SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft Purview to manage compliance. You need to ensure that financial documents are automatically labeled as 'Financial' and retained for 7 years. Additionally, if a user tries to share a financial document externally, they must see a policy tip warning them and be blocked if they proceed. You also need to audit all access to financial documents. Which configuration should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an auto-labeling policy to apply a sensitivity label 'Financial' with encryption; create a retention policy to retain all labeled content for 7 years; create a DLP policy to block external sharing of 'Financial' labeled content with a policy tip; enable audit logging
It combines auto-labeling to automatically apply the 'Financial' sensitivity label with encryption, a retention policy to retain labeled content for 7 years, a DLP policy to block external sharing with a policy tip, and audit logging (enabled by default) to track access. Option A lacks labeling and retention. Option B uses manual labeling, which is not automatic, and the DLP only warns, not blocks. Option C uses a retention label instead of a sensitivity label, so it does not provide encryption or protection, and the DLP policy does not include a policy tip.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a DLP policy to detect financial data and block external sharing; use default audit logging
Why it's wrong here
DLP does not automatically label or retain content; no retention policy.
- ✗
Create a manual labeling policy for users to apply 'Financial' label; create a retention label for 7 years; create a DLP policy to warn on external sharing
Why it's wrong here
Manual labeling is not automatic; retention label is separate from sensitivity label, but the scenario requires automatic labeling.
- ✗
Create a retention label 'Financial' with auto-apply based on sensitive info type; create a DLP policy to block external sharing
Why it's wrong here
Retention label does not provide encryption; also sensitivity label is needed for encryption.
- ✓
Create an auto-labeling policy to apply a sensitivity label 'Financial' with encryption; create a retention policy to retain all labeled content for 7 years; create a DLP policy to block external sharing of 'Financial' labeled content with a policy tip; enable audit logging
Why this is correct
Auto-labeling applies label automatically; retention policy retains; DLP blocks sharing; audit logging tracks access.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.