SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft Purview for data governance. You need to ensure that when a user marks an email as 'Confidential' using a sensitivity label, the email is automatically encrypted and cannot be forwarded. What configuration is required?
⚠ Common exam trap
Candidates often confuse the role of DLP policies with sensitivity labels, assuming DLP can enforce encryption, when in fact encryption is a native capability of sensitivity labels using Azure RMS templates.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the sensitivity label with encryption and a rights management template that prohibits forwarding
Microsoft Purview sensitivity labels can be configured with encryption settings that use Azure Rights Management (Azure RMS) to enforce usage restrictions. By selecting the 'Do Not Forward' template, the email is automatically encrypted and the recipient cannot forward, copy, or print the message, meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the sensitivity label with encryption and a rights management template that prohibits forwarding
Why this is correct
Sensitivity labels are designed to classify and protect data directly at the point of creation or modification. By configuring a sensitivity label with encryption, it applies Azure Rights Management (Azure RMS) protection to the content. This protection can include specific usage rights, such as "Do Not Forward," which prevents recipients from forwarding, printing, or copying the protected email or document, ensuring the data remains within its intended scope. This method directly embeds the protection into the content, making it persistent wherever the data travels.
- ✗
Create a DLP policy that detects the 'Confidential' label and applies encryption
Why it's wrong here
While Data Loss Prevention (DLP) policies can detect sensitivity labels and enforce actions based on their presence, DLP itself does not directly apply encryption to content in the same way a sensitivity label does. DLP policies are primarily designed to identify sensitive information and prevent its unauthorized sharing or exfiltration by blocking, auditing, or notifying. The encryption capability is inherent to the sensitivity label's configuration, not an action that a DLP policy typically triggers as a primary protection mechanism for content already labeled.
- ✗
Use the Azure Information Protection unified labeling scanner
Why it's wrong here
The Azure Information Protection (AIP) unified labeling scanner is specifically engineered to discover, classify, and protect files residing on on-premises file shares, SharePoint Server, and network paths. Its function is to apply sensitivity labels to existing unstructured data within an organization's on-premises infrastructure. It is not designed to process or apply protection to emails within cloud services like Exchange Online, which are handled by native Exchange transport rules or client-side labeling.
- ✗
Apply a retention label that triggers encryption
Why it's wrong here
Retention labels are fundamentally designed for data governance, focusing on managing the lifecycle of information by defining how long content should be kept or deleted. Their primary function is to ensure compliance with regulatory requirements for data retention and disposal. Retention labels do not possess any inherent capability to apply encryption or enforce usage rights like "Do Not Forward"; these protection features are exclusively provided by sensitivity labels.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.