nerdexam
Microsoft

MS-900 · Question #110

You deploy Enterprise Mobility + Security E5 and assign Microsoft 365 licenses to all employees. Employees must not be able to share documents or forward emails that contain sensitive information…

The correct answer is A. Use Microsoft Azure Information Protection to define a label. Associate the label with an Azure. Azure Information Protection (AIP) labels with associated Rights Management policies can enforce restrictions on sharing and forwarding documents containing sensitive information outside the organization.

Submitted by eva_at· Mar 5, 2026Describe security, compliance, privacy, and trust in Microsoft 365

Question

You deploy Enterprise Mobility + Security E5 and assign Microsoft 365 licenses to all employees. Employees must not be able to share documents or forward emails that contain sensitive information outside the company. You need to enforce the file sharing restrictions. What should you do?

Options

  • AUse Microsoft Azure Information Protection to define a label. Associate the label with an Azure
  • BCreate a Microsoft SharePoint Online content type named Sensitivity. Apply the content type to
  • CUse Microsoft Azure Information Rights Protection to define a label. Associate the label with an
  • DCreate a label named Sensitive. Apply a Data Layer Protection policy that notifies users when

How the community answered

(52 responses)
  • A
    85% (44)
  • B
    4% (2)
  • C
    2% (1)
  • D
    10% (5)

Why each option

Azure Information Protection (AIP) labels with associated Rights Management policies can enforce restrictions on sharing and forwarding documents containing sensitive information outside the organization.

AUse Microsoft Azure Information Protection to define a label. Associate the label with an AzureCorrect

Microsoft Azure Information Protection allows you to define sensitivity labels and associate them with Azure Rights Management (RMS) protection templates. These templates can enforce restrictions such as preventing forwarding of emails and blocking external sharing of documents, ensuring sensitive content stays within the organization. With EMS E5 licensing, AIP provides the full classification, labeling, and protection capabilities needed.

BCreate a Microsoft SharePoint Online content type named Sensitivity. Apply the content type to

Creating a SharePoint Online content type named Sensitivity only provides metadata classification within SharePoint and does not enforce restrictions on email forwarding or document sharing outside the company.

CUse Microsoft Azure Information Rights Protection to define a label. Associate the label with an

"Microsoft Azure Information Rights Protection" is not the correct product name; the correct service is Azure Information Protection (AIP) with Azure Rights Management, making this answer incorrect due to the inaccurate terminology and likely incorrect association described.

DCreate a label named Sensitive. Apply a Data Layer Protection policy that notifies users when

A Data Layer Protection (DLP) policy that only notifies users does not enforce file sharing restrictions - it merely alerts users, which does not meet the requirement to prevent sharing and forwarding of sensitive information.

Concept tested: Azure Information Protection labels and Rights Management enforcement

Source: https://learn.microsoft.com/en-us/azure/information-protection/what-is-information-protection

Topics

#Azure Information Protection#data loss prevention#document sharing restrictions#email forwarding

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full MS-900 Practice