SC-900 - Microsoft Compliance Solutions - Section 4.3

Describe information protection, data lifecycle management, and data governance in Microsoft Purview.

Describe how data classification and sensitivity labels in Microsoft Purview identify and protect sensitive content, and explain how data loss prevention policies prevent unauthorised sharing of that content. Distinguish records management from retention policies, recognising that records management handles regulatory obligations while retention policies govern the broader lifecycle of content.

data classificationsensitivity labelsdata loss preventionrecords managementretention policies

Practice question for this objective

Free sampleMicrosoft Compliance Solutionsmedium

An administrator wants protection that classifies an item and then keeps controls such as encryption attached to the file even after it leaves the organisation, while separately blocking risky sharing actions in real time. Which TWO Microsoft Purview capabilities together deliver this, one for each requirement? Select TWO.

  • ASensitivity labels, which classify content and embed protection that travels with the file Correct
  • BRetention policies, which decide how long content is kept or when it is deleted
  • CRecords management, which declares items as records and disposes of them on a schedule
  • DData loss prevention, which detects and blocks inappropriate sharing of sensitive items Correct
  • EAudit, which records the user and admin activity for later review
Sensitivity labels embed persistent protection that travels with a file, while data loss prevention detects and blocks inappropriate sharing of sensitive content. The two requirements map to two distinct tools: labels carry encryption with the file, and DLP enforces real-time controls on sharing. Retention and records management handle lifecycle, and audit only records events, so none of those satisfy either stated need.

Why A is correct: Sensitivity labels classify and apply persistent protection such as encryption that stays with the file wherever it goes.

Why B is wrong: Retention governs lifecycle duration, not classification or real-time sharing control, so it answers neither requirement.

Why C is wrong: Records management handles regulatory record declaration and disposal, not portable encryption or sharing blocks.

Why D is correct: DLP policies inspect content and can block or warn on risky sharing in real time across Microsoft 365 locations.

Why E is wrong: Audit logs activity after the fact; it neither protects files nor prevents the sharing action from happening.

See more SC-900 practice questions, answers explained.

More in this domain

Back to all Microsoft Compliance Solutions objectives, or the SC-900 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.