MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Data Loss Prevention (DLP)

  Why this is correct

  Data Loss Prevention (DLP) uses Microsoft Purview's content analyzers and sensitive information types, such as credit card numbers or Social Security numbers, to scan documents in real time when a user attempts to share them through SharePoint, OneDrive, or Teams. When a match occurs, the DLP policy can block the sharing action, restrict access, or show a policy tip to the user. Because DLP inspects the actual file content and is integrated into the sharing workflow, it is the only solution that proactively detects and stops sensitive data from leaving the organization.

• ✗

  Sensitivity labels

  Why it's wrong here

  Sensitivity labels classify and protect documents by applying encryption, permissions, and visual markings based on the organization's classification scheme. While a label can be assigned automatically using pattern detection for a limited set of sensitive info types, that automatic detection runs during document iteration or labeling, not at the moment a sharing action occurs. Labels themselves never block a share; they simply define protection that must be interpreted by other apps, and misconfigured labels can still allow an accidental external share.

• ✗

  Retention policies

  Why it's wrong here

  Retention policies govern a document's lifecycle by ensuring content is kept for a specified period or deleted when it expires. These policies evaluate the file's age, location, and metadata, but they never inspect file content for sensitive data nor do they respond to a user's sharing attempt. Since retention processing happens on a scheduled basis, not in real time, it cannot detect or prevent a document from being shared at the moment of the action.

• ✗

  eDiscovery

  Why it's wrong here

  Microsoft Purview eDiscovery is a search, hold, and export tool used by legal teams to find content relevant to litigation or compliance investigations. It runs queries across mailboxes, sites, and teams after content has been created and stored, and its purpose is to locate, preserve, and export evidence, not to intercept actions in real time. Because it is a forensic search engine, eDiscovery has no capacity to evaluate a user's current sharing attempt and block it.