SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company uses Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to documents containing a credit card number. What should they create?
⚠ Common exam trap
Many exam-takers confuse the function of a DLP policy (which blocks or alerts on sensitive data) with an auto-labeling policy (which applies a sensitivity label based on content), as both use sensitive information types but serve different purposes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An auto-labeling policy
An auto-labeling policy in Microsoft Purview Information Protection is designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This allows the 'Confidential' label to be applied without user intervention, meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A sensitivity label
Why it's wrong here
A sensitivity label itself defines the classification and protection settings, such as encryption, visual markings, or content access restrictions, that should be applied to sensitive data. However, a label is merely a container for these settings; it does not possess the inherent capability to automatically scan content and apply itself. Manual user action or an automated policy is required to actually assign a sensitivity label to a document or email.
- ✗
A data loss prevention (DLP) policy
Why it's wrong here
A data loss prevention (DLP) policy primarily focuses on detecting, monitoring, and preventing the unauthorized sharing or leakage of sensitive information, both at rest and in transit. While DLP policies can identify sensitive content based on specific conditions, their core function is to enforce protective actions like blocking, auditing, or notifying, rather than automatically classifying and applying sensitivity labels to content for persistent protection. DLP acts as a gatekeeper, not an automatic classifier.
- ✓
An auto-labeling policy
Why this is correct
An auto-labeling policy is specifically designed within Microsoft Purview Information Protection to automatically scan content across various locations, such as SharePoint, OneDrive, and Exchange, for predefined conditions. When these conditions, which often include sensitive information types, keywords, or trainable classifiers, are met, the policy automatically applies a specified sensitivity label to the content. This ensures consistent and automated classification and protection without requiring manual user intervention.
- ✗
A retention label policy
Why it's wrong here
A retention label policy is fundamentally concerned with data governance and compliance, dictating how long specific content should be retained or when it should be disposed of to meet regulatory or organizational requirements. Unlike sensitivity labels, which focus on classifying content based on its sensitivity to protect against unauthorized access or sharing, retention labels manage the lifecycle of information for legal and compliance purposes, not its inherent confidentiality or integrity.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Sensitivity label
A sensitivity label is a metadata tag applied to digital content that classifies the content's level of confidentiality and governs how it can be shared, protected, and accessed.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.