SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?
⚠ Common exam trap
Test-takers frequently confuse 'Block access to content' with 'Block external sharing', not realizing that the former blocks all sharing (internal and external) while the latter specifically targets external recipients, allowing internal sharing as required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.
Microsoft Purview DLP allows you to configure a policy that blocks external sharing of sensitive data (credit card numbers) while permitting internal sharing, and user notifications can be enabled to alert users when they attempt to share externally. This meets the requirement to prevent external sharing, allow internal sharing, and notify the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.
Why it's wrong here
This option is incorrect because the 'Block access to content' action, when applied to 'all recipients,' is overly restrictive. It would prevent both internal and external sharing of documents containing credit card numbers, severely hindering legitimate internal collaboration and business processes. A more granular approach is needed to differentiate between permissible internal use and prohibited external exfiltration.
- ✓
Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.
Why this is correct
This option is correct as it precisely addresses the common requirement to protect sensitive data from leaving the organization while enabling necessary internal collaboration. The 'Block external sharing' action directly prevents data exfiltration to unauthorized external parties, while explicitly allowing internal sharing supports legitimate business operations. Furthermore, enabling user notifications with policy tips is a best practice for educating users about compliance policies and fostering a security-aware culture.
- ✗
Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.
Why it's wrong here
This option is incorrect because 'Allow override' with a business justification primarily focuses on permitting users to bypass the policy under specific circumstances, rather than enforcing a default block on external sharing. While overrides can be useful for flexibility, this action does not provide the robust, proactive protection against unauthorized external data transfer typically required for highly sensitive information like credit card numbers. It also fails to differentiate between internal and external recipients for blocking purposes.
- ✗
Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.
Why it's wrong here
This option is incorrect because merely using 'Notify user with policy tip' without any blocking action is insufficient to meet the implied requirement of preventing external sharing. While policy tips are valuable for user education and awareness, they do not enforce any technical restrictions on data movement. For sensitive data like credit card numbers, a strong preventative measure, such as blocking, is essential to ensure compliance and data protection.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.