Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A security administrator needs to automatically restrict access to documents labeled as 'Highly Confidential' when accessed from devices that are not joined to the domain. The restriction should block editing and printing, and apply encryption. Which combination of Microsoft 365 solutions should the administrator use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft Purview Data Loss Prevention (DLP) with Information Protection, not realizing DLP only monitors and blocks data in transit (e.g., email) and cannot enforce encryption or usage restrictions on documents at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection + Microsoft Entra ID Conditional Access
Microsoft Purview Information Protection (MIP) allows you to create sensitivity labels that apply encryption, restrict editing, and block printing on documents. Microsoft Entra ID Conditional Access can then enforce that these labels are automatically applied based on device compliance (e.g., devices not joined to the domain). Together, they provide the automated, policy-driven restriction described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Information Protection + Microsoft Entra ID Conditional Access
Why this is correct
Sensitivity labels from Microsoft Purview Information Protection can be configured to encrypt documents and apply usage rights, while Microsoft Entra ID Conditional Access evaluates policy at sign-in and can require the device to be hybrid Azure AD joined and compliant before allowing access to labeled content. This combination creates a layered enforcement: the label protects the file wherever it travels, and Conditional Access blocks access from non-compliant devices to the cloud location hosting the document. Together they directly satisfy the requirement to automatically restrict access to highly confidential documents based on device state.
- ✗
Microsoft Purview Data Loss Prevention + Microsoft Entra ID Identity Protection
Why it's wrong here
Data Loss Prevention policies in Microsoft Purview are designed to detect and block inappropriate sharing of sensitive data via email or cloud apps, but they do not restrict a user's access to an already-labeled document based on device compliance. Microsoft Entra ID Identity Protection assesses sign-in risk signals like leaked credentials or anonymous IP addresses, not whether the endpoint is domain-joined or compliant. Neither component can enforce a device-state gate on opening a sensitivity-labeled file, which is the core access restriction needed.
- ✗
Microsoft Defender for Office 365 + Microsoft 365 Business Premium
Why it's wrong here
Microsoft Defender for Office 365 provides threat protection for email and SharePoint by filtering malicious links and attachments, but it has no mechanism for applying sensitivity labels or enforcing conditional access based on device health. Microsoft 365 Business Premium is a licensing bundle that includes many services, but mentioning it does not identify a specific control that automatically restricts access to labeled documents. The requirement is about information protection and device-based access control, not email threat filtering.
- ✗
Microsoft Purview Audit + Microsoft Entra ID Privileged Identity Management
Why it's wrong here
Microsoft Purview Audit captures historical event logs of user activity for forensic investigation, so it is a detective control rather than a preventive one for document access. Microsoft Entra ID Privileged Identity Management governs administrative roles with just-in-time activation and approval workflows, which is unrelated to how end users access sensitivity-labeled files. Neither feature can block a user from opening a highly confidential document on a non-compliant device.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Conditional access
Conditional access is a security framework that evaluates signals like user location, device health, and risk level to grant or block access to resources in real time.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 217 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.