Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer needs to automatically classify documents stored in SharePoint Online that contain personally identifiable information (PII) such as social security numbers. The classification must apply a sensitivity label that encrypts the document and restricts access to only employees in the Legal department. The process should run without any user interaction. Which Microsoft Purview solution should be configured?
⚠ Common exam trap
Many candidates confuse DLP policies (which block sharing) with auto-labeling policies (which apply sensitivity labels and encryption), but DLP does not automatically encrypt or restrict access via sensitivity labels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection with auto-labeling
Microsoft Purview Information Protection with auto-labeling can automatically detect PII (e.g., social security numbers) in documents stored in SharePoint Online and apply a sensitivity label that encrypts the content and restricts access to the Legal department. This process runs without user interaction, meeting the compliance officer's requirement for automatic classification and protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management governs the retention and deletion of content by applying retention labels and disposal reviews, but these labels are not security or sensitivity labels. While retention auto-labeling can use sensitive info types, the resulting label only controls how long content is kept, not who can access it or whether it is encrypted. Because the compliance officer needs automatic classification that protects documents by applying sensitivity metadata and rights restrictions, Data Lifecycle Management is the wrong control and does not fulfill the classification requirement.
- ✗
Microsoft Purview Data Loss Prevention (DLP)
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) policies inspect content in real time and can detect sensitive data such as credit card numbers or personally identifiable information, triggering enforcement actions like blocking, allowing, or notifying users. However, DLP does not automatically affix sensitivity labels to documents, nor does it persist classification metadata or enforce long-lived encryption and access restrictions on the file itself. DLP is a reactive enforcement layer that complements sensitivity labels, but it is not the mechanism that automatically classifies and protects content at creation or storage.
- ✓
Microsoft Purview Information Protection with auto-labeling
Why this is correct
Microsoft Purview Information Protection with auto-labeling is the correct solution because it natively applies sensitivity labels to files and emails based on content matches such as sensitive info types, trainable classifiers, or manual conditions. When an auto-labeling policy applies a sensitivity label, that label can automatically enforce encryption via Azure Rights Management, add visual markings, and restrict access, and the classification persists with the document or email across platforms. This provides the compliance officer with true automatic classification and protection without requiring user intervention.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management is designed to detect, analyze, and investigate risky user behavior such as unauthorized exfiltration, data theft, or malicious insider activities based on user activity signals and analytics. It does not inspect document content to assign classification labels, and it does not alter files with protection settings or sensitivity metadata. Its purpose is alerting and case management for behavioral risk, not the automatic classification and protection of documents requested by the compliance officer.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Sensitivity label
A sensitivity label is a metadata tag applied to digital content that classifies the content's level of confidentiality and governs how it can be shared, protected, and accessed.
About these practice questions
Courseiva writes every MS-900 question from scratch — 217 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.