SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your organization uses Microsoft Purview to classify sensitive data. You need to create a custom sensitive information type that detects employee IDs matching the pattern 'EMP-XXXXX' (where X is a digit). Which rule pack element must you define?
⚠ Common exam trap
The trap is picking 'keyword list' because the pattern contains a literal prefix ('EMP-'), but keyword lists cannot enforce the numeric structure — only regex can.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regular expression
A custom sensitive information type (SIT) in Microsoft Purview is built from one or more pattern-matching elements; to detect a structured pattern like 'EMP-XXXXX' where X is a digit, you must define a regular expression (regex) that matches the literal 'EMP-' followed by exactly five digits. Regex is the only rule-pack element that can express this positional, character-class pattern. Supporting elements like keyword lists or functions can raise confidence but cannot define the pattern itself.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Keyword list
Why it's wrong here
A keyword list matches literal dictionary terms such as 'confidential', not a structured EMP-XXXXX digit pattern, so it cannot detect employee IDs. It is tempting because keyword lists are a genuine rule pack element used for boosting confidence alongside other evidence, but they lack the positional digit matching a regular expression provides.
- ✓
Regular expression
Why this is correct
Employee IDs follow the fixed pattern EMP- followed by five digits, so a regular expression defines that structure precisely. Rule pack elements such as keywords or dictionaries cannot match positional digit patterns; the regex element supplies the pattern-matching logic Microsoft Purview requires for this custom sensitive information type.
- ✗
Data store reference
Why it's wrong here
A data store reference points a sensitive information type at an existing repository (such as SharePoint or Exchange) rather than defining detection logic, so it cannot match the EMP-XXXXX pattern. It is tempting because rule packs do reference data stores when scoping where classification applies, but the required element here is a regular expression defining the ID format.
- ✗
Function
Why it's wrong here
A function is a supporting predicate (such as a checksum or date validator) that confirms a match already found by a primary element; it cannot itself locate the EMP-XXXXX pattern. It is tempting because functions appear in rule packs for validating identifiers, but detection of the format requires a regular expression.
Go deeper
Related to this question
Learn chapter
Microsoft Purview Compliance Portal
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.