SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' sensitivity label to any document that contains a Social Security number. What should you create?
⚠ Common exam trap
A common mix-up: candidates confuse auto-labeling policies with DLP policies, as both deal with sensitive data, but DLP policies enforce actions on data in motion or at rest without applying labels, while auto-labeling policies specifically apply sensitivity labels based on content detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An auto-labeling policy for sensitivity labels
An auto-labeling policy for sensitivity labels in Microsoft Purview can automatically apply a 'Confidential' sensitivity label to documents containing sensitive information types like Social Security numbers. This policy uses content scanning and pattern matching to detect the data and apply the label without user intervention, meeting the requirement for automatic classification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
An auto-labeling policy for sensitivity labels
Why this is correct
An auto-labeling policy within Microsoft Purview automatically applies sensitivity labels to content based on specific conditions, such as the detection of sensitive information types (SITs), keywords, or trainable classifiers. This method is ideal for large-scale data classification, ensuring consistent application of labels without manual intervention, thereby enabling automated protection and governance. It directly addresses the need to classify data programmatically and efficiently.
- ✗
A sensitivity label policy with manual labeling
Why it's wrong here
While sensitivity label policies define the available labels and their associated protections, a policy configured for manual labeling relies entirely on end-users to select and apply the correct label to their documents and emails. This approach is prone to human error, inconsistency, and non-compliance, making it an inefficient and unreliable method for an organization aiming for comprehensive and consistent data classification across its entire estate, especially when leveraging Purview's capabilities for scale.
- ✗
A Data Loss Prevention (DLP) policy
Why it's wrong here
A Data Loss Prevention (DLP) policy is designed to identify, monitor, and protect sensitive information across various locations by preventing its unauthorized sharing or transfer. While DLP policies can detect sensitive content using similar mechanisms as auto-labeling, their primary function is to enforce protective actions like blocking, auditing, or notifying, rather than applying sensitivity labels for data classification. DLP acts *after* data is classified or detected as sensitive, focusing on preventing loss, not on the initial classification itself.
- ✗
A retention policy
Why it's wrong here
A retention policy in Microsoft Purview is used to manage the lifecycle of data by specifying how long content should be kept or deleted. Its purpose is to meet regulatory, legal, and business record-keeping requirements, ensuring data is retained for the necessary period and then disposed of appropriately. While retention labels can be applied to content, the policy itself governs retention and deletion, not the initial classification of data based on its sensitivity or content type. It's about lifecycle management, not content-based classification.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Sensitivity label
A sensitivity label is a metadata tag applied to digital content that classifies the content's level of confidentiality and governs how it can be shared, protected, and accessed.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.