SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company wants to protect sensitive data in Microsoft Teams. Which two Microsoft Purview features can help prevent accidental sharing of confidential information? (Choose two.)
⚠ Common exam trap
Many exam-takers confuse detective controls (like audit logs and eDiscovery) with preventive controls (like DLP and sensitivity labels), leading them to select options that only record or search for data after it has been shared rather than stopping the sharing in the first place.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policies for Teams
Data Loss Prevention (DLP) policies for Teams can detect and block sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams messages and channels, preventing accidental exposure. Sensitivity labels allow you to classify and protect Teams sites and content by applying encryption, visual markings, and access restrictions, ensuring confidential data is not shared with unauthorized users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Loss Prevention (DLP) policies for Teams
Why this is correct
DLP policies for Teams proactively identify and prevent the sharing of sensitive information, such as credit card numbers or health records, within Teams chats, channels, and files. These policies leverage sensitive information types and trainable classifiers to detect data and can automatically block sharing, notify users, or require justification before allowing the action, directly protecting against data exfiltration.
- ✗
Audit log search for Teams
Why it's wrong here
Audit log search for Teams provides a historical record of user and admin activities, including file access, message deletions, and policy changes. While crucial for forensic investigations, compliance auditing, and identifying past incidents, it is a reactive tool that tracks events after they occur and does not offer real-time prevention or blocking of sensitive data sharing.
- ✗
eDiscovery for Teams
Why it's wrong here
eDiscovery for Teams is designed for legal and compliance investigations, enabling organizations to search for, preserve, and export content from Teams communications and files for legal hold purposes. Its primary function is to gather evidence for litigation or regulatory requests, not to proactively prevent users from sharing sensitive data within the platform. It is a post-event collection and preservation mechanism.
- ✗
Retention policies for Teams messages
Why it's wrong here
Retention policies for Teams messages govern the lifecycle of data by specifying how long messages and files should be kept or deleted to meet regulatory and organizational compliance requirements. While essential for data governance and ensuring data availability or eventual disposal, these policies do not inspect content in real-time or prevent users from initially sharing sensitive information. They manage data after it has been created or shared.
- ✓
Sensitivity labels for Teams sites and content
Why this is correct
Sensitivity labels for Teams sites and content allow organizations to classify data and apply protective actions directly to the information itself, regardless of where it resides. These labels can enforce encryption, restrict access to specific users or groups, prevent external sharing, and apply visual markings, thereby proactively safeguarding sensitive data from unauthorized access or inappropriate sharing within Teams and beyond.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Exposure
Exposure is the measure of potential loss or harm to an organization's assets when a vulnerability is exploited by a threat, often expressed as the window of time or degree of access an attacker has.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.