MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A security administrator at Contoso wants to ensure that sensitive documents in SharePoint Online are automatically encrypted and access is restricted to specific users, even if the document is shared externally. Which Microsoft 365 feature should the administrator use?
⚠ Common exam trap
The trap here is assuming that SharePoint permissions alone provide encryption, when they only control access within SharePoint and do not persist externally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels in Microsoft Purview Information Protection
Sensitivity labels in Microsoft Purview Information Protection can automatically apply encryption and access restrictions to documents. When configured, labels can enforce encryption that travels with the document, ensuring that access is restricted even when shared externally. This directly addresses the requirement for automatic encryption and persistent access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SharePoint Online site-level permissions
Why it's wrong here
SharePoint Online site-level permissions control who can access the site and its contents, but they do not encrypt individual documents or enforce encryption when documents are shared externally. Once a document is downloaded or shared outside SharePoint, the permissions no longer apply, so this does not meet the requirement.
- ✗
Microsoft Defender for Cloud Apps file policies
Why it's wrong here
Microsoft Defender for Cloud Apps file policies can detect and govern sensitive files in cloud apps, but they do not automatically encrypt documents or enforce persistent access restrictions. They are focused on monitoring and controlling cloud app usage, not on embedding encryption and permissions within files.
- ✓
Sensitivity labels in Microsoft Purview Information Protection
Why this is correct
Sensitivity labels can automatically apply encryption and access restrictions to documents based on the label's configuration. When applied to SharePoint Online, labels can enforce encryption and permissions that persist even when the document is shared externally. This meets the requirement for automatic encryption and restricted access.
- ✗
Exchange Online transport rules
Why it's wrong here
Exchange Online transport rules are used to inspect and act on email messages, such as applying encryption to emails. They do not apply to documents stored in SharePoint Online, so they cannot automatically encrypt or restrict access to SharePoint documents.
Go deeper
Related to this question
Learn chapter
Microsoft Access and Power Apps Comparison
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.