Describe the capabilities of Microsoft security solutions →mediumMultiple ChoiceObjective-mapped

Understanding Sensitivity Label Actions in Microsoft Purview

Exhibit

Refer to the exhibit.

{
  "LabelId": "12345678-1234-1234-1234-123456789012",
  "DisplayName": "Confidential",
  "Description": "Sensitive business data",
  "Actions": [
    {
      "Type": "encrypt",
      "EncryptionType": "AES256"
    },
    {
      "Type": "marking",
      "MarkingType": "watermark",
      "WatermarkText": "CONFIDENTIAL"
    },
    {
      "Type": "protection",
      "ProtectionType": "block",
      "BlockAction": "share"
    }
  ]
}

You are reviewing a Microsoft Purview sensitivity label configuration. Based on the exhibit, what will happen when this label is applied to a document?

Quick Answer

The correct answer is that the document will be encrypted with AES256, watermarked with 'CONFIDENTIAL', and sharing will be blocked. This is because the sensitivity label configuration includes three distinct actions: encryption using the AES256 algorithm, a visual watermark applied to the document, and a protection setting that blocks external sharing. On the SC-900 exam, this scenario tests your ability to interpret a sensitivity label’s action list rather than just its name or purpose—a common trap is confusing a label that only marks content with one that also enforces encryption and sharing restrictions. Remember that Microsoft Purview sensitivity labels can combine encryption, visual markings like watermarks, and access controls independently; the exhibit explicitly shows all three enabled. For a quick memory tip, think of the acronym EWB: Encryption, Watermark, Block sharing—if you see all three in the label’s actions, that is exactly what will happen when applied.

⚠ Common exam trap

Many exam-takers confuse the 'expiration' setting with the 'encryption' setting, or assume that a watermark alone implies no encryption, when in fact the label can combine multiple actions (encryption, watermark, and sharing restrictions) simultaneously.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The document will be encrypted with AES256, watermarked with 'CONFIDENTIAL', and sharing will be blocked.

The exhibit shows a Microsoft Purview sensitivity label configured with both encryption (AES256) and content marking (a 'CONFIDENTIAL' watermark), and the sharing permissions are explicitly set to 'Block sharing'. This combination of settings ensures that when the label is applied, the document is encrypted, watermarked, and sharing is prevented.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The document will be watermarked only.
Why it's wrong here
The label includes encryption and blocking in addition to watermarking.
✗
The document will be encrypted and will expire after a set period.
Why it's wrong here
No expiration action is defined in the label.
✓
The document will be encrypted with AES256, watermarked with 'CONFIDENTIAL', and sharing will be blocked.
Why this is correct
All three actions are specified in the label configuration.
✗
The document will display a warning before sharing.
Why it's wrong here
The label blocks sharing entirely, not just a warning.

Go deeper

2 more ways this is tested on SC-900

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Your organization wants to protect sensitive documents from being copied to unauthorized cloud services. Which Microsoft Purview capability should you use?

easy

A.Audit log
✓ B.Data Loss Prevention (DLP) policy
C.Retention policy
D.Sensitivity label

Why B: Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers or health records—when users attempt to copy or share it with unauthorized cloud services like personal OneDrive or third-party storage apps. By scanning content in transit and applying actions like blocking the action or encrypting the data, DLP directly addresses the requirement to prevent data exfiltration to unauthorized cloud destinations.

Variation 2. Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

medium

✓ A.Classify and label sensitive data
B.Block external sharing of files
C.Detect malware in email attachments
✓ D.Apply encryption based on sensitivity labels
E.Monitor user activities in real-time

Why A: Microsoft Purview Information Protection (MIP) enables organizations to classify and label sensitive data based on content inspection and policy rules. It also applies encryption and usage restrictions directly through sensitivity labels, ensuring data is protected regardless of where it is stored or shared.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.

Understanding Sensitivity Label Actions in Microsoft Purview

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question

2 more ways this is tested on SC-900