Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer needs to ensure that any document containing passport numbers automatically gets a 'Highly Confidential' label and is encrypted when saved in SharePoint. The labeling should occur without any user interaction. Which Microsoft Purview feature should they configure?
⚠ Common exam trap
Test-takers frequently confuse retention labels (which manage lifecycle) with sensitivity labels (which enforce protection like encryption), leading them to choose Option C, or they mistakenly think trainable classifiers (Option D) can directly apply labels without an auto-labeling policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-labeling policy for sensitivity labels
Auto-labeling policies in Microsoft Purview can automatically apply a sensitivity label (e.g., 'Highly Confidential') to documents containing passport numbers when saved in SharePoint, without any user interaction. This is achieved by configuring a policy that uses sensitive info types (e.g., 'Passport Number') to detect the data and then automatically apply the label and encryption. The labeling occurs at rest, triggered by document upload or modification, meeting the compliance officer's requirement for zero user intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Auto-labeling policy for sensitivity labels
Why this is correct
Auto-labeling policies for sensitivity labels are purpose-built to evaluate content against sensitive information types—such as passport numbers, credit card numbers, or other regex-based classifiers—and automatically apply the appropriate sensitivity label without any user intervention. In Microsoft 365, these policies can be run in simulation mode first to validate accuracy, then switched to enforced mode to consistently label and optionally encrypt content. This directly satisfies the compliance officer's requirement because labeling and protection are applied programmatically at rest or in motion, rather than depending on human action.
- ✗
Manual labeling using the Office apps
Why it's wrong here
Manual labeling using the Office apps requires each user to actively choose a sensitivity label from the Sensitivity button in Word, Excel, PowerPoint, or Outlook, and then confirm the selection. Because this process is discretionary, sensitive documents can be left unlabeled if a user forgets, skips, or deliberately ignores the prompt, creating gaps in compliance coverage. Even a well-intentioned user might select an incorrect or insufficient label, so manual labeling cannot provide the deterministic, automatic classification that the compliance officer asks for.
- ✗
Retention labels with DLP policy
Why it's wrong here
Retention labels are designed to manage content lifecycle—specifically how long content is kept and when it can be deleted—while DLP policies detect sensitive data and restrict actions like copying, forwarding, or sending externally. Neither capability has the native ability to assign a sensitivity label to a document, and combining them does not create that classification step. Thus, a retention label with a DLP policy might quarantine or block a document containing a passport number, but it will not automatically classify the document with a sensitivity label, failing the stated requirement.
- ✗
Trainable classifiers
Why it's wrong here
Trainable classifiers use machine learning to recognize content by pattern and semantic context, such as identifying a document as a resume, a contract, or a legal brief. However, a trainable classifier only outputs a classification result; it cannot apply a sensitivity label itself. To achieve automatic labeling, the classifier must be referenced as a condition inside an auto-labeling policy, which then performs label assignment. Deploying trainable classifiers alone therefore leaves the actual labeling step undone, so they are insufficient for this compliance scenario.
Go deeper
Related to this question
Learn chapter
Cloud Service Types for MS-900
Key term
Sensitivity label
A sensitivity label is a metadata tag applied to digital content that classifies the content's level of confidentiality and governs how it can be shared, protected, and accessed.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.