MS-900 Sensitivity labels classify and protect data. Practice Question
A compliance administrator needs to apply encryption and usage restrictions to confidential documents. Which Microsoft 365 capability is the best fit? The design must avoid adding custom operational scripts.
⚠ Common exam trap
A common mix-up: candidates confuse the OneDrive sync client with a security tool, mistakenly thinking it can enforce encryption or restrictions, when in fact it only synchronizes files without applying any protection policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels
Sensitivity labels are the correct choice because they allow the compliance administrator to apply encryption and usage restrictions (such as 'Do Not Forward' or 'View Only') directly to confidential documents without writing any custom scripts. This capability is built into Microsoft 365 and integrates with Azure Information Protection to enforce protection policies at the file level, meeting the requirement for a no-code solution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
OneDrive sync client
Why it's wrong here
The OneDrive sync client synchronizes files between a local device and SharePoint/OneDrive for both data transport and local access, but it does not independently apply encryption keys or usage restrictions to that content. While files stored in OneDrive are encrypted at rest and in transit by the underlying service, this is generic service-level encryption, not a label-driven protection mechanism. The sync client cannot enforce view-only permissions, prevent copying, or restrict forwarding based on a classification label.
- ✓
Sensitivity labels
Why this is correct
Sensitivity labels, defined in the Microsoft Purview compliance portal, classify and protect content by embedding metadata and applying information rights management (RMS) encryption directly to files and email. Administrators can configure label settings to enforce usage restrictions such as read-only, prohibit printing, block forwarding, and even custom user-assigned permissions, which then persist and travel with the content wherever it is shared. This gives the compliance administrator the necessary control to enforce both encryption and usage restrictions on sensitive data.
- ✗
Microsoft Bookings
Why it's wrong here
Microsoft Bookings is a scheduling and appointment-management application that allows customers to book time with staff, but it provides no content classification, RMS encryption, or usage-restriction capabilities. Although Bookings may hold customer data, it relies on the standard Exchange Online at-rest encryption and cannot apply per-file or per-message permissions, view-only restrictions, or do-not-forward settings. As a result, it is wholly unrelated to the compliance requirement of applying encryption and usage restrictions to documents and emails.
- ✗
Microsoft Teams live events
Why it's wrong here
Microsoft Teams live events delivers real-time audio and video to large audiences, relying on the Teams transport encryption and service-level protections rather than offering persistent classification-based controls. It does not allow a compliance administrator to assign sensitivity labels, set granular permissions such as view-only or prevent capture, or enforce usage restrictions on the event's artifacts or associated files. While an event may be recorded and stored, that recording would need to be protected with labels or DLP separately, so the live events feature itself is not a tool for this compliance requirement.
Go deeper
Related to this question
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.