SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization wants to protect sensitive documents from being copied to unauthorized cloud services. Which Microsoft Purview capability should you use?
⚠ Common exam trap
A common mix-up: candidates confuse Sensitivity labels with DLP because both deal with data protection, but labels are for classification and persistent protection, whereas DLP is the active enforcement mechanism that monitors and blocks unauthorized data movement to cloud services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP) policy
Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers or health records—when users attempt to copy or share it with unauthorized cloud services like personal OneDrive or third-party storage apps. By scanning content in transit and applying actions like blocking the action or encrypting the data, DLP directly addresses the requirement to prevent data exfiltration to unauthorized cloud destinations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Audit log
Why it's wrong here
An audit log serves as a chronological record of activities and events within a system, detailing who performed what action, when, and from where. While indispensable for security investigations, compliance auditing, and identifying potential breaches post-occurrence, audit logs are purely reactive. They lack the inherent capability to actively intervene or block the unauthorized sharing of sensitive documents in real-time, making them unsuitable for proactive data loss prevention.
- ✓
Data Loss Prevention (DLP) policy
Why this is correct
A Data Loss Prevention (DLP) policy is purpose-built to identify, monitor, and protect sensitive information from being inappropriately shared, transferred, or used. These policies leverage predefined or custom rules to detect specific sensitive content, such as financial data or intellectual property, within documents across various locations and then enforce actions like blocking sharing, encrypting the data, or alerting administrators. DLP policies are highly effective in preventing unauthorized sharing of sensitive documents to external parties or unapproved cloud services, directly addressing the organization's protection requirement.
- ✗
Retention policy
Why it's wrong here
A retention policy is designed to manage the lifecycle of information by dictating how long specific types of data or documents must be preserved or, conversely, when they should be permanently deleted. Its primary function is to ensure compliance with legal, regulatory, and business requirements regarding data longevity and disposal. While crucial for information governance, a retention policy does not include mechanisms to prevent or block the unauthorized sharing of sensitive documents, as its scope is solely data lifecycle management, not real-time data movement control.
- ✗
Sensitivity label
Why it's wrong here
A sensitivity label is used to classify and categorize data based on its level of sensitivity, such as 'General' or 'Highly Confidential.' While labels can apply visual markings, encryption, or restrict access permissions, they primarily serve as a classification mechanism and a trigger for other protective policies. By themselves, sensitivity labels do not inherently block the sharing of documents; rather, they enable other services, like DLP, to identify and then enforce protection based on the label applied. The label itself is not the enforcement engine for blocking.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.