SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization needs to create a policy that prevents users from sharing credit card numbers in emails. Which Microsoft Purview solution should you configure?
⚠ Common exam trap
Many exam-takers confuse Communication Compliance with DLP because both deal with content monitoring, but Communication Compliance focuses on policy violations in communications (e.g., harassment) rather than preventing the sharing of sensitive data like credit card numbers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data loss prevention (DLP) policy
Data loss prevention (DLP) policies in Microsoft Purview are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers—across Exchange Online, SharePoint, OneDrive, and Teams. By configuring a DLP policy with a credit card number sensitive info type, the organization can block users from sending emails containing those patterns, either by preventing the email from being sent or by triggering a policy tip. This directly addresses the requirement to prevent sharing of credit card numbers in emails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance is primarily designed to help organizations detect and remediate inappropriate communications, such as harassment, threats, or the sharing of sensitive information within conversational contexts. While it can identify sensitive data disclosure in messages, its core function is monitoring and investigation of user conduct and content in communications, not proactively preventing the use or sharing of specific data types across various data repositories or sharing channels as a policy enforcement mechanism.
- ✗
Retention policy
Why it's wrong here
A Retention policy is used to manage the lifecycle of data by defining how long specific content should be kept or deleted to meet regulatory, legal, or business requirements. Its purpose is data governance and lifecycle management, ensuring data is retained or disposed of appropriately. However, retention policies do not actively monitor content for sensitive information or prevent users from sharing or using that data in unauthorized ways in real-time.
- ✗
eDiscovery
Why it's wrong here
eDiscovery tools are utilized to identify, preserve, collect, review, and analyze electronically stored information (ESI) for legal cases or internal investigations. It is a reactive process, enabling organizations to find relevant data after an event has occurred or a legal hold is placed. eDiscovery does not provide proactive prevention capabilities to stop specific data types from being used or shared in the first instance; it's an investigative and data retrieval mechanism.
- ✓
Data loss prevention (DLP) policy
Why this is correct
A Data loss prevention (DLP) policy is specifically engineered to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and cloud apps. DLP policies achieve this by detecting content that matches predefined sensitive information types or custom conditions and then enforcing actions like blocking, auditing, or notifying users and administrators to prevent unauthorized sharing, transfer, or use of that data. This directly addresses the need to prevent the use of specific data types.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.