Manage compliance by using Microsoft Purview →mediumMultiple Select

MS-102 Manage compliance by using Microsoft Purview Practice Question

A compliance officer needs to automatically classify documents in SharePoint Online that contain credit card numbers. The classification should apply a label that restricts access and adds a header. Which two Microsoft Purview features must be configured? (Choose two.)

⚠ Common exam trap

Many exam-takers confuse DLP policies with auto-labeling, but DLP policies do not apply labels or headers—they only enforce actions like blocking or notification, whereas auto-labeling policies are required to automatically assign the sensitivity label.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Sensitivity labels

Sensitivity labels are correct because they are the Microsoft Purview feature that applies classification markings (such as headers and footers) and encryption or access restrictions to documents. For this scenario, a sensitivity label must be configured to enforce the required header and access restrictions on content containing credit card numbers.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Sensitivity labels
Why this is correct
Sensitivity labels are the core classification mechanism in Microsoft Purview Information Protection. When applied, they embed metadata into the document and enforce protection settings such as encryption, rights management restrictions, and visual markings like headers, footers, or watermarks. The label persists with the content even when it leaves the organization, ensuring classification and protection follow the file. This directly satisfies the compliance officer's need to classify documents, especially when combined with auto-labeling for full automation.
✗
Retention labels
Why it's wrong here
Retention labels are designed for records management, not for content classification or access control. They govern how long content must be kept, when it should be permanently deleted, and whether disposition reviews are required, all based on regulatory or business rules. While they attach metadata to content, that metadata is focused on retention and deletion schedules, not on sensitivity or protection. Consequently, retention labels do not implement encryption, rights restrictions, or access policies, so they cannot fulfill the automatic classification requirement.
✗
Data Loss Prevention (DLP) policies
Why it's wrong here
DLP policies inspect content in motion and at rest to detect sensitive information types such as credit card numbers, bank account numbers, or national identifiers. When a match occurs, they can block sharing, warn users, or trigger incident reports, but they never write classification labels onto the content itself. DLP might even use sensitivity labels as a condition for its actions, yet the policy's role is enforcement and remediation, not classification. Therefore, a DLP policy alone cannot automatically classify documents; it only reacts to existing labels or detected sensitive data.
✓
Auto-labeling policies
Why this is correct
Auto-labeling policies automate the assignment of sensitivity labels by scanning content against conditions such as sensitive info types, keywords, or trainable classifiers. They can run in simulation mode to assess impact before enforcement, and they are able to label documents at rest in SharePoint/OneDrive as well as emails in transit in Exchange. This is the direct mechanism that lets a compliance officer automatically classify documents at scale without requiring manual user effort. Auto-labeling works hand-in-hand with sensitivity labels, making the classification process consistent and policy-driven.

Go deeper

MS-102 Manage compliance by using Microsoft Purview Practice Question

Why each option matters

Option-by-option breakdown

Related to this question