Microsoft SC-900 Dumps - Pass Microsoft Security, Compliance, and Identity Fundamentals Exam in First Attempt 2026

In Microsoft Purview, Sensitivity labels are the feature designed to let users identify and classify content that should be protected. Microsoft's guidance explains that sensitivity labels ''enable you to classify and protect your organization's data while ensuring that user productivity and collaboration aren't hindered.'' Users can manually choose a label in Office apps and services to indicate the data's sensitivity; as Microsoft notes, labels ''can be applied by users or automatically,'' and the label ''persists with the content in its metadata.'' Once identified with a label, protection settings can be enforced, including ''encryption, content marking (headers, footers, watermarks), and access restrictions based on the label.''

By comparison, Data Loss Prevention (DLP) focuses on ''monitoring and blocking the unintentional sharing of sensitive information'' based on policy---DLP enforces handling rules after data is identified, rather than providing the user-centric classification mechanism. Insider Risk addresses ''risky user activities and insider data security scenarios,'' and eDiscovery is used to ''find, preserve, collect, and review content for investigations or litigation.'' Therefore, the feature that explicitly allows users to identify content that should be protected---by selecting and applying a classification that then drives protection---is Sensitivity labels.

In Microsoft guidance, network segmentation and isolation are core security principles. Azure virtual networks (VNets) are ''a fundamental building block... that enable isolation and segmentation of resources,'' and multiple VNets are commonly used to separate environments, business units, or security boundaries. This aligns with Zero Trust and SCI guidance that recommends isolating workloads to reduce blast radius and to apply least privilege and policy-based controls per boundary. Microsoft also emphasizes governance alignment, stating that enterprises should structure Azure resources so that policies, RBAC, and compliance requirements can be applied at appropriate scopes (management group, subscription, resource group, or network boundary). Deploying multiple VNets supports these goals by enabling per-environment policy assignment (for example, dev/test vs. production), differentiated security controls (such as NSGs, ASGs, and firewalls), and independent address spaces to prevent overlap across organizations or regions. Options A and D are not primary drivers: budgeting is handled at subscription/resource group scopes rather than VNet count, and a single VNet can already host and connect many resource types; creating multiple VNets is therefore primarily about governance and isolation that reduce risk and enforce organizational policies.

Microsoft defines Microsoft Entra ID Governance as the capability to manage ''the identity lifecycle, access lifecycle, and privileged access'' so organizations can ensure ''the right people have the right access to the right resources at the right time.'' The product family explicitly lists the following core features: ''Lifecycle workflows, Entitlement management, Access reviews, and Privileged Identity Management (PIM).'' Microsoft further explains that PIM helps you ''manage, control, and monitor access within your organization,'' enabling just-in-time elevation, approval workflows, MFA/justification on activation, and detailed auditing for privileged roles. By contrast, the other options are separate Microsoft Entra offerings outside ID Governance: Verifiable credentials (Microsoft Entra Verified ID) issues and validates digital credentials; Permissions Management (Microsoft Entra Permissions Management) provides CIEM for multi-cloud permissions; and Identity Protection offers risk-based detection and policies for sign-ins and users. Therefore, among the choices, the feature that is included in Microsoft Entra ID Governance is Privileged Identity Management (PIM), which is specifically called out by Microsoft as a pillar of ID Governance and is used to govern privileged access with policy-based controls, time-bound assignments, approvals, and comprehensive auditability.

To on-board Azure Sentinel, you first need to connect to your security sources. Azure Sentinel comes with a number of connectors for Microsoft solutions, including Microsoft 365 Defender solutions, and Microsoft 365 sources, including Office 365, Azure AD, Microsoft Defender for Identity, and Microsoft Cloud App Security, etc.

https://docs.microsoft.com/en-us/azure/sentinel/overview

In Microsoft 365, Data Loss Prevention (DLP) policies are designed to ''help you identify, monitor, and automatically protect sensitive information'' across services such as Exchange Online, SharePoint Online, OneDrive, and Microsoft Teams. Microsoft's guidance explains that DLP uses sensitive information types---including built-in classifiers like Credit Card Number---to detect when content matches a defined pattern and then enforce protective actions. With DLP, you can create rules that trigger when email messages contain customer lists with credit card numbers, and choose actions to block the message, restrict access, or notify and educate users via policy tips and incident reports. Microsoft further notes that DLP ''prevents the accidental sharing of sensitive information,'' can require user justification to override, and supports granular conditions (e.g., number of matches, recipients internal vs. external) to ensure that only risky transmissions are stopped. By applying a DLP policy to Exchange with the Credit Card Number sensitive info type, an organization can block or quarantine outbound mail that includes those numbers, thereby reducing regulatory and data-exposure risk. Other options listed---retention policies, conditional access, and information barriers---serve different purposes (data lifecycle, access/authentication conditions, and restricting communication between groups) and do not inspect message contents for sensitive data. Hence, DLP policies are the correct control to restrict sending emails that contain customer lists and associated credit card numbers.