MS-900 Describe Microsoft 365 apps and services Practice Question
Your company is deploying Microsoft 365 Copilot and wants to ensure that sensitive data in emails and documents is not inadvertently exposed via Copilot responses. Which Microsoft 365 capability should you implement?
⚠ Common exam trap
Test-takers frequently confuse Sensitivity Labels (which apply persistent protection) with DLP (which enforces real-time actions), leading them to choose A, even though labels alone cannot block Copilot from surfacing sensitive data in responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention
Microsoft Purview Data Loss Prevention (DLP) is the correct choice because it is specifically designed to identify, monitor, and automatically protect sensitive data (e.g., credit card numbers, PII, or custom patterns) across Microsoft 365 services, including emails and documents. When integrated with Microsoft 365 Copilot, DLP policies can prevent Copilot from including sensitive information in its responses by enforcing real-time content checks and blocking or warning users before exposure occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Sensitivity Labels
Why it's wrong here
Microsoft Purview Sensitivity Labels tag documents and emails with classification metadata (e.g., Confidential) and can apply encryption or visual markings, but they do not natively intercept or block data from appearing in Copilot responses. They serve as a precondition for downstream controls like DLP policies, which actually match sensitive content patterns and enforce actions. Labels alone cannot stop a Copilot prompt from echoing a labeled secret unless a DLP rule references that label as a condition.
- ✗
Microsoft Defender for Cloud Apps
Why it's wrong here
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on discovering shadow IT, controlling third-party app access, and setting session policies for SaaS apps. It evaluates app permissions and user behavior across cloud services, but it does not inspect or filter Copilot's generative responses for sensitive content. While it can integrate with DLP for data governance, its core role is not to prevent data leakage within an AI chat interface.
- ✗
Microsoft Purview Customer Lockbox
Why it's wrong here
Microsoft Purview Customer Lockbox is an access control tool that requires explicit approval before Microsoft support engineers can access customer content during a support incident. It addresses the risk of unauthorized Microsoft personnel viewing data, not the risk of Copilot generating responses that include sensitive information. Because it governs backend administrative access rather than data flow in user-facing AI features, it is irrelevant to blocking sensitive data from Copilot output.
- ✓
Microsoft Purview Data Loss Prevention
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) is the correct control because it can identify sensitive data types (e.g., credit card numbers, passport IDs) in Copilot interactions and apply enforcement actions like blocking the response or restricting sharing. DLP policies attach to specific data sources, including Microsoft 365 Copilot endpoints, and can evaluate prompts and responses against sensitive info types or trainable classifiers. This gives administrators a direct way to prevent Copilot from returning confidential content to unauthorized users.
Go deeper
Related to this question
Learn chapter
Microsoft 365 Governance Policies and Controls
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
This MS-900 question is part of Courseiva's 794-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.