MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
During requirements gathering, an IT manager says the organization must classify files as Confidential and apply encryption to the most sensitive content. Microsoft security, identity, or compliance capability should it use?
⚠ Common exam trap
Test-takers frequently confuse Microsoft's collaboration tools (Stream, Planner, Forms) with security/compliance features, overlooking that sensitivity labels are the dedicated mechanism for classification and encryption in Microsoft 365.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Sensitivity labels
Sensitivity labels in Microsoft Purview Information Protection allow organizations to classify files as Confidential and apply encryption automatically or manually. This capability meets the requirement to protect the most sensitive content by enforcing access controls and encryption policies based on the label.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Stream
Why it's wrong here
Microsoft Stream is an enterprise video hosting and sharing service in Microsoft 365, used to upload, manage, and play back recorded meetings and videos. It organizes content with channels and permissions, but it does not understand document classification or apply sensitivity labels, encryption, or usage restrictions to non-video content. That makes it incapable of meeting a sensitivity-based data protection requirement.
- ✗
Microsoft Planner
Why it's wrong here
Microsoft Planner is a lightweight task and project management application that breaks work into plans, buckets, and tasks to track ownership and deadlines. It does not analyze or protect the underlying content of files or emails, so it cannot apply encryption, rights management, or classification markings. Its role in M365 is to coordinate work, not to enforce compliance or sensitivity controls.
- ✓
Sensitivity labels
Why this is correct
Sensitivity labels in Microsoft Purview are the correct choice because they let administrators define classification tiers and associate them with protections such as Azure Rights Management encryption, visual headers/footers/watermarks, and conditional access restrictions. Once applied, the label persists as metadata as the item travels, allowing Microsoft 365 apps and DLP policies to enforce the same protections everywhere. This directly satisfies the requirement to control access based on the sensitivity of content.
- ✗
Microsoft Forms
Why it's wrong here
Microsoft Forms is a survey, quiz, and polling tool for gathering structured input from internal or external audiences into an Excel spreadsheet. Even though a form has sharing settings and can be restricted to a tenant, Forms does not classify documents or emails, nor does it apply encryption, rights, or label-based controls to content. It thus cannot fulfill a sensitivity-labeling or data-protection requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.