MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer needs to automatically label and encrypt documents that contain personally identifiable information (PII) when they are saved in SharePoint. The labeling should happen without manual user intervention. Which Microsoft Purview feature should they configure?
⚠ Common exam trap
A common mix-up: candidates confuse auto-labeling with DLP policies, as both deal with sensitive data, but DLP focuses on preventing data loss during transit or sharing, not on automatic classification and encryption of stored documents.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels (auto-labeling policy)
Sensitivity labels with auto-labeling policies in Microsoft Purview can automatically detect and classify documents containing PII when they are saved in SharePoint, and apply encryption based on the label configuration. This meets the requirement of automatic, user-intervention-free labeling and encryption by scanning content for sensitive data types (e.g., Social Security numbers) and applying the label at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sensitivity labels (auto-labeling policy)
Why this is correct
Sensitivity labels, when used with auto-labeling policies, scan documents and emails for sensitive data patterns such as PII, credit card numbers, or passport IDs and automatically apply a pre-configured label. That label can carry encryption settings (e.g., end-user-defined permissions or 'Do Not Forward') and visual markings, thereby satisfying both automatic classification and encryption. This is the recommended solution for the compliance officer's stated requirement.
- ✗
Data Loss Prevention (DLP) policy
Why it's wrong here
Data Loss Prevention (DLP) policies monitor and control sharing of sensitive information, for example by blocking external sharing or prompting users when they send credit card data externally. While DLP can integrate with sensitivity labels and may trigger protective actions on already-labeled content, it does not itself apply sensitivity labels or encrypt documents at rest; it enforces rules after content is created and classified.
- ✗
Retention labels
Why it's wrong here
Retention labels are designed for information governance in Microsoft Purview, controlling how long content is kept and what happens at the end of the retention period (e.g., disposition review or deletion). They do not perform content classification for access control nor can they apply encryption via Azure RMS, so they meet neither the labeling nor the encryption requirement.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance is an insider risk management solution that monitors Microsoft Teams, Exchange email, and Yammer for policy violations such as offensive language, harassment, or sharing of sensitive information. It uses machine learning to generate alerts and perform investigations, but it does not automatically classify or encrypt documents at rest and is not designed for file-level content governance.
Go deeper
Related to this question
About these practice questions
This MS-900 question is part of Courseiva's 794-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.