How Many Sensitive Info Types Are Needed for SharePoint Watermarks?

Implement and manage data classification Implement and manage sensitivity labels in Microsoft Purview Implement and manage retention

Answer Correct answer: B — Two sensitive info types suffice: one custom SIT for Project1/Project2 and one built-in credit card SIT; Site1/Site2 watermarks are location-based.

You have a Microsoft 365 subscription that contains two Microsoft SharePoint Online sites named Site1 and Site2. You plan to use policies to meet the following requirements: • Add a watermark of Confidential to a document if the document contains the words Project1 or Project2. • Retain a document for seven years if the document contains credit card information. • Add a watermark of Internal Use Only to all the documents stored on Site2. • Add a watermark of Confidential to all the documents stored on Site1. You need to recommend the minimum number of sensitive info types required. How many sensitive info types should you recommend?

1
2 Correct Answer
3
4

Community Insight

The question tests whether you can separate content-condition SITs from location-based label application; the trap is counting each watermark requirement as a separate SIT.

This SC-401 scenario asks for the minimum number of sensitive info types needed for SharePoint watermarking and credit-card retention. The answer is two: one custom SIT for Project1/Project2 and one built-in credit card SIT, while Site1 and Site2 watermarks are applied by location-based label policies.

A common mistake is choosing four SITs—one per requirement—or choosing one SIT by overlooking that the built-in credit card SIT is needed separately from the custom Project keyword SIT.

Community Discussion (7 comments)

kollyp2000 👍 1 Selected: B

I’m treating B. 2 as the answer. Taking the four requirements one at a time Requirement Needs a SIT? Which Watermark if the document contains “Project1” or “Project2” Yes One custom SIT with a keyword list containing both words. The primary element “can be a Regular expression..., a Keyword list, a Keyword dictionary, or one of the preconfigured Functions.” Retain seven years if it contains credit card info Yes The built-in Credit card number SIT, which uses Func_credit_card plus the Luhn check Watermark “Internal Use Only” on everything in Site2 No A location-based rule, not a content match. Use a default sensitivity label on the Site2 document library Watermark “Confidential” on everything in Site1 No Same approach, a default label on the Site1 library

7525c5f 👍 1 Selected: A

One SIT is need and two sensitivity labels which will have different watermarks. Retention Labels for credit cards don't have watermarks.

Ender3 👍 1 Selected: B

Two SITs are needed. Here is why: 1. Create one SIT to identify project 1 and project 2 content. This is used in an auto-labeling policy to apply a sensitivity label for the "Confidential" watermarking. 2. Use a credit card SIT in an auto-labeling policy to apply a 7-year retention label. 3. Apply a sensitivity label to all content stored on Site2 for the "Internal" watermarking. No SIT needed. 4. Apply a sensitivity label to all content stored on Site1 for the "Confidential" watermarking. No SIT needed.

Nurob 👍 3 Selected: B

I only see 2 SITs needed: ONE for documents that contains specific words Project1 or Project2, and ONE for Credit Cards, the reset is location based so I don't see the point of a 3rd SIT

Suranka 👍 11 Selected: B

To meet the requirements described in the image, let's break down the scenarios: Watermark "Confidential" if document contains "Project1" or "Project2" This requires 1 custom sensitive info type to detect either "Project1" or "Project2". Retain document for 7 years if it contains credit card information This uses 1 built-in sensitive info type (e.g., Credit Card Number). Watermark "Internal Use Only" for all documents on Site2 This is location-based, not content-based, so no sensitive info type needed. Watermark "Confidential" for all documents on Site1 Also location-based, so no sensitive info type needed.

choukou 👍 2 Selected: U

1 seul

Rtstrider 👍 5 Selected: B

Project 1 and Project 2 can be added to a single custom Sensitive Info type. The second Sensitive info type would be Credit Card information I would think. For this reason I'm voting B (2) Sensitive Info Types

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Two SITs are the minimum because only two requirements depend on content inspection. The Project1/Project2 condition can be met with a single custom sensitive info type whose keyword list or regex includes both terms, and one SIT can match either word. The credit-card requirement uses the built-in credit card SIT, which is a separate SIT from the custom project SIT. The Site1 and Site2 watermark requirements are location-based: a sensitivity label with a watermark can be applied to a site or library without a SIT condition, so they add zero SITs. Therefore B (2) is correct.

Why the Other Options Are Wrong

A (1) fails because the Project keyword condition and the credit-card retention condition must be distinguishable; if one SIT matched either Project words or credit cards, the retention policy could not reliably target only credit-card documents. C (3) overcounts, usually by treating Project1 and Project2 as separate SITs or by turning one site watermark into a SIT requirement. D (4) overcounts every requirement as a SIT, but the two SharePoint site watermarks are location-based and need no SIT. The key distinction is that SITs define content conditions, while site-scoped sensitivity label policies define location.

Community Comment Notes

Suranka broke the scenarios down and concluded that a custom SIT covers Project1 or Project2 while a built-in SIT covers credit cards. Rtstrider similarly noted “Project 1 and Project 2 can be added to a single custom Sensitive Info type” and voted B. Nurob emphasized that only two SITs are needed and the rest is location-based. Ender3 gave the same three-part breakdown, including site-scoped labels for the Internal and Confidential watermarks. A minority view, such as choukou’s “1 seul” and 7525c5f’s one-SIT/two-label approach, overlooks that the credit-card retention condition still requires its own SIT, so B remains the stronger answer.

Official Reference

Exam Strategy

For SIT-count questions, separate content-based conditions from location-based label settings before counting. Each distinct content condition needs its own SIT, but applying a watermark to an entire site does not require a SIT.

Frequently Asked Questions

Why don’t the Site1 and Site2 watermarks require a sensitive info type?

They are location-based: a sensitivity label with a watermark can be applied to a site or library without inspecting content, so no SIT condition is needed.

Can Project1 and Project2 be detected by one custom sensitive info type?

Yes. A custom SIT can use a keyword list or regex that matches either Project1 or Project2, so both terms count as one SIT.

More SC-401 FAQ →

Related Analysis

← Back to SC-401 Study Guide