SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft Purview to classify documents containing health information. You need to ensure that only users with explicit permission can access these documents. Which Microsoft Purview capability should you use?
⚠ Common exam trap
Candidates often confuse Data Loss Prevention (DLP) with access control, but DLP only monitors and blocks data exfiltration, not who can view or edit documents after they are stored.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels with encryption
Sensitivity labels with encryption are the correct choice because they allow you to classify documents containing health information and apply encryption to restrict access to only users with explicit permissions. This ensures that even if the document is shared or moved, only authorized users can decrypt and read it, meeting the requirement for access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit logs
Why it's wrong here
Audit logs provide a detailed record of activities performed on data, such as who accessed a document, when, and from where. While essential for security monitoring, compliance, and forensic analysis, they are purely reactive. Audit logs do not proactively enforce access restrictions or prevent unauthorized users from opening or modifying classified documents; they merely document that an event occurred after the fact, without controlling the access itself.
- ✗
Retention policies
Why it's wrong here
Retention policies in Microsoft Purview are designed to manage the lifecycle of data by specifying how long content should be kept or deleted. Their primary function is to meet regulatory, legal, and business record-keeping requirements by ensuring data is preserved or disposed of appropriately. These policies do not implement access controls or encryption on documents; they only dictate the duration for which data is maintained, irrespective of who can access it.
- ✗
Data Loss Prevention
Why it's wrong here
Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information from being shared inappropriately, either internally or externally. DLP primarily focuses on preventing data exfiltration or unauthorized sharing based on content inspection and context. While DLP can block sharing actions, it does not apply persistent access controls or encryption directly to the document itself, meaning an unauthorized user with existing access could still open the file if it's not protected by other means.
- ✓
Sensitivity labels with encryption
Why this is correct
Sensitivity labels in Microsoft Purview allow organizations to classify and protect their sensitive data throughout its lifecycle, regardless of where it's stored or shared. When configured with encryption, these labels apply persistent, rights-management protection directly to the document content. This ensures that only authorized users, as defined by the label's policy, can open, view, or modify the document, even if it leaves the organization's controlled environment, thereby enforcing access controls.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.