SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Which TWO Microsoft Purview solutions can be used to identify and protect sensitive data in Microsoft 365?
⚠ Common exam trap
It's easy for candidates to confuse 'identifying and protecting sensitive data' with broader compliance solutions like Communication compliance or Insider risk management, which address behavioral monitoring rather than data classification and protection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP)
Data Loss Prevention (DLP) is correct because it uses content analysis (e.g., keyword matching, regex patterns, and machine learning classifiers) to detect and automatically protect sensitive data like credit card numbers or PII across Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are correct because they classify and protect data at rest and in transit by applying encryption, visual markings, and access restrictions based on label policies, enabling persistent protection even when data leaves Microsoft 365.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Loss Prevention (DLP)
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) policies are designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and non-Microsoft cloud apps. DLP utilizes sensitive information types, keywords, and content matching to detect sensitive data, such as credit card numbers or national ID numbers, both at rest and in transit. Upon detection, DLP can block sharing, notify users, or encrypt the content, effectively identifying and protecting the data.
- ✗
Communication compliance
Why it's wrong here
Microsoft Purview Communication Compliance is primarily used to help organizations detect, investigate, and act on inappropriate messages in their internal and external communications. While it monitors content for policy violations related to harassment, threats, or regulatory compliance, its core function is not to identify specific sensitive data patterns for protection. Instead, it focuses on user conduct and communication content types rather than applying direct data protection measures.
- ✗
Insider risk management
Why it's wrong here
Microsoft Purview Insider Risk Management helps organizations identify, analyze, and act on internal risks, such as data theft or data leakage, by monitoring user activities. It focuses on detecting risky user behaviors that could lead to data exposure, rather than directly identifying and protecting sensitive data itself. While it can help mitigate data loss by addressing user actions, it does not classify or apply protective measures to the data content.
- ✓
Sensitivity labels
Why this is correct
Microsoft Purview Sensitivity labels allow organizations to classify and protect sensitive data across documents, emails, and containers. These labels can be applied manually by users or automatically based on content inspection, effectively identifying the data's sensitivity level. Once applied, labels enforce specific protection actions like encryption, access restrictions, visual markings (headers/footers), and watermarks, thereby both identifying and safeguarding the information.
- ✗
eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery solutions are designed to identify, preserve, collect, process, review, and analyze electronically stored information (ESI) for legal or investigative purposes. Its primary role is to facilitate the discovery process in litigation or regulatory inquiries by searching for and exporting relevant content. It does not proactively identify sensitive data for protection or apply any protective measures to the data it discovers.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.