MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Defender for Office 365

  Why it's wrong here

  Microsoft Defender for Office 365 is a threat protection platform that detects and blocks phishing, malware, and malicious URLs through capabilities like Safe Links, Safe Attachments, and anti-phishing policies. While it can inspect outbound email for threats, it does not provide native encryption; its purpose is to stop malicious content from entering or leaving the organization, not to secure the confidentiality of legitimate sensitive messages. Therefore, enabling Defender alone would not encrypt the financial emails as required.

• ✓

  Microsoft Purview Message Encryption

  Why this is correct

  Microsoft Purview Message Encryption, built on Azure Rights Management, encrypts outbound email content so that only authenticated recipients can decrypt it using a Microsoft account or a one-time passcode in a secure web portal. This capability can be fully automated via mail flow rules in Exchange Online, such as applying encryption when a DLP policy identifies sensitive financial data or when a message is sent to an external domain. The service ensures confidentiality for both data at rest and in transit, directly meeting the stated requirement.

• ✗

  Microsoft Purview Data Loss Prevention (DLP)

  Why it's wrong here

  Microsoft Purview Data Loss Prevention (DLP) is a policy-based engine that scans emails and other content for sensitive information types, such as credit card numbers, and can block, restrict, or notify based on those findings. While a DLP policy can trigger a mail flow rule that invokes Microsoft Purview Message Encryption, DLP itself does not encrypt messages; its 'encrypt' action simply delegates to the separate encryption infrastructure. Thus, without an explicit Message Encryption rule, enabling DLP alone would fail to produce an encrypted outbound email.

• ✗

  Microsoft Purview Insider Risk Management

  Why it's wrong here

  Microsoft Purview Insider Risk Management analyzes telemetry and user behavior, such as mass downloading, unauthorized sharing, or unusual mail forwarding, to generate risk scores and alerts that initiate a remediation workflow. This solution is designed for detection and case management, not for enforcing message-level security controls. Consequently, it cannot encrypt outgoing emails, and expecting it to do so would fall outside its intended scope.

Go deeper

Related to this question