Manage compliance by using Microsoft Purview →easyMultiple Choice

MS-102 Manage compliance by using Microsoft Purview Practice Question

You need to implement a solution that allows users to classify documents containing personal data as 'Highly Confidential' and automatically encrypt them when shared via email. What should you configure?

⚠ Common exam trap

It's easy for candidates to confuse DLP policies with sensitivity labels, thinking that DLP's block action achieves the same result as classification and encryption, but DLP only prevents sharing without applying persistent protection or classification metadata.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A sensitivity label with auto-labeling and encryption.

A sensitivity label with auto-labeling and encryption is correct because sensitivity labels in Microsoft Purview Information Protection can be configured to automatically classify documents based on sensitive data types (e.g., personal data) and apply encryption to protect the content when shared via email. The auto-labeling feature uses conditions like pattern matching for personally identifiable information (PII) to assign the 'Highly Confidential' label, and the encryption action ensures the document is protected with Rights Management Services (RMS) policies, preventing unauthorized access even if the email is forwarded.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
A sensitivity label with auto-labeling and encryption.
Why this is correct
Sensitivity labels in Microsoft Purview can be configured to automatically apply encryption when content matches specified conditions, such as credit card numbers or confidential keywords. This auto-labeling can occur at rest or during document creation, and the encryption enforces permissions that protect data both inside and outside the organization. Because the requirement is to classify and encrypt, this is the only option that directly fulfills both actions.
✗
A retention label with a disposition action.
Why it's wrong here
Retention labels are designed solely for data lifecycle management, allowing you to define how long content is retained and what disposition action to take upon expiry, such as deletion or review. They do not possess any capability to apply encryption, access restrictions, or content protection. While a disposition action handles the eventual removal of data, it cannot classify or encrypt content, so it fails to meet the stated requirement.
✗
An information barrier policy.
Why it's wrong here
Information barrier policies in Microsoft Purview restrict communication and collaboration between defined user segments, preventing certain users from contacting others via chat, email, or teams. They operate as access-control mechanisms based on defined segments and policies, but they do not apply encryption or any form of content protection. Because they neither classify data nor encrypt files, they cannot satisfy the solution requirement.
✗
A DLP policy with an action to block sharing.
Why it's wrong here
A DLP policy with an action to block sharing detects sensitive information and prevents users from sharing it externally, for example by blocking a share in Microsoft 365 or blocking sending an email. This action controls the flow of data but does not modify the underlying file to encrypt it or apply permissions. Blocking sharing is a behavioral restriction, not a metadata or encryption change, so it falls short of the need to implement encryption.

Go deeper

MS-102 Manage compliance by using Microsoft Purview Practice Question

Why each option matters

Option-by-option breakdown

Related to this question