SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft Purview to manage data governance. You need to ensure that sensitive financial data containing credit card numbers is automatically detected and labeled when stored in SharePoint Online. Which compliance solution should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse Data Lifecycle Management (retention/deletion) with Information Protection (classification/labeling), or assume eDiscovery can automatically label content, when in fact eDiscovery is purely for search and export in legal contexts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Information Protection auto-labeling
Microsoft Purview Information Protection auto-labeling is the correct solution because it can automatically detect sensitive data types, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply sensitivity labels to documents in SharePoint Online. This ensures that financial data is classified and protected at rest without manual intervention, aligning with the requirement for automatic detection and labeling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Information Protection auto-labeling
Why this is correct
Information Protection auto-labeling within Microsoft Purview is designed to automatically detect and classify sensitive data across an organization's digital estate. By leveraging auto-labeling policies, administrators can configure the system to identify specific Sensitive Information Types (SITs) or trainable classifiers within content. Upon detection, the appropriate sensitivity label is applied, enabling consistent data protection and governance without manual intervention, directly addressing the need for automatic classification.
- ✗
eDiscovery (Premium)
Why it's wrong here
eDiscovery (Premium) is a specialized capability within Microsoft Purview focused on identifying, preserving, collecting, processing, reviewing, and analyzing electronically stored information (ESI) for legal or investigative purposes. Its primary function is to support litigation, regulatory requests, or internal investigations by managing data holds and facilitating the discovery process. It is a reactive tool for specific cases, not a proactive mechanism for automatic content classification or labeling.
- ✗
Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management (DLM) in Microsoft Purview governs the retention and deletion of data throughout its lifecycle, from creation to disposition. It utilizes retention labels and policies to ensure compliance with regulatory requirements by defining how long specific types of data must be kept or when it should be permanently deleted. While crucial for data governance, DLM focuses on the duration and fate of data, not on automatically identifying and applying sensitivity labels based on content.
- ✗
Audit (Premium)
Why it's wrong here
Audit (Premium) in Microsoft Purview provides comprehensive logging of user and administrator activities across Microsoft 365 services, offering crucial forensic evidence for security and compliance investigations. It records detailed events, such as file access, policy changes, and data exports, enabling organizations to understand 'who did what, when, and where.' However, its function is purely observational and record-keeping; it does not actively modify, classify, or apply labels to content.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.