SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Which TWO Microsoft Purview solutions can be used to discover and classify sensitive data in Microsoft 365? (Select two.)
⚠ Common exam trap
The SC-900 exam often tests the distinction between the tool that performs discovery (Data Classification) and the solution that enables classification (Information Protection), causing candidates to mistakenly select Sensitivity labels as a discovery solution instead of recognizing it as a labeling mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Information Protection
Information Protection (option B) provides the ability to discover, classify, and protect sensitive data across Microsoft 365 by using trainable classifiers and content scanning. Data Classification (option E) offers a unified view of sensitive data across the tenant, including classification results from sensitivity labels and retention labels, enabling administrators to identify and monitor sensitive information at scale.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) is primarily designed to prevent sensitive information from being shared inappropriately, either internally or externally. While DLP policies utilize classifications to identify sensitive data, its core function is policy enforcement and protection, not the initial discovery, scanning, or cataloging of unclassified data across an organization's entire data estate.
- ✓
Information Protection
Why this is correct
Microsoft Purview Information Protection (MPIP) is a comprehensive solution designed to discover, classify, label, and protect sensitive data throughout an organization's digital estate. It leverages sensitivity labels, sensitive information types, and trainable classifiers to identify and categorize data based on its sensitivity, applying visual markings, encryption, and access restrictions to ensure proper handling and compliance.
- ✗
Sensitivity labels
Why it's wrong here
Sensitivity labels are a fundamental component and feature *within* Microsoft Purview Information Protection, not a standalone Purview solution. They provide a mechanism to classify data based on its sensitivity, applying visual markings, encryption, and access controls, but they are deployed and managed as part of the broader Information Protection framework, which is the actual solution.
- ✗
Audit
Why it's wrong here
Microsoft Purview Audit provides a unified logging solution that records user and administrator activities across various Microsoft 365 services, including data access and modification events. Its primary purpose is to enable forensic investigations and compliance reviews by tracking actions, not to discover or classify the actual content or sensitivity of the data itself.
- ✓
Data Classification
Why this is correct
Microsoft Purview Data Classification is a core capability within the Purview suite specifically designed to identify, categorize, and label sensitive information across an organization's entire data estate. It utilizes various methods, such as sensitive information types (SITs), trainable classifiers, and exact data match (EDM), to automatically discover and classify data at scale, directly addressing the need for data discovery and categorization.
Visual reference
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.