SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Classify and label sensitive data

  Why this is correct

  Microsoft Purview Information Protection (MPIP) is a foundational component that enables organizations to identify, categorize, and apply sensitivity labels to data across various locations, including Microsoft 365 services, on-premises file shares, and third-party cloud apps. This classification helps in understanding the data landscape and applying appropriate protection measures, making it a core capability.

• ✗

  Block external sharing of files

  Why it's wrong here

  While closely related to data protection, blocking external sharing of files is primarily a capability of Microsoft Purview Data Loss Prevention (DLP). DLP policies are configured to detect sensitive information being shared outside the organization's boundaries and can automatically block or audit such actions, preventing unauthorized exfiltration of data. Microsoft Purview Information Protection labels can trigger DLP policies, but the blocking action itself is a DLP enforcement.

• ✗

  Detect malware in email attachments

  Why it's wrong here

  Detecting malware in email attachments is a core function of Microsoft Defender for Office 365, which is part of the broader Microsoft Defender XDR suite. This security service employs advanced threat protection capabilities like safe attachments and safe links to scan incoming emails for malicious content, ensuring that threats are neutralized before they reach end-users. Microsoft Purview focuses on data governance and compliance, not real-time threat detection.

• ✓

  Apply encryption based on sensitivity labels

  Why this is correct

  Microsoft Purview Information Protection sensitivity labels can be configured to automatically apply encryption to documents and emails containing sensitive data. When a user applies a label configured for encryption, or when auto-labeling policies detect sensitive content, the data is encrypted, and access permissions are restricted based on the label's policy. This ensures that only authorized individuals can view or modify the protected information, even if it leaves the organization's control.

• ✗

  Monitor user activities in real-time

  Why it's wrong here

  Monitoring user activities in real-time, especially for potential risky or malicious behavior, falls under capabilities like Microsoft Purview Insider Risk Management or Microsoft Purview Audit. These services collect and analyze user signals across Microsoft 365 services to identify unusual patterns, policy violations, or data exfiltration attempts. While Purview encompasses these, 'monitoring user activities in real-time' is a specific function of these specialized components, not a general capability of 'Microsoft Purview' in the context of its core data classification and protection features.

Go deeper

Related to this question