Sensitivity labels and DLP practice questions
Fifteen free Microsoft Purview practice questions with explained answers, written as short scenarios about sensitivity labels, label policies, auto-labeling and data loss prevention (DLP). A sensitivity label classifies and protects the item itself, while a DLP policy controls what users may do with sensitive items and where they may send them. The topic is tested in SC-401, SC-900 and AB-900, and parts of it appear in the Power BI and Fabric exams.
How to use these questions
Try each question before opening the explanation and commit to one letter. Underline the constraint word in the stem, such as “published”, “recommend”, “simulation”, “already applied” or “block”, because it usually points to the one layer that is failing: the label, its scope, the policy, the application method or the DLP rule. Read why each wrong option fails, since the same distractors return on real exams. The guide sensitivity labels explained holds the theory behind these fifteen.
Warm-up: labels, scopes and policies
Question 1. A company wants the protection of a contract document to travel with the file, so that only members of the legal group can open it even after it is emailed outside the company. Which feature provides this?
- A. A DLP policy for Exchange Online
- B. A sensitivity label with encryption
- C. A retention label with a seven-year period
- D. An Insider Risk Management policy
Show answer
Answer: B
A sensitivity label with encryption stores the protection in the file, so it restricts who can open it wherever the file goes. A DLP policy acts on activities in monitored locations and does not encrypt the file. A retention label controls how long content is kept, not who can open it. Insider Risk Management policies detect risky user behavior and do not protect files.
Question 2. A new label named Internal was published in a label policy to the Finance group. Users in the Sales group report that the label is not available in Word. What is the most direct fix?
- A. Move the label to the top of the label list
- B. Add the Internal label as a condition in a DLP rule
- C. Change the label scope to Emails only
- D. Add the Sales group to the label policy that publishes the label
Show answer
Answer: D
Labels are available only to the users and groups named in a label policy that includes them, so the Sales group must be added to a policy that publishes the label. Changing the label scope or its position in the list does not change who sees it. A DLP rule has no influence on which labels users can select.
Question 3. A legal team wants every contract to be marked Confidential and also to be kept for seven years. Which combination of labels can be applied to a single document?
- A. One sensitivity label and one retention label
- B. Two sensitivity labels
- C. One retention label, which also classifies the content
- D. One sensitivity label, which also sets the retention period
Show answer
Answer: A
An item can carry only one sensitivity label, but documents and emails can have a sensitivity label and a retention label at the same time, so one of each is valid. Two sensitivity labels cannot be applied to the same item. A retention label does not classify or protect, and a sensitivity label does not control how long content is kept.
Question 4. An administrator wants a sensitivity label that can be applied to Teams meetings. When creating the label, the Meetings scope cannot be selected on its own. What must also be selected?
- A. Groups and sites only
- B. Emails only
- C. Files and other data assets, and Emails
- D. Nothing, because Meetings is selected in the label policy
Show answer
Answer: C
The Meetings scope cannot be selected unless Files and other data assets and Emails are also selected. Groups and sites is a separate scope for containers and is not a prerequisite. Selecting only Emails still leaves the Meetings option unavailable. The label policy comes after the label is created and does not affect the scope choices.
Question 5. A label must set the privacy of a Microsoft 365 group to private and block external sharing of its SharePoint site. It must not appear in Word or Outlook. Which scope should the label have?
- A. Files and other data assets
- B. Groups and sites only
- C. Emails and Meetings
- D. Files and other data assets, and Groups and sites
Show answer
Answer: B
Selecting only the Groups and sites scope creates a label for containers, and a label with only that scope is not displayed in Office apps. Files and other data assets, Emails and Meetings all make the label selectable on items in Office apps, which is what the requirement excludes.
Scenarios: applying and enforcing
Question 6. A company wants to block users from sharing documents with external recipients when a document contains ten or more credit card numbers. Which solution fits?
- A. A DLP policy with a rule for the credit card number sensitive information type that blocks external sharing
- B. A sensitivity label that adds a watermark
- C. A retention policy for SharePoint sites
- D. A default label in the label policy
Show answer
Answer: A
A DLP policy with a rule that detects the credit card sensitive information type and blocks external sharing meets the requirement directly. A sensitivity label with a watermark marks the document but does not block sharing. A retention policy controls how long content is kept. A default label in a label policy classifies unlabeled items and does not inspect content or block anything.
Question 7. A compliance officer wants users to consciously choose a label whenever they open or save a document that has none, instead of having a label applied silently. Which label policy setting does this?
- A. A default label for documents
- B. An auto-labeling policy for SharePoint
- C. A DLP rule that blocks unlabeled files
- D. The policy setting that requires users to apply a label
Show answer
Answer: D
The setting Require users to apply a label to their email and documents, known as mandatory labeling, prompts users to choose a label for unlabeled items. A default label applies a label for the user without a choice. Auto-labeling policies apply labels in the service without prompting users. A DLP policy does not decide which label a user picks.
Question 8. A label policy requires users to provide a justification when they change a label to a lower sensitivity. What decides whether a change counts as lowering the label?
