MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A healthcare organization is using Microsoft 365 and needs to ensure that patient data (protected health information) is not accidentally shared externally. They want to classify all documents containing medical terms and apply automatic encryption when shared outside the organization. Which two Microsoft Purview features should they combine? (Select TWO)
⚠ Common exam trap
MS-900 often tests the confusion between classification (sensitivity labels/auto-labeling) and enforcement (DLP) — candidates must recognize that both are needed to detect PHI and encrypt it on external sharing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels with auto-labeling based on trainable classifiers
Sensitivity labels with auto-labeling based on trainable classifiers can automatically detect and classify documents containing medical terminology (PHI) without manual tagging. DLP policies with encryption actions then enforce protection by automatically encrypting those labeled documents when they are shared externally. Together they provide detection (classification) and enforcement (encryption) for PHI.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Sensitivity labels with auto-labeling based on trainable classifiers
Why this is correct
Sensitivity labels with auto-labeling use trainable classifiers to detect medical terminology in documents, then apply encryption automatically. This satisfies the requirement to classify patient data and enforce protection when shared externally, since label-based encryption persists with the file and blocks unauthorised external access.
- ✓
Data Loss Prevention (DLP) policies with encryption action
Why this is correct
DLP policies detect sensitive information via sensitive information types and can enforce encryption when content leaves the tenant boundary. Combined with auto-labelling, the encryption action satisfies the requirement that documents containing medical terms be automatically encrypted upon external sharing, blocking accidental disclosure of patient data.
- ✗
Insider Risk Management policies
Why it's wrong here
Incorrect. Insider Risk Management is designed to detect and mitigate risky user behaviors from within the organization, such as data theft or intentional leakage, but it does not provide automatic classification or encryption of documents based on content.
- ✗
Communication Compliance policies
Why it's wrong here
Communication Compliance detects inappropriate or risky messages for review by investigators; it neither classifies documents by content nor encrypts them. It is the right control for regulatory conduct monitoring, but the scenario needs trainable classifiers plus sensitivity labels with encryption.
- ✗
Microsoft Entra ID Conditional Access policies
Why it's wrong here
Conditional Access governs sign-in and session access based on user, device and location signals; it cannot inspect document contents or apply persistent encryption to a file. It is correct for restricting access to services, whereas content-based classification and encryption require sensitivity labels and trainable classifiers.
Go deeper
Related to this question
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.