MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
An organization is concerned about data leakage from sensitive emails. They want to enforce encryption on emails containing financial information automatically. Which Microsoft 365 solution should they configure?
⚠ Common exam trap
Test-takers frequently confuse Data Loss Prevention (DLP) policies with encryption capabilities, assuming DLP can automatically encrypt emails, when in fact DLP only detects and blocks or warns, while Message Encryption is the service that actually applies encryption to outbound emails.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Message Encryption
Microsoft Purview Message Encryption (Option B) is the correct solution because it enables organizations to send and receive encrypted email messages, and it can be configured with mail flow rules to automatically encrypt emails containing sensitive financial information. This service leverages Azure Rights Management (Azure RMS) to provide persistent protection that follows the email, ensuring only authorized recipients can decrypt and read the content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention (DLP) policies
Why it's wrong here
Data Loss Prevention (DLP) policies are not primarily encryption tools; they are designed to detect, monitor, and block the transmission of sensitive data via policy rules. While DLP can integrate with encryption—for example, by applying a Rights Management–based action to encrypt emails—the DLP engine itself does not perform encryption. Thus, DLP alone would not meet the requirement to encrypt sensitive emails; it can only trigger such protection as part of a broader policy.
- ✓
Microsoft Purview Message Encryption
Why this is correct
Microsoft Purview Message Encryption is the correct answer. It is a dedicated email encryption capability built on Azure Rights Management, allowing organizations to send and receive encrypted messages across domains. You can configure mail flow rules (transport rules) to automatically encrypt messages based on conditions such as the presence of sensitive content, specified users, or message classifications. This directly achieves the goal of encrypting sensitive emails, both in transit and at rest, and provides a secure access experience for recipients.
- ✗
Microsoft Purview Information Protection (Microsoft Purview Information Protection)
Why it's wrong here
Microsoft Purview Information Protection (MIP) is centered on classifying and labeling documents and emails using sensitivity labels, which can include user-defined or automatic labeling. Although labels can be configured to apply encryption as an action, MIP is fundamentally a classification and governance framework, not a purpose-built email encryption solution. The encryption triggered by MIP policies is a separate action that requires additional configuration, whereas Microsoft Purview Message Encryption provides encryption directly through mail flow rules, making it the more precise answer for email encryption.
- ✗
Exchange Online Protection (EOP)
Why it's wrong here
Exchange Online Protection (EOP) is a cloud-based email filtering service that offers anti-malware, anti-spam, and some basic policy enforcement, but it does not include any native email encryption capability. EOP's role is to protect the email infrastructure from threats and to filter email traffic, not to apply encryption to messages. Therefore, relying on EOP alone would leave sensitive emails unencrypted, and it cannot fulfill the requirement to encrypt them.
Go deeper
Related to this question
About these practice questions
One of 794 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.