- A. The color of the label
- B. The date on which the label was created
- C. The position of the label in the label order
- D. The priority of the DLP policy
Show answer
Answer: C
The order of the labels in the list defines their priority, and a move to a label higher in the list than the current one is treated as a lower sensitivity. Label color is cosmetic, the creation date has no role, and DLP policy priority concerns the order in which DLP policies are evaluated, not labels.
Question 9. Thousands of files already sit in SharePoint. An administrator wants to label those that contain bank account numbers, preview the result before any label is applied, and not depend on which Office version users have. Which method fits?
- A. The auto-labeling setting on the label, applied in Office apps
- B. An auto-labeling policy run in simulation mode
- C. A default label for the document library
- D. A DLP policy in simulation mode
Show answer
Answer: B
An auto-labeling policy runs in the service on SharePoint and OneDrive content, does not depend on app versions and can be run in simulation mode before it is turned on. The label setting for auto-labeling in Office apps is client-side, depends on app versions and has no simulation mode. A default label does not inspect content. A DLP policy in simulation mode does not apply labels.
Question 10. Management wants Word to suggest the Confidential label when a user types a document that contains a customer number, while leaving the decision to the user. Which configuration fits?
- A. An auto-labeling policy for SharePoint and OneDrive
- B. A DLP policy with a policy tip
- C. A retention label for customer data
- D. The label setting for auto-labeling for files and emails, configured as recommend
Show answer
Answer: D
The auto-labeling setting on the label, used by Office apps, supports recommending a label, and the user decides whether to accept it. Auto-labeling policies in the service do not support recommended labeling because the user is not involved. A DLP policy tip can warn but does not offer a label. A retention label has nothing to do with classification.
Edge cases and traps
Question 11. A user manually applies the label General to a Word document. The Confidential label is configured for client-side automatic labeling, and the user then types content that matches its condition. What happens?
- A. The document keeps General
- B. Confidential silently replaces General
- C. Both labels are applied to the document
- D. Word shows an error and blocks saving
Show answer
Answer: A
Client-side auto-labeling does not override a manually applied sensitivity label, so the document keeps General. It can override a default label, which is why a label applied as a default would behave differently. The two labels cannot both be applied, because an item has a single sensitivity label. Nothing produces an error for the user.
Question 12. An administrator removes the Project X label from the only label policy that publishes it. Documents labeled Project X already exist. What happens to those documents?
- A. The label is removed from all documents
- B. The documents are decrypted
- C. The documents keep the label, but users can no longer select it for other content
- D. The documents revert to the default label
Show answer
Answer: C
Removing a label from a label policy only stops users from selecting it. Labels already applied stay on content, and the label name still shows. Nothing is decrypted or relabeled by this action. Deleting a label is different and has greater impact, such as removing encryption for files in SharePoint and OneDrive and users no longer seeing the label name.
Question 13. A file in SharePoint matches three rules of one DLP policy. Rule 1 at the highest priority only audits. Rule 2 blocks with a user override. Rule 3 blocks with no override. What is enforced?
- A. Only the audit action, because rule 1 has the highest priority
- B. The block with override, because it is the middle rule
- C. The actions of all three rules combined
- D. The block without override, while the other matches are logged
Show answer
Answer: D
For Exchange, SharePoint and OneDrive, rules are processed in priority order, and when content matches several rules the first rule evaluated with the most restrictive action is enforced, which here is the block without override in rule 3. All matches are still recorded in the audit log and reports. The highest priority rule does not win if it is less restrictive, and the actions of the rules are not combined.
Question 14. A new DLP policy blocks external email with sensitive data. The team wants to measure its impact on real activity without any action being enforced against users. Which policy state should be used first?
- A. Run the policy in simulation mode
- B. Turn it on right away
- C. Keep it off
- D. Turn it on with policy tips only for administrators
Show answer
Answer: A
Run the policy in simulation mode enforces no actions while auditing the events, so the impact can be reviewed before enforcement. Turn it on right away enforces the actions immediately. Keep it off leaves the policy inactive, so it produces no data about impact. Adding policy tips changes what users see, which the requirement does not ask for.
Question 15. An organization wants to stop users from copying files labeled Highly Confidential to USB drives on Windows devices. Which configuration achieves this?
- A. Add encryption to the Highly Confidential label
- B. Create a DLP policy for Devices with the label as condition and block copy to USB
- C. Create a retention policy for Windows devices
- D. Make Highly Confidential the default label
Show answer
Answer: B
A DLP policy that includes the Devices location, with the sensitivity label as the condition and an action that blocks copying to USB removable media, meets the requirement through Endpoint DLP. Encryption in the label controls who can open the file, not where it is copied. A retention policy does not restrict copying. A default label only applies a label to unlabeled items.
Where to go next
Review the theory in sensitivity labels explained, then continue with Zero Trust and IAM practice questions and Conditional Access practice questions. The free 20-question SC-401 practice test mixes this topic with the rest of the exam, and multiple-choice exam tips cover how to handle the constraint words.