SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Which TWO Microsoft Purview solutions can be used to automatically classify sensitive data at rest?
⚠ Common exam trap
Test-takers frequently confuse Communication Compliance (which monitors communications) with Information Protection (which classifies data), or they think eDiscovery or Auditing can classify data, when in fact they are reactive or investigative tools, not proactive classification solutions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Lifecycle Management
Data Lifecycle Management (DLM) automatically classifies sensitive data at rest by applying retention labels based on sensitive content detection, such as credit card numbers or social security numbers, using trainable classifiers or exact data match. Information Protection (IP) extends this by enabling automatic labeling of documents and emails based on sensitive information types, ensuring data is classified and protected while stored in SharePoint, OneDrive, or Exchange Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Lifecycle Management
Why this is correct
Data Lifecycle Management in Microsoft Purview includes retention policies and retention labels. These labels can be configured for automatic application based on sensitive information types, keywords, or trainable classifiers, thereby automatically classifying data at rest to manage its retention and deletion throughout its lifecycle. This ensures compliance without manual intervention.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance is designed to help organizations detect, investigate, and act on inappropriate messages in their internal and external communications. While it monitors content for policy violations, it does not automatically classify data by applying labels or metadata; instead, it flags content for review by human investigators.
- ✗
eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery solutions are used to identify, preserve, collect, process, review, and analyze electronically stored information (ESI) for legal or investigative purposes. While it can locate specific data, it is a discovery tool that does not automatically classify or apply sensitivity or retention labels to content; its function is retrieval and analysis, not data categorization.
- ✗
Auditing
Why it's wrong here
Microsoft Purview Auditing provides a comprehensive record of user and admin activities across various Microsoft 365 services. Its primary purpose is to track events, such as file access, policy changes, or label applications, for security and compliance investigations. However, Auditing itself is a logging mechanism and does not automatically classify data or apply any form of labeling to content.
- ✓
Information Protection
Why this is correct
Microsoft Purview Information Protection (MPIP) enables organizations to discover, classify, and protect sensitive information. Its auto-labeling policies for files at rest in SharePoint, OneDrive, and Exchange, or client-side auto-labeling, automatically classify content based on sensitive information types, regular expressions, or trainable classifiers, applying sensitivity labels without user intervention.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Information protection
Information protection refers to the policies, procedures, and technologies used to safeguard data from unauthorized access, disclosure, alteration, or destruction.
Key term
Data lifecycle management
Data lifecycle management is the process of managing data from its creation to its deletion, ensuring it is stored, used, and disposed of in a way that meets security, compliance, and business needs.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.