Understand data protection and governance tasks for Microsoft 365 and Copilot practice questions

Sensitivity labels can be applied manually, by default, by required (mandatory) labeling, by client-side auto-labeling in Office apps, or by service-side auto-labeling policies.

The deciding detail is that nobody will open the files. Every client-side option (auto-labeling in the label for Office apps, default labels, mandatory labeling) only acts when a user creates, edits or saves a document. A service-side auto-labeling policy runs in SharePoint and OneDrive (and Exchange for mail in transit), finds content that matches sensitive information types and applies the label without user involvement.

1. Notice the files are at rest and won't be edited.
2. Separate client-side methods (need a user in the app) from service-side policies.
3. Match the requirement to service-side auto-labeling for SharePoint and OneDrive.

Exam tip: Files at rest that nobody opens need a service-side auto-labeling policy.

Data classification in Purview identifies sensitive items with sensitive information types (SITs), trainable classifiers and exact data match.

Credit card numbers have a well-defined structure (format and checksum), which is exactly what a sensitive information type describes, and Microsoft ships one ready to use. Trainable classifiers are for categories of documents, exact data match compares against values you upload, and fingerprinting matches a template document.

1. Identify what is being detected: a structured number.
2. Recall that SITs detect patterns with checksums and keywords.
3. Reject methods that need your own data or describe whole document types.

Exam tip: Structured identifiers such as card or passport numbers: use a sensitive information type.

Trainable classifiers use machine learning to recognise categories of content rather than specific patterns.

When the content is identified by what it is, not by a number pattern, a trainable classifier is the right tool. Microsoft ships pre-trained classifiers for categories such as resumes and source code, and you can train your own from samples. SITs need patterns or keywords, exact data match needs a table of values, and fingerprinting needs a template.

1. Note that there is no pattern or keyword to match.
2. Recall that trainable classifiers recognise document categories.
3. Choose the pre-trained classifiers for resumes and source code.

Exam tip: Recognise a kind of document (resume, contract, source code): trainable classifier.

Exact data match (EDM) classification matches content against actual values from a table you upload, instead of a generic pattern.

The problem is false positives from pattern matching. Only exact data match checks the detected value against the organization's own data, so a number in the right format that isn't a real customer's doesn't trigger the policy. A stricter regex is still a pattern, a classifier recognises document categories, and fingerprinting recognises a template.

1. Identify the cause: pattern matching can't know which numbers are real.
2. Recall that EDM compares against uploaded values from your own records.
3. Choose exact data match for precise, low false-positive detection.

Exam tip: Need to match only your real records, not anything in that format: exact data match.

Microsoft Purview Data Loss Prevention (DLP) prevents sensitive information from being shared inappropriately across email, SharePoint, OneDrive, Teams, devices and Copilot.

The requirement is real-time: warn the user and optionally stop the action while they share. That is what DLP policies do with policy tips and block actions. Insider Risk Management and Communication Compliance surface activity or messages for review later, and Data Lifecycle Management controls retention.

1. Notice the need to act at the moment of sharing.
2. Recall that DLP shows policy tips and can block.
3. Reject solutions that only review or retain.

Exam tip: Warn or block while sensitive data is being shared: DLP.

Insider Risk Management uses policy templates such as data theft by departing users to correlate risky activities, with privacy controls like pseudonymization.

The scenario combines a trigger (resignation reported by HR), several activity signals over time and a privacy requirement. Insider Risk Management is built for this: its policies score sequences of risky activity and show users with pseudonymized names unless an authorised investigator reveals them. Communication Compliance looks at message content, DLP evaluates single actions, and DSPM for AI covers AI usage.

1. Spot the pattern: a departing user and many activity signals.
2. Recall the data theft by departing users template.
3. Note the pseudonymization requirement, a privacy feature of Insider Risk Management.

Exam tip: Risky user behaviour over time, pseudonymized: Insider Risk Management.