Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
Auto-Labeling with Sensitivity Labels for Automatic Encryption and Restriction
A compliance administrator needs to ensure that any document containing a patient's health information (e.g., medical record number) is automatically encrypted and restricted to authorized users. The encryption should be enforced regardless of where the document is saved (SharePoint, OneDrive, or email). Which Microsoft Purview feature should they configure?
Quick Answer
Auto-labeling policies with sensitivity labels solve this because the protection needs to be automatic and it needs to travel with the file regardless of where it lands. A sensitivity label, once applied, carries encryption and access restrictions embedded in the document itself rather than as a setting on the storage location — so a labelled file remains protected whether it sits in SharePoint, moves to OneDrive, or is attached to an email. Auto-labeling is what removes the human step: Purview scans content for patterns like a medical record number and applies the appropriate label without anyone having to classify the file manually, which matters for healthcare-style scenarios where relying on users to label every sensitive document consistently is not realistic. The exam distinction to hold onto is that DLP blocks or warns on an action, while sensitivity labels protect the content itself persistently — this scenario needs the latter.
⚠ Common exam trap
It's easy for candidates to confuse DLP policies with sensitivity labels, thinking DLP can enforce encryption, but DLP only monitors and blocks actions—it does not apply persistent protection like sensitivity labels do.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-labeling policies with sensitivity labels
Auto-labeling policies with sensitivity labels are the correct choice because they can automatically apply encryption and access restrictions to documents containing sensitive data like medical record numbers, regardless of where the document is saved (SharePoint, OneDrive, or email). Sensitivity labels support persistent protection that travels with the file, enforcing encryption and authorized user restrictions even when the file is moved or copied. This meets the requirement for automatic, location-independent encryption and access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Information Rights Management (IRM)
Why it's wrong here
IRM can protect documents by restricting actions, but it does not automatically classify or label content based on sensitive data detection.
- ✓
Auto-labeling policies with sensitivity labels
Why this is correct
Auto-labeling can automatically detect sensitive data (like health info) and apply a sensitivity label that enforces encryption and access restrictions.
- ✗
Data Loss Prevention (DLP) policies
Why it's wrong here
DLP detects and prevents sharing of sensitive data but does not automatically encrypt documents at rest.
- ✗
Retention labels
Why it's wrong here
Retention labels are used to keep or delete content for compliance and do not apply encryption or restrictions.
Go deeper
Related to this question
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on MS-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are the security administrator for Contoso, a global consulting firm with 10,000 employees. Contoso uses Microsoft 365 E5 and Microsoft Entra ID P2. The company has a strict policy that all sensitive client data must be encrypted at rest and in transit. Additionally, the legal team requires that any document labeled as 'Highly Confidential' must be automatically encrypted and cannot be printed or forwarded. You have created a sensitivity label called 'Highly Confidential' with encryption and a protection setting that restricts actions like printing. However, you notice that users are still able to print documents that have the label applied. After investigation, you find that the label is correctly configured but users are manually applying the label. What should you do to ensure the label is consistently applied and printing is blocked?
hard- A.Create a Data Loss Prevention (DLP) policy that blocks printing of documents with the 'Highly Confidential' label.
- B.Configure a Conditional Access policy that blocks printing for users accessing documents from unmanaged devices.
- C.Modify the sensitivity label's encryption settings to require user authentication before printing.
- ✓ D.Create an auto-labeling policy that automatically applies the 'Highly Confidential' label to documents that contain certain sensitive information types, and ensure the label's protection settings block printing.
Why D: Auto-labeling policies automatically apply the 'Highly Confidential' label to documents containing specified sensitive information types, ensuring consistent labeling. Once applied, the label's built-in protection settings block printing. Option A is incorrect because DLP policies can block printing but do not apply sensitivity labels. Option B is incorrect because Conditional Access controls access to resources, not document-level actions like printing. Option C is incorrect because the label already has encryption; the issue is manual application, not encryption settings.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.