MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A company needs to enforce that all documents marked as 'Confidential' are encrypted and cannot be printed. Which combination of Microsoft Purview features should they use?
⚠ Common exam trap
MS-900 often tests the confusion between DLP (detection/blocking) and sensitivity labels (persistent protection) — candidates pick DLP thinking it encrypts, but only labels apply encryption and rights management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels with encryption and rights management
Sensitivity labels in Microsoft Purview can apply encryption and rights management (Azure Rights Management) directly to documents, and label policies can enforce protection settings such as 'do not print' and 'do not copy.' When a user labels a document 'Confidential,' the label can automatically encrypt it and restrict actions like printing, fulfilling both requirements in a single control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Entra ID Conditional Access and Intune app protection
Why it's wrong here
Conditional Access governs sign-in and Intune app protection governs app-level data handling, but neither reads a document's 'Confidential' label to apply encryption or block printing. They suit controlling access to apps and sessions, not label-driven file protection.
- ✓
Sensitivity labels with encryption and rights management
Why this is correct
Sensitivity labels apply persistent encryption through Azure Rights Management, and the label's protection settings can block printing while restricting copying or forwarding. This directly satisfies the stem's dual requirement: Confidential documents stay encrypted at rest and in transit, and print permissions are denied for all users regardless of device or location.
- ✗
Data Loss Prevention (DLP) policies and retention labels
Why it's wrong here
DLP policies detect and block sharing of sensitive content, and retention labels govern lifecycle, not encryption or print blocking. Sensitivity labels with encryption and usage rights are required. DLP and retention labels would be correct for preventing oversharing or meeting retention obligations.
- ✗
eDiscovery (Premium) and Audit (Premium)
Why it's wrong here
eDiscovery (Premium) and Audit (Premium) support legal investigation, content search and activity logging; they do not apply encryption or printing restrictions to labelled documents. They would be the right choice for litigation holds or forensic review, not enforcement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During requirements gathering, an IT manager says the organization must classify files as Confidential and apply encryption to the most sensitive content. Microsoft security, identity, or compliance capability should it use?
medium- A.Microsoft Stream
- B.Microsoft Planner
- ✓ C.Sensitivity labels
- D.Microsoft Forms
Why C: Sensitivity labels in Microsoft Purview Information Protection allow organizations to classify files as Confidential and apply encryption automatically or manually. This capability meets the requirement to protect the most sensitive content by enforcing access controls and encryption policies based on the label.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.