Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer needs to automatically detect documents stored in SharePoint Online that contain sensitive data types (e.g., credit card numbers) and apply a sensitivity label that restricts access to only certain users. The classification should occur without user intervention and the label must be applied to the document. Which Microsoft Purview solution should be configured?
⚠ Common exam trap
Many exam-takers confuse DLP policies with auto-labeling, but DLP only detects and blocks sharing actions, whereas auto-labeling applies the sensitivity label and its associated protection directly to the document.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels with auto-labeling
Sensitivity labels with auto-labeling are the correct solution because they can automatically classify documents based on sensitive data types (such as credit card numbers) and apply a sensitivity label that enforces protection actions like restricting access to specific users. This occurs without user intervention, meeting the requirement for automatic classification and labeling in SharePoint Online.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) policies use sensitive information types to identify content such as credit card numbers or PII, then enforce protective actions like blocking sharing or sending an email notification. However, DLP is an enforcement engine that acts on content in transit or at rest; it does not persist classification metadata by assigning a sensitivity label, nor does it automatically apply encryption to the document itself. Since the compliance officer needs detection that results in a persistent, labeled classification, DLP alone falls short.
- ✓
Sensitivity labels with auto-labeling
Why this is correct
Sensitivity labels with auto-labeling meet this requirement because they combine detection and protection: an auto-labeling policy in Microsoft Purview can scan files in SharePoint or OneDrive for predefined sensitive information types or trainable classifiers. When a match occurs, the policy automatically assigns a sensitivity label configured with encryption, rights management permissions, and visual markings. This creates a persistent classification that travels with the document, exactly matching the officer's need to automatically detect and protect sensitive documents.
- ✗
Retention labels
Why it's wrong here
Retention labels are built to govern content lifecycle by specifying whether content must be kept for a set period or deleted when it expires, and they support records management events like disposition reviews. Although a retention label can be auto-applied based on keywords or sensitive info types, that mechanism is contextual rule matching, not a security classification: the label never encrypts the file or restricts who can access it. Thus while a retention label may be triggered by sensitive data, its purpose is retention, not detecting and protecting the document from unauthorized exposure.
- ✗
Information barriers
Why it's wrong here
Information barriers in Microsoft Purview are administrative policies that segment users into groups to prevent or limit communication and collaboration between them — for example, to isolate a trading team from investment banking. They are evaluated at the user relationship level (chat, email, sharing) and do not inspect or scan document content for sensitive data. Since the official's goal is automatic detection within documents, and information barriers neither classify nor protect individual files, they provide no mechanism for this scenario.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
Courseiva writes every MS-900 question from scratch — 217 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.