How to Block Credit Card Numbers in Email with Microsoft Purview DLP
Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive credit card numbers via email. The DLP policy must trigger automatically when a user attempts to send an email containing a credit card number. Which DLP configuration should you use?
Quick Answer
The answer is to create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email. This configuration works because Microsoft Purview DLP uses predefined sensitive info types—like regex patterns for credit card numbers—to automatically detect the data in transit, and the block action prevents the email from being sent, either by rejecting it at the transport layer or by sending a notification to the user. On the SC-900 exam, this tests your understanding of how DLP policies apply to data in motion, specifically email; a common trap is confusing DLP with security tools like Microsoft Defender for Office 365 (which handles threats, not data classification) or encryption features like Customer Key or Double Key Encryption (which protect data at rest, not block sharing). Remember the memory tip: “DLP detects and blocks; encryption protects but doesn’t stop the send.”
⚠ Common exam trap
Test-takers frequently confuse data-at-rest encryption controls (like Customer Key or Double Key Encryption) with data-loss prevention capabilities that inspect and block data in transit, leading them to select encryption options instead of the DLP policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email
Microsoft Purview DLP policies can be configured to detect sensitive information types, such as the Credit Card Number (defined by regex and checksum validation per PCI DSS), and automatically apply an action to block the email from being sent. This meets the requirement for automatic, policy-driven prevention of sharing credit card numbers via email.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email
Why this is correct
Matching the Credit Card Number sensitive information type gives the policy a precise detection condition, and the block action stops the email at send time. This satisfies the stem's requirement for automatic triggering when credit card data appears in outbound mail.
- ✗
Configure Double Key Encryption for the Exchange Online mailbox
Why it's wrong here
Double Key Encryption protects labelled content with two keys so Microsoft cannot decrypt it; it does not detect credit card numbers or stop an email being sent. It is tempting because DKE is correct when highly sensitive data must remain unreadable to Microsoft while still being classified and protected.
- ✗
Configure a Safe Links policy in Microsoft Defender for Office 365
Why it's wrong here
Safe Links rewrites and checks URLs at click time to block malicious destinations; it does not scan message bodies for credit card number patterns or prevent sending. It is tempting because Safe Links is correct when defending against phishing links and malicious websites delivered through email or Teams.
- ✗
Use Microsoft Purview Customer Key for encryption
Why it's wrong here
Customer Key encrypts data at rest with customer-managed keys; it neither inspects email content nor blocks sending, so credit card numbers still leave the tenant. It is tempting because Customer Key is correct when regulatory requirements mandate controlling the root encryption keys protecting Microsoft 365 data at rest.
Go deeper
Related to this question
Learn chapter
Azure Policy Effects: Audit, Deny, Modify
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
5 more ways this is tested on SC-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. You need to ensure that when a user attempts to share a document containing a credit card number via email, the email is blocked and the user receives a policy tip. Which action should you configure in the DLP policy?
medium- A.Notify user
- B.Audit only
- ✓ C.Block with user notification
- D.Block override
Why C: The 'Block with user notification' action in a Microsoft Purview DLP policy blocks the email when sensitive data like credit card numbers is detected and simultaneously shows the user a policy tip explaining why. This matches both requirements: blocking the email and notifying the user.
Variation 2. An organization uses Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally. They need to block sharing of credit card numbers in emails and Teams messages. What should they create?
medium- A.A retention label to retain credit card data
- ✓ B.A DLP policy with a rule that detects credit card numbers and blocks sharing
- C.An audit policy to log credit card sharing
- D.A sensitivity label that marks credit card data
Why B: Microsoft Purview DLP policies are specifically designed to detect and automatically block the sharing of sensitive data, such as credit card numbers, across services like Exchange Online (email) and Microsoft Teams. By creating a DLP policy with a rule that includes a sensitive information type for credit card numbers and an action to block external sharing, the organization can enforce the required protection. Retention labels, audit policies, and sensitivity labels do not provide the real-time blocking capability needed for this scenario.
Variation 3. An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email outside the company. Which type of DLP rule action should they configure?
easy- ✓ A.Block
- B.Notify
- C.Audit only
- D.Encrypt
Why A: To prevent users from sharing credit card numbers via email outside the company, a DLP rule action of 'Block' is required. This action stops the email from being sent when sensitive content (e.g., credit card numbers) is detected, ensuring data exfiltration is prevented. The Block action can also be configured to show a policy tip to the user, but the core enforcement is the blocking of the message.
Variation 4. An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to ensure that when a user tries to share a document containing a credit card number externally via email, the user sees a policy tip and the email is blocked. Which DLP rule action should they configure?
medium- A.Notify user with policy tip only
- ✓ B.Block the message and notify the user with a policy tip
- C.Block the message only
- D.Redirect the message to the compliance admin
Why B: The requirement is to both block the email and show a policy tip to the user. In Microsoft Purview DLP, the 'Block the message and notify the user with a policy tip' action enforces the block at the transport level while simultaneously displaying a customizable policy tip in Outlook or Outlook on the web, informing the user why the message was blocked. This meets the dual need of prevention and user notification.
Variation 5. Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers in emails to external recipients. Which DLP rule action should you configure?
medium- A.Audit the activity only
- B.Allow the message but notify the user
- ✓ C.Block the message from being sent
- D.Allow the message with a policy tip
Why C: Microsoft Purview DLP allows you to configure rule actions that enforce protective measures. When you need to prevent users from sharing credit card numbers in emails to external recipients, the 'Block the message from being sent' action stops the email from being delivered, ensuring the sensitive data is not leaked. This action can be combined with a notification or override option, but the core enforcement is blocking the message.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.