MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
Your company is planning to adopt Microsoft Copilot for Microsoft 365. The security team is concerned about data leakage. What must you implement to ensure that Copilot respects your organization's sensitivity labels and data classification?
⚠ Common exam trap
Many exam-takers confuse DLP policies (which monitor and block data in transit or at rest) with sensitivity labels (which define and enforce data classification at the content level), leading them to choose DLP as the solution for controlling Copilot's behavior.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Microsoft Purview Information Protection with sensitivity labels
Microsoft Purview Information Protection with sensitivity labels is the correct answer because Copilot for Microsoft 365 uses these labels to enforce data governance at the content level. When a sensitivity label is applied to a document or email, Copilot respects that label's encryption, marking, and access restrictions, preventing the model from generating responses that leak classified data. This is the foundational mechanism for ensuring Copilot adheres to your organization's data classification policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Microsoft Defender for Cloud Apps to control Copilot
Why it's wrong here
Microsoft Defender for Cloud Apps (MCAS) is designed to discover and control third-party cloud applications through app connectors and conditional access policies, but Copilot is an integrated Microsoft 365 service that does not surface as a discrete cloud app for those controls. MCAS visibility and session policies cannot inspect or modify how Copilot interprets sensitivity labels on source content, so it cannot prevent Copilot from incorporating labeled data into its responses. Its role is broader cloud shadow IT governance, not AI-specific label enforcement.
- ✗
Configure Data Loss Prevention (DLP) policies
Why it's wrong here
Data Loss Prevention (DLP) policies in Microsoft Purview scan content in email, endpoints, and cloud apps for sensitive data types and apply corrective actions like blocking or quarantining. DLP, however, is a post-processing content filter that looks at human-readable data patterns, not a mechanism that teaches Copilot about sensitivity labels present in underlying documents or email threads. Copilot does not trigger DLP policies at generation time the way an outbound email would, so DLP alone cannot stop Copilot from summarizing or quoting a labeled file if the user has access.
- ✓
Deploy Microsoft Purview Information Protection with sensitivity labels
Why this is correct
Deploying Microsoft Purview Information Protection with sensitivity labels is correct because Copilot respects these labels as the core data classification signal across files, emails, SharePoint sites, and Teams messages. When a label is applied, Copilot inherits the label's encryption and permission settings, and it either restricts content from being used in a prompt or adds the appropriate label/visual markings to its generated output. This gives organizations a direct way to ensure Copilot does not leak sensitive or confidential information, fulfilling the label-aware protection requirement.
- ✗
Enable Customer Lockbox
Why it's wrong here
Customer Lockbox is a feature that gives customers explicit approval control when Microsoft support engineers need to access tenant data during a support incident. It is entirely unrelated to how Copilot processes prompts or surfaces data, because Lockbox governs internal Microsoft administrative access, not the data flow between Copilot and your tenant's workloads. Enabling Lockbox thus has no effect on Copilot's labeling behavior, output generation, or data leakage prevention capabilities.
Go deeper
Related to this question
Learn chapter
Exchange Mobile Device Policies (OWA)
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.