MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A healthcare organization needs to automatically apply a sensitivity label to any document stored in a SharePoint document library that contains patient diagnosis codes. The label should prevent the document from being shared externally. The classification must happen after the document is saved, not during creation. Which Microsoft Purview solution should be configured?
⚠ Common exam trap
Many candidates confuse auto-labeling (which applies labels after save) with manual or default labeling (which applies during creation), or mistaking DLP policies for labeling solutions when DLP only detects and blocks sharing without applying persistent labels.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Auto-labeling with sensitivity labels in Microsoft Purview
Auto-labeling with sensitivity labels in Microsoft Purview is correct because it automatically applies a sensitivity label to documents containing sensitive content (like patient diagnosis codes) after they are saved to SharePoint. This label can enforce protection actions such as preventing external sharing, meeting the requirement for post-save classification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Auto-labeling with sensitivity labels in Microsoft Purview
Why this is correct
Auto-labeling in Microsoft Purview is the correct choice because it evaluates content in SharePoint and OneDrive against sensitive info types or trainable classifiers, then automatically applies a sensitivity label that triggers protection such as encryption or restricting external sharing. This is a classification-first approach, which directly satisfies the requirement to 'automatically apply' a sensitivity label without manual user intervention.
- ✗
Microsoft Purview Data Loss Prevention (DLP) policies
Why it's wrong here
DLP policies in Microsoft Purview monitor and block risky sharing of sensitive data using rules and actions like 'Block' or 'Warn', but they do not assign sensitivity labels to documents. DLP complements sensitivity labels by enforcing protection at the sharing layer, but it is not the mechanism that applies classification metadata, so it cannot meet the stated need.
- ✗
Microsoft Purview retention labels
Why it's wrong here
Retention labels in Microsoft Purview are designed for lifecycle governance, controlling how long content is kept and whether it is deleted or retained after a period. They do not convey security classifications or apply protection settings like encryption and external sharing limits, which are the core functions of sensitivity labels—therefore they are not a substitute here.
- ✗
Microsoft Purview Information Barriers
Why it's wrong here
Information Barriers in Microsoft Purview restrict communication and collaboration between defined user groups by preventing chat, meeting, or sharing between them. They operate at the people-to-people collaboration layer and never inspect, classify, or label content, so they have no ability to automatically apply a sensitivity label to documents.
Go deeper
Related to this question
About these practice questions
This MS-900 question is part of Courseiva's 794-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.