SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your company wants to use Microsoft Purview to classify and protect sensitive data in Microsoft 365. The compliance team needs to automatically detect credit card numbers in emails and apply a label that encrypts the email. What should they configure?
⚠ Common exam trap
Watch out — candidates often confuse DLP policies (which detect and block) with sensitivity labels (which classify and protect via encryption), leading them to choose C instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A sensitivity label with auto-labeling for sensitive information types
Sensitivity labels with auto-labeling can automatically detect sensitive information types (such as credit card numbers) in emails and apply a label that enforces encryption. This meets the requirement to both classify and protect the data in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A trainable classifier for credit card numbers
Why it's wrong here
Trainable classifiers in Microsoft Purview are designed to identify specific types of content based on examples provided, improving detection accuracy for unstructured data. However, they are primarily a detection mechanism and do not inherently apply protective actions like encryption or even labels automatically. While a trainable classifier can help identify credit card numbers, it requires integration with other policies, such as sensitivity labels, to trigger any automatic classification or encryption.
- ✗
A retention label for credit card information
Why it's wrong here
Retention labels are a component of data governance within Microsoft Purview, specifically designed to manage the lifecycle of information by defining how long content should be kept or deleted. Their primary function is to ensure compliance with data retention policies and regulatory requirements. They do not, however, provide any mechanisms for classifying data based on its content or applying protective measures such as encryption to secure the information itself.
- ✗
A data loss prevention (DLP) policy
Why it's wrong here
A Data Loss Prevention (DLP) policy is primarily focused on identifying, monitoring, and protecting sensitive information from unauthorized sharing or transfer, both inside and outside the organization. While DLP policies can detect sensitive information types, such as credit card numbers, and block or audit actions, their core function is to prevent data exfiltration. DLP policies do not automatically apply classification labels or encryption to the data itself as a primary protective measure.
- ✓
A sensitivity label with auto-labeling for sensitive information types
Why this is correct
Sensitivity labels are the correct and most comprehensive mechanism within Microsoft Purview for classifying data and applying a range of protective actions, including encryption, access restrictions, and visual markings. When configured with auto-labeling policies, these labels can automatically detect specific sensitive information types, such as credit card numbers, within content. Upon detection, the associated sensitivity label, along with its defined encryption and other protections, is automatically applied to the content, ensuring both classification and robust security.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.