SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft 365 E5 licenses and wants to prevent sensitive data from being shared externally via email. You need to configure a solution that automatically scans outgoing emails for credit card numbers and blocks them if detected. What should you use?
⚠ Common exam trap
A common mix-up: candidates confuse Microsoft Defender for Office 365 (which handles malware and phishing) with Microsoft Purview DLP (which handles data protection), leading them to select the security-focused option instead of the compliance-focused one.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online
Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is the correct solution because it is specifically designed to inspect email content and attachments for sensitive data types, such as credit card numbers, using built-in sensitive info types. When a match is detected, the policy can automatically block the email from being sent externally, enforcing the organization's data protection requirements without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Defender for Office 365 Safe Attachments policy
Why it's wrong here
Microsoft Defender for Office 365 Safe Attachments policies are primarily designed to protect against zero-day malware and viruses by detonating email attachments in a sandbox environment before delivery to users. While crucial for advanced threat protection, these policies do not inspect the content of attachments or email bodies for sensitive information types to prevent data loss. Therefore, they cannot fulfill the requirement of identifying and blocking the outbound sharing of sensitive, legitimate data.
- ✓
Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online
Why this is correct
A Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is specifically engineered to identify, monitor, and protect sensitive information sent via email. These policies utilize sensitive information types, keywords, and content matching to detect specific data patterns, such as credit card numbers or national ID numbers, within email messages and attachments. Upon detection, the policy can enforce actions like blocking the email, encrypting it, or notifying administrators, directly preventing unauthorized data egress.
- ✗
Microsoft Intune App Protection policy
Why it's wrong here
Microsoft Intune App Protection policies focus on securing organizational data within specific mobile applications, regardless of device enrollment status. They enforce controls like preventing 'save as' to personal storage, restricting copy/paste between managed and unmanaged apps, and requiring PIN access for app data. These policies manage data *within* applications on endpoints, not the content of emails being transmitted through the Exchange Online service itself to prevent data loss.
- ✗
Microsoft Entra ID Conditional Access policy
Why it's wrong here
Microsoft Entra ID Conditional Access policies regulate *who* can access *what* resources and *under what conditions*, such as requiring multi-factor authentication for specific applications or blocking access from untrusted locations. While vital for identity and access management, these policies do not inspect the actual content of data being transmitted once access is granted. They control the gateway to services, not the information flowing through them to prevent specific sensitive information from being shared.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Data protection
Data protection refers to the practices and technologies used to safeguard personal and sensitive information from unauthorized access, loss, or corruption.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.