SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your company uses Microsoft Purview Information Protection to classify sensitive data. A user reports that when they try to share a document containing a credit card number via email, the email is blocked. Which Purview feature is most likely causing this behavior?
⚠ Common exam trap
A common mix-up: candidates confuse Sensitivity labels with DLP policies, thinking labels alone can block emails, but labels only apply classification and protection—they require a DLP policy to enforce blocking actions based on content detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policy
A Data Loss Prevention (DLP) policy in Microsoft Purview is specifically designed to detect and block sensitive data—such as credit card numbers—from being shared via email. When a user attempts to send a document containing a credit card number, the DLP policy scans the email content and attachments, matches the credit card pattern (e.g., using the predefined Sensitive Info Type for credit card numbers), and enforces an action like blocking the message. This is the most likely cause of the email being blocked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Loss Prevention (DLP) policy
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including email. They utilize sensitive information types (SITs) to detect specific data patterns, such as credit card numbers, and can enforce actions like blocking email transmission, notifying users, or encrypting content to prevent unauthorized sharing. This capability directly addresses the requirement to detect sensitive data and block its sharing via email.
- ✗
Audit log
Why it's wrong here
Audit logs in Microsoft Purview record user and admin activities across Microsoft 365 services, providing a forensic trail of events for security investigations and compliance. While crucial for understanding data access patterns and post-incident analysis, audit logs are purely reactive. They document what happened after an event occurs and do not possess the capability to proactively prevent or block actions like the real-time email transmission of sensitive data.
- ✗
Sensitivity label
Why it's wrong here
Microsoft Purview sensitivity labels allow organizations to classify and protect data by applying encryption, visual markings (headers, footers, watermarks), and access restrictions directly to the content. While labels can trigger protection actions like encryption or restrict who can access a document, they primarily focus on the data itself and its state. They do not inherently block the transmission of an email containing sensitive data based on its content, unless combined with other policies like DLP or mail flow rules.
- ✗
Retention label
Why it's wrong here
Microsoft Purview retention labels are used to manage the lifecycle of data by defining how long items should be kept or deleted to comply with regulatory requirements. They ensure data is retained for a specified period or disposed of after a certain time, focusing on data governance and lifecycle management. Retention labels have no functionality to detect sensitive content within an email or to block the real-time transmission of emails based on their content.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
DLP policy
A DLP policy is a set of rules that an organization uses to prevent sensitive data from being lost, stolen, or accidentally exposed, whether it is in use, in motion, or at rest.
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.