Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A company wants to ensure that sensitive documents classified as 'Confidential' are automatically encrypted and have restricted access permissions applied when they are shared via email. The protection must persist even if the email is forwarded to external parties. Which Microsoft Purview solution should be used?
⚠ Common exam trap
Many exam-takers confuse Microsoft Purview Message Encryption (which encrypts the email transport) with Information Protection (which applies persistent rights management to the content itself), leading them to choose C when the question explicitly requires protection that persists after forwarding.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection
Microsoft Purview Information Protection (A) is correct because it enables classification and labeling of documents (e.g., 'Confidential'), with built-in encryption and rights management that persists regardless of where the document is shared or forwarded. This is achieved through Azure Rights Management (Azure RMS), which enforces access restrictions even when the email is forwarded to external parties, ensuring the protection travels with the content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Information Protection
Why this is correct
Sensitivity labels in Microsoft Purview Information Protection can apply persistent encryption via Azure Rights Management so that documents carry their own usage restrictions (view, edit, print, forward) wherever they travel. Because the encryption and permissions are embedded in the document itself, the protection remains enforced when the file is sent to external users or copied to another tenant. This is exactly what you need for confidential documents that must stay controlled after they leave the organization.
- ✗
Microsoft Purview Data Loss Prevention (DLP)
Why it's wrong here
DLP policies use sensitive info types and conditions to detect content and then enforce actions such as blocking, warning, or allowing overrides, but those controls act on movement of the content and do not encrypt the document. Once a file is in transit or stored, DLP alone cannot revoke access rights or keep the document encrypted if the policy is no longer evaluated. DLP is a monitoring/remediation layer, not a persistent rights-management mechanism.
- ✗
Microsoft Purview Message Encryption
Why it's wrong here
Microsoft Purview Message Encryption wraps email messages in a secure transport and can require recipients to authenticate through a web portal or use Outlook to read them, but it does not alter the underlying attachment file's encryption or apply document-level usage rights. After the recipient decrypts and saves an attachment, the file is in the clear and can be shared, printed, or forwarded without any further enforcement. Its purpose is securing the communication channel, not protecting the document's lifecycle.
- ✗
Microsoft Purview Compliance Manager
Why it's wrong here
Compliance Manager helps you track and demonstrate compliance by generating a score based on controls, action items, and evidence from Microsoft and your own solutions, and it maps to regulatory requirements. It provides visibility and continuous monitoring of compliance posture but has no capability to encrypt content or define access permissions. Selecting it would be a governance/audit decision rather than a data-protection enforcement mechanism.
Go deeper
Related to this question
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.