MS-900 Describe Microsoft 365 apps and services Practice Question
A company wants to ensure that sensitive documents in Microsoft SharePoint Online are automatically classified and protected when they contain credit card numbers. Which Microsoft 365 service should they use?
⚠ Common exam trap
Many candidates confuse Compliance Manager (a compliance posture dashboard) with the actual data classification and protection service, or assume Insider Risk Management handles content classification when it is actually focused on user behavior analytics.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection
Microsoft Purview Information Protection (D) enables organizations to automatically classify and protect sensitive documents based on data classification rules. By configuring a sensitive information type for credit card numbers, SharePoint Online can apply sensitivity labels or retention labels to documents containing that pattern, ensuring they are encrypted or restricted as defined by policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Compliance Manager
Why it's wrong here
Microsoft Purview Compliance Manager is a governance tool that calculates a compliance score by assessing your tenant against regulatory standards and tracking improvement actions, but it does not inspect or label content. It relies on other Purview solutions to identify where sensitive data resides, so it cannot perform automatic classification of documents. Its purpose is to manage compliance posture, not to scan and classify files.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit captures and logs user and administrator activities across Microsoft 365 services, such as file access or configuration changes, allowing you to reconstruct a timeline of events. However, it is a post-event tracking mechanism that does not analyze file contents or apply sensitivity labels at the time of creation or modification. Therefore, it cannot automatically classify sensitive documents as they are saved.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management analyzes user activities with behavioral indicators—like repeated data downloads, unusual sharing, or security alert triggers—to identify potential malicious or accidental data leaks. It focuses on identifying risky actions by users, not on inspecting the intrinsic sensitivity of document content. This solution never assigns classification labels; it only surfaces patterns of activity that might warrant investigation.
- ✓
Microsoft Purview Information Protection
Why this is correct
Microsoft Purview Information Protection delivers automatic classification by using content inspection and pattern detection to identify sensitive data types, such as credit card numbers or national identity numbers, and then applies sensitivity labels automatically without manual intervention. These labels can encrypt, restrict access, or add visual markings, ensuring that sensitive documents are consistently protected across the tenant. This is the correct solution because it directly addresses the requirement to ensure that sensitive documents are automatically classified.
Go deeper
Related to this question
Learn chapter
Sensitivity Labels and Azure Information Protection
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.