The answer is to configure sensitivity labels to apply encryption to 'Highly Confidential' data and use Microsoft Purview DLP to prevent Copilot from using that content. This works because encryption applied via sensitivity labels renders the data unreadable to Copilot’s processing engine, while a Data Loss Prevention policy explicitly blocks Copilot from generating responses based on that encrypted content. On the MS-102 exam, this scenario tests your understanding of how Microsoft Purview Information Protection layers work together—specifically that sensitivity labels alone do not block Copilot; you must pair encryption with a DLP rule targeting the Copilot workload. A common trap is assuming that simply labeling data as 'Highly Confidential' is enough, but without encryption, Copilot can still access the metadata or content. Remember the memory tip: “Label locks, DLP blocks”—the sensitivity label encrypts the data, and the DLP policy blocks Copilot from using it.
MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
This MS-102 practice question tests your understanding of deploy and manage a microsoft 365 tenant. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your organization is planning to deploy Microsoft 365 Copilot for all users. The compliance team has concerns about data leakage through Copilot responses. Specifically, they want to ensure that Copilot does not generate responses based on highly confidential data labeled with the 'Highly Confidential' sensitivity label. Additionally, users must be able to use Copilot for general productivity tasks. You need to configure Microsoft 365 Copilot to meet these requirements. The solution must use Microsoft Purview Information Protection. What should you do?
Remove the 'Highly Confidential' label from data that needs to be accessed by Copilot.
Why wrong: This would expose sensitive data to Copilot, increasing risk.
B
Configure sensitivity labels to apply encryption to 'Highly Confidential' data and use Microsoft Purview DLP to prevent Copilot from using that content.
Encryption and DLP policies can restrict Copilot from accessing protected content.
C
Block Copilot for all users who have access to 'Highly Confidential' data.
Why wrong: This would prevent those users from using Copilot even for non-sensitive tasks.
D
Create a conditional access policy to require multi-factor authentication for Copilot access.
Why wrong: MFA does not address data leakage through Copilot responses.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure sensitivity labels to apply encryption to 'Highly Confidential' data and use Microsoft Purview DLP to prevent Copilot from using that content.
Option B is correct because it uses Microsoft Purview Information Protection to apply encryption via sensitivity labels to 'Highly Confidential' data, and then leverages Microsoft Purview Data Loss Prevention (DLP) policies to block Copilot from accessing or generating responses based on that encrypted content. This ensures that Copilot cannot use the protected data as a source for its responses, while still allowing users to use Copilot for general productivity tasks with non-protected data.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Remove the 'Highly Confidential' label from data that needs to be accessed by Copilot.
Why it's wrong here
This would expose sensitive data to Copilot, increasing risk.
✓
Configure sensitivity labels to apply encryption to 'Highly Confidential' data and use Microsoft Purview DLP to prevent Copilot from using that content.
Why this is correct
Encryption and DLP policies can restrict Copilot from accessing protected content.
Related concept
Read the scenario before looking for a memorised answer.
✗
Block Copilot for all users who have access to 'Highly Confidential' data.
Why it's wrong here
This would prevent those users from using Copilot even for non-sensitive tasks.
✗
Create a conditional access policy to require multi-factor authentication for Copilot access.
Why it's wrong here
MFA does not address data leakage through Copilot responses.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse blocking user access (Option C) with blocking data usage, or they think removing a label (Option A) is a valid compliance control, when in fact the correct approach is to use DLP policies to enforce restrictions on how Copilot can use labeled data.
Detailed technical explanation
How to think about this question
Under the hood, Microsoft Purview DLP can inspect Copilot interactions by evaluating sensitivity labels and encryption status of source content. When a DLP policy is configured to block Copilot from using content with the 'Highly Confidential' label, it prevents the Copilot service from indexing or retrieving that content for response generation, even if the user has permission to access the data. This is achieved through Microsoft 365's unified labeling and DLP integration, which applies at the data plane level, not just the user plane.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this MS-102 question in full detail.
Deploy and manage a Microsoft 365 tenant — This question tests Deploy and manage a Microsoft 365 tenant — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Configure sensitivity labels to apply encryption to 'Highly Confidential' data and use Microsoft Purview DLP to prevent Copilot from using that content. — Option B is correct because it uses Microsoft Purview Information Protection to apply encryption via sensitivity labels to 'Highly Confidential' data, and then leverages Microsoft Purview Data Loss Prevention (DLP) policies to block Copilot from accessing or generating responses based on that encrypted content. This ensures that Copilot cannot use the protected data as a source for its responses, while still allowing users to use Copilot for general productivity tasks with non-protected data.
What should I do if I get this MS-102 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization plans to use Microsoft 365 Copilot. To ensure compliance, you need to prevent Copilot from accessing sensitive content in SharePoint Online document libraries that are labeled as 'Highly Confidential'. What should you configure?
medium
A.Configure a retention policy to prevent Copilot from accessing older content.
B.Create a conditional access policy to block Copilot from accessing SharePoint.
C.Create a DLP policy to block Copilot from processing 'Highly Confidential' content.
✓ D.Configure a sensitivity label with encryption and apply it to the documents.
Why D: Option D is correct because sensitivity labels with encryption can restrict access to documents based on their classification. When a document is labeled 'Highly Confidential' and encrypted, Microsoft 365 Copilot cannot process it because Copilot respects the encryption applied by the label, effectively preventing it from accessing the sensitive content. This is the only configuration that directly controls Copilot's ability to read the content at the file level.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.