SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization, Fabrikam Inc., uses Microsoft 365 E5 licenses. The security team is deploying Microsoft Purview to protect sensitive data. They need to ensure that when a user attempts to share a document containing credit card numbers with an external partner, the action is blocked and the user receives a policy tip. Additionally, the incident should be logged for investigation. You have already created a sensitivity label for credit card data and auto-labeled documents. Which Microsoft Purview feature should you configure to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Data Loss Prevention (DLP) policy that applies to documents containing credit card numbers, with an action to block sharing and notify users via policy tip.
Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive information (e.g., credit card numbers) in documents and emails, block sharing, display policy tips, and generate incident reports. Sensitivity labels alone do not enforce restrictions on sharing. Records management handles retention. Insider risk management detects risky user activities. Audit logs record events but do not block actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Microsoft Purview Insider Risk Management to detect the sharing activity.
Why it's wrong here
Microsoft Purview Insider Risk Management is primarily designed for detecting and investigating risky activities and potential data exfiltration by internal users. While it can identify patterns of sensitive data sharing, its core function is not to proactively block sharing in real-time or provide immediate policy tips to users. It focuses on post-event analysis and alerting security teams to potential insider threats.
- ✗
Implement Microsoft Purview Records Management with a retention label that prevents sharing.
Why it's wrong here
Microsoft Purview Records Management, through retention labels, is fundamentally focused on managing the data lifecycle, ensuring compliance with legal and regulatory record-keeping requirements. Retention labels dictate how long data is preserved or when it's deleted, and its disposition. They are not engineered to detect specific sensitive content like credit card numbers or to enforce real-time sharing restrictions by blocking external access based on content analysis.
- ✓
Create a Data Loss Prevention (DLP) policy that applies to documents containing credit card numbers, with an action to block sharing and notify users via policy tip.
Why this is correct
Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information such as credit card numbers across various locations. A DLP policy can be precisely configured to detect this sensitive data within documents and then automatically enforce actions like blocking external sharing. Furthermore, it can provide immediate, user-facing policy tips to educate individuals about the policy violation, making it the ideal solution for both prevention and user notification.
- ✗
Configure a sensitivity label policy that blocks external sharing when the label is applied.
Why it's wrong here
While Microsoft Purview sensitivity labels are excellent for classifying data and applying protective measures like encryption or visual markings, they do not inherently possess the capability to block external sharing on their own. Sensitivity labels primarily tag and protect content, but to enforce a sharing restriction or other specific actions based on the label's presence, a separate Data Loss Prevention (DLP) policy or an Azure Information Protection (AIP) policy is required to act upon that classification. The label itself is a classification mechanism, not an enforcement engine for sharing rules.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.