Question 767 of 217
Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
An organization wants to prevent employees from sharing sensitive files with external users via SharePoint Online, but they need to allow sharing with a specific external partner for a single project. What is the most efficient configuration?
⚠ Common exam trap
A common mix-up: candidates confuse DLP policies or sensitivity labels as the primary method to control sharing, when in fact SharePoint sharing settings at the tenant and site level are the direct and most efficient configuration for this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable external sharing at the tenant level and enable it only for the specific project site
It allows the organization to disable external sharing globally at the tenant level via the SharePoint admin center, which prevents all users from sharing with external users by default. Then, by enabling external sharing only for the specific project site (site-level override), the organization can grant the necessary access to the external partner while maintaining the broad restriction. This is the most efficient approach because it uses a single configuration change at the tenant level and a targeted exception at the site level, avoiding complex policies or labels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Disable external sharing at the tenant level and enable it only for the specific project site
Why this is correct
Disabling external sharing at the tenant level in the SharePoint admin center (under Policies > Sharing) establishes a baseline that blocks all external sharing by default. Enabling it only for the specific project site via site-level sharing settings grants a granular exception, so the partner can access that site while all other sites remain locked down. This layered configuration directly enforces the requirement, as tenant settings are inherited unless explicitly overridden for the chosen site collection.
- ✗
Change the default sharing link type to 'Specific people' and add the partner's domain to an allow list
Why it's wrong here
Changing the default sharing link type to 'Specific people' only alters the default behavior of the share dialog; users can still select other link types such as 'Anyone with the link' or 'People in your organization' when sharing. Adding the partner's domain to an allow list in the SharePoint admin center does not restrict external sharing; it merely permits that domain, while external sharing remains enabled for all other domains unless explicitly blocked. This option fails to prohibit employees from sharing with external users because it neither disables external sharing nor prevents them from choosing different link types.
- ✗
Apply sensitivity labels with encryption to all files
Why it's wrong here
Applying sensitivity labels with encryption protects file content from unauthorized access, but it does not prevent employees from sharing the files externally. Users can still share encrypted files with external recipients, and if the file is unencrypted, the label provides no protection against external sharing. This approach relies on users consistently applying the correct label, whereas the requirement is to enforce a sharing restriction at the platform level, independent of user behavior and file classification.
- ✗
Configure a DLP policy to block external sharing except for the partner domain
Why it's wrong here
A DLP policy blocks sharing based on content inspection, not on the destination domain of the external user; it cannot selectively allow a specific partner domain while blocking all others in SharePoint Online. This option is tempting because DLP is often used to prevent data leaks, and in scenarios requiring content-based restrictions—such as blocking files containing credit card numbers—it would be the correct choice.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.