Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataMedium
A multinational corporation is designing a new customer relationship management (CRM) application on Azure. The application will store customer contact details, purchase history, and communication logs. The security architect needs to implement a solution that classifies data based on its sensitivity and automatically applies protection, such as encryption and access restrictions, regardless of where the data is stored or shared within the Microsoft ecosystem. Which service should be used to achieve this data classification and protection?
- AAzure Policy
- BAzure Data Catalog
- CAzure Security Center
- DMicrosoft Information Protection (MIP) sensitivity labels
Show answer & explanationAnswer & explanation
Correct answer: D. Microsoft Information Protection (MIP) sensitivity labels
Microsoft Information Protection (MIP) sensitivity labels allow organizations to classify and protect sensitive data across Microsoft 365, Azure, and other services. Labels can automatically apply encryption, visual markings, and access restrictions, and persist with the data wherever it travels.
Why the other options are wrong
- A. Azure Policy enforces organizational standards and assesses compliance for Azure resources, not for classifying and protecting data content itself.
- B. Azure Data Catalog (now part of Microsoft Purview) is for data discovery and metadata management, not active data protection.
- C. Azure Security Center (now Defender for Cloud) provides cloud security posture management and threat protection, not data classification and persistent protection.
Microsoft Information Protection (MIP) Sensitivity Labels
A feature that allows organizations to classify and protect sensitive data by applying labels that can automatically enforce encryption, visual markings, and access restrictions, persisting with the data.
- Classifies data based on sensitivity.
- Applies persistent protection (encryption, access control).
- Protects data across Microsoft 365, Azure, and other services.
- Helps meet compliance requirements.
Memory trick: MIP labels data like a sticky note that also locks the content.