MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A legal firm needs to automatically encrypt and apply access restrictions to all documents that contain case numbers considered highly confidential. The protection must remain enforced even if the document is emailed to external parties or saved to a personal device. Which Microsoft Purview solution should be configured?
⚠ Common exam trap
It's easy for candidates to confuse Data Loss Prevention (DLP) with persistent protection, mistakenly thinking DLP can encrypt documents and enforce access controls after they leave the organization, when in fact DLP only monitors and blocks data in transit or at rest within the tenant, not after it is shared externally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity Labels with encryption
Sensitivity Labels with encryption are the correct solution because they allow the legal firm to classify documents containing confidential case numbers and enforce persistent protection (encryption and access restrictions) that travels with the document, even when emailed externally or saved to a personal device. This is achieved by applying Azure Rights Management (Azure RMS) encryption directly to the file, ensuring the protection is embedded in the document itself, not just at the network or service boundary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Data Loss Prevention (DLP) policies inspect content in real time to detect and block risky sharing of sensitive information, such as credit card numbers or personally identifiable information. However, DLP itself does not encrypt documents or apply persistent rights management; at best it can trigger a notification, block the transmission, or recommend applying a label, but the actual encryption must come from an associated sensitivity label. Thus DLP is a preventive control at the network or tenant edge, not a protection mechanism that follows the file.
- ✓
Sensitivity Labels with encryption
Why this is correct
Sensitivity labels with encryption use Azure Rights Management to automatically encrypt a document when a label is applied, and the encryption remains attached to the file wherever it travels, including outside the tenant. The label can be configured to require automatic classification based on content conditions, so the legal firm's files are encrypted without user intervention, and the same label enforces usage restrictions like read-only or no-copy. This persistent, automatic protection directly meets the requirement for securing legal documents.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit records user and administrator activities, such as when a document was accessed, modified, or shared, and provides an unalterable log for forensic analysis and regulatory compliance. It is a detective control that tells you what happened after the fact, but it does not alter the document itself, apply classification, or restrict access in any way. Therefore, while it complements a data protection strategy, it cannot automatically encrypt or protect files.
- ✗
Customer Lockbox
Why it's wrong here
Customer Lockbox controls Microsoft support engineers' access to a customer's data on rare troubleshooting occasions by requiring explicit approval from the tenant administrator. It is an access-control mechanism for Microsoft's own personnel, not a feature that classifies your documents, applies encryption, or enforces user-defined usage limits. Consequently, it addresses trust in the cloud provider, not the legal firm's need for automatic, persistent document encryption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.