrong here
Audit policies are designed to record user and administrator activities across various Microsoft 365 services, providing a comprehensive log for security investigations, compliance adherence, and forensic analysis. Their function is to track and report on 'who did what, when, and where' with data, rather than to identify, categorize, or apply classification metadata to the content itself. Therefore, they do not directly contribute to data classification.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.