SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization is adopting Microsoft 365 Copilot for enterprise users. Which Microsoft Purview capability should you configure to prevent sensitive data from being inadvertently shared during Copilot interactions?
⚠ Common exam trap
Candidates often confuse Sensitivity labels (which apply persistent protection like encryption) with DLP policies (which enforce real-time actions like blocking), leading them to choose labels instead of the correct DLP answer for preventing inadvertent sharing during live interactions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policies
Data Loss Prevention (DLP) policies are the correct Microsoft Purview capability to prevent sensitive data from being inadvertently shared during Copilot interactions. DLP policies can inspect content in real time, including Copilot prompts and responses, and apply actions such as blocking or warning when sensitive information types (e.g., credit card numbers, social security numbers) are detected. This directly addresses the requirement to prevent inadvertent sharing of sensitive data within the Copilot environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Customer Lockbox
Why it's wrong here
Customer Lockbox is designed to provide customers with control over access to their content by Microsoft support personnel during service operations. It requires explicit customer approval for Microsoft engineers to access customer data, primarily for troubleshooting or service restoration. It does not prevent users from sharing sensitive data or enforce data loss prevention policies within applications like Microsoft 365 Copilot.
- ✓
Data Loss Prevention (DLP) policies
Why this is correct
Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various Microsoft 365 services, including applications integrated with Microsoft 365 Copilot. DLP policies can detect sensitive information types (e.g., credit card numbers, PII) and enforce actions such as blocking sharing, notifying users, or encrypting content, thereby preventing accidental or intentional data exfiltration when Copilot generates or processes content.
- ✗
Sensitivity labels
Why it's wrong here
Sensitivity labels from Microsoft Purview Information Protection are used to classify and protect data by applying encryption, visual markings, and access restrictions. While labels can be a component of a DLP policy, they primarily focus on data classification and protection at rest or in transit based on their sensitivity. By themselves, sensitivity labels do not inherently prevent users from sharing labeled sensitive data in contexts like Copilot; they require other mechanisms (like DLP) to enforce such preventative actions.
- ✗
eDiscovery
Why it's wrong here
eDiscovery tools within Microsoft Purview are used for searching, preserving, collecting, and exporting electronic content for legal or investigative purposes. They are reactive tools, designed to identify and manage data after an event has occurred or for compliance audits. eDiscovery does not provide proactive controls or preventative measures to stop sensitive data from being shared or exposed through applications like Microsoft 365 Copilot in real-time.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.