MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance administrator needs to automatically protect sensitive data by applying a 'Confidential' label that encrypts documents and restricts access to a specific user group. The label must be applied when a document containing a credit card number is saved in SharePoint. Which Microsoft Purview feature should be configured?
⚠ Common exam trap
Many candidates confuse DLP policies with auto-labeling, but DLP policies only block or alert on data sharing, not apply labels or encryption, which is the core requirement for protecting data at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels with auto-labeling
Sensitivity labels with auto-labeling are the correct choice because they allow you to automatically apply a 'Confidential' label that encrypts documents and restricts access based on sensitive content (e.g., credit card numbers) when documents are saved in SharePoint. This feature uses conditions like sensitive information types to trigger label application, ensuring data protection at rest and in use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Retention labels
Why it's wrong here
Retention labels manage data retention and deletion, not automatic encryption or access restrictions based on sensitive content. They can be applied manually or via retention policies, but they do not inspect content for sensitive types like credit card numbers to trigger protection. Auto-labeling for retention can classify data, but it does not enforce encryption or access controls; it merely marks content for disposal or preservation.
- ✓
Sensitivity labels with auto-labeling
Why this is correct
Sensitivity labels with auto-labeling can be configured with policies that automatically detect sensitive data, such as credit card numbers, in SharePoint documents and apply encryption and access controls. These labels are integrated with Microsoft Purview Information Protection, so once applied, the document is encrypted at rest and permissions are enforced wherever the file is used. This makes it the correct answer, because it both classifies and actively protects content without manual intervention.
- ✗
Data Loss Prevention (DLP) policies
Why it's wrong here
Data Loss Prevention (DLP) policies prevent accidental sharing of sensitive data by blocking or restricting external access, and they can show policy tips or trigger alerts. However, DLP does not apply labels or encryption to documents automatically; it only controls how data is used or transmitted while leaving the file unaltered. DLP is a reactive control against data exfiltration, not a protection mechanism that persists with the document.
- ✗
Data classification service
Why it's wrong here
The data classification service in Microsoft 365 identifies and labels sensitive data for visibility and reporting, often using sensitive information types and trainable classifiers. It provides a dashboard of where sensitive data resides but does not automatically apply protection labels or encryption to the documents it discovers. Its purpose is auditing and discovery, not end-to-end remediation of content security.
Go deeper
Related to this question
Learn chapter
External Sharing in SharePoint and OneDrive
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.