Question 880 A newly created sensitivity label is visible to compliance administrators but does not appear in Word for the intended staff. What should be checked? Whether the file has an unrelated retention policy Publish the sensitivity label to an administrators-only policy while expecting it to appear for department users in Word Whether the tenant's default browser is Edge The label publishing policy's included users/groups and completion of policy distribution Explanation Correct Answer D:Creating a label does not automatically publish it to every user. Incorrect Answers A:Retention does not make a sensitivity label visible in Office apps. B:A label must be published to its intended client/user audience; DNS mail routing has no role in label distribution. C:Browser selection is not the main determinant of label policy audience.
Question 881 A company wants Word to suggest a Confidential label when a detector finds personal IDs, but wants a person to confirm classification. What design fits? Create a retention policy requiring one-year preservation Configure a supported recommended labeling rule rather than automatically applying the label Create an auto-labeling policy that silently applies the label immediately Use only an Exchange mail-flow rule to rename the document Explanation Correct Answer B:Recommendation preserves a user confirmation step after the condition matches. Incorrect Answers A:Lifecycle settings do not suggest a sensitivity label in an authoring app. C:Automatic application does not ask the user to confirm. D:Mail transport cannot provide the requested authoring prompt.
Question 882 A department requests that newly created supported documents start with Internal as the ordinary classification. Which policy setting is relevant? A global retention label applied only after a deletion request A domain verification TXT record with the word Internal An endpoint device compliance tag named Internal The default sensitivity label in the label policy scoped to that department Explanation Correct Answer D:Policy defaults can establish an initial label for supported content and users. Incorrect Answers A:Retention selection does not specify the new-document sensitivity default. B:DNS proof has no relationship to content labeling defaults. C:Device tags do not set Office document classification defaults.
Question 883 Users repeatedly send unlabeled documents despite company policy. What supported sensitivity-label policy requirement addresses this? Enable only a retention policy with no classification instruction Rename an existing label to Mandatory without publishing a policy Turn on an Exchange forwarding address for all users Require the applicable users to select a sensitivity label for supported files or messages Explanation Correct Answer D:Mandatory labeling prompts classification rather than allowing the content to remain unlabeled. Incorrect Answers A:Retention timing does not force users to choose a sensitivity label. B:A label name alone is not an enforcement setting. C:Forwarding cannot require a document label.
Question 884 An employee changes a document from Confidential to Public after removing sensitive material. What policy feature can support accountable downgrades? Disable auditing of all sensitivity label actions Automatically delete the employee's account after each downgrade Require justification when users remove or lower the protection of a label Change the file's retention clock to zero days Explanation Correct Answer C:The policy can record why a less protective designation was selected. Incorrect Answers A:Removing evidence makes accountable downgrades harder to review. B:Deletion is disproportionate and not a label justification workflow. D:Lifecycle changes do not explain the classification decision.
Question 885 A compliance administrator wants to label existing SharePoint content without relying on individual users opening each document. What should be evaluated? Publish a recommended sensitivity label in Office apps only and assume existing SharePoint documents will be labeled without user interaction Require every SharePoint site owner to open each stored document so the Office client applies an organization sensitivity label A supported service-side auto-labeling policy scoped to the target SharePoint locations An Office user-facing recommended labeling prompt only Explanation Correct Answer C:At-rest service policies can inspect eligible stored content rather than requiring interactive editing. Incorrect Answers A:Recommended labeling waits for an applicable client interaction; a supported service-side policy can label eligible stored content. B:Manual client-side interaction does not meet the request for automated labeling of existing SharePoint content at scale. D:A client prompt requires an applicable user interaction.
Question 886 An auto-label policy could encrypt thousands of SharePoint files and disrupt external vendors. What is the most important deployment safeguard? Run simulation on a representative scope, inspect matches and exception cases, then enable enforcement Enable policy immediately and rely on emergency tenant deletion if sharing breaks Change every file's owner to the compliance administrator first Increase SharePoint storage limits instead of evaluating policy scope Explanation Correct Answer A:Previewing affected content reduces accidental broad protection changes. Incorrect Answers B:Tenant deletion is not a safe rollback method. C:Ownership changes may be disruptive and do not validate classification matches. D:Storage capacity does not establish which files will be labeled.
Question 887 A Teams-connected SharePoint site has a Confidential container label, but one downloaded file has no sensitivity encryption. What distinction explains this? Every site label always applies identical encryption to all files by default A site label is a retention policy that deletes old documents Interpret a Confidential site container label as guaranteed file-by-file encryption, regardless of separate item labeling and rights settings A container sensitivity label controls supported site or group settings and does not automatically encrypt every file in it Explanation Correct Answer D:Container and file-level labels apply different protection semantics. Incorrect Answers A:Container labeling is not automatic blanket document encryption. B:Sensitivity site labels are not inherently time-based deletion rules. C:Container sensitivity labels govern supported group/site properties but do not automatically apply item-level encryption to every file.
Question 888 A project workspace needs to restrict external guest access using classification of the Microsoft 365 group and site. Which label capability is relevant? Apply a sensitivity label that targets documents only, assuming it also configures the Microsoft 365 Group's guest access policy Apply a file-only encryption label and assume all site membership changes are blocked Use a sensitivity label configured for groups and sites with the intended guest-sharing controls Set the site's backup restore point to the day of creation Explanation Correct Answer C:Container label settings can manage supported group/site collaboration restrictions. Incorrect Answers A:File labels and container labels have different supported settings; restricting group/site guest access requires the appropriate container label. B:File encryption settings do not necessarily govern group guest membership. D:Backup history does not restrict new guest invitations.
Question 889 An encrypted sensitive message is sent to an approved outside lawyer, who cannot open its contents. Which policy setting deserves review? The sensitivity label's encryption permissions and supported external-recipient access experience Verify only that the encrypted message reached the lawyer's mailbox and assume delivery grants them decryption rights The message's retention label deletion period alone The lawyer's ability to view a public company website Explanation Correct Answer A:Recipients need usable rights to decrypt protected content even if mail delivery succeeded. Incorrect Answers B:Mail transport success is distinct from encryption authorization; confirm external-recipient permissions in the label. C:Retention cannot grant a decryption entitlement. D:Website access does not establish rights to encrypted mail.
Question 890 A classified file is encrypted with a label, but policy also requires blocking the upload of that file to an unsanctioned service. What control gap remains? Adding another Exchange accepted domain Strengthen the file's sensitivity label encryption permissions and assume that every upload destination is automatically blocked A retention policy that keeps the file ten years A relevant DLP or session/access policy for the destination and transfer channel Explanation Correct Answer D:File classification/encryption and movement prevention address different risks. Incorrect Answers A:Mail domains cannot govern an external SaaS upload. B:Encryption protects readable content but does not necessarily prevent the transfer action to an unsanctioned cloud app; DLP/session controls address the channel. C:Preservation does not necessarily prevent unauthorized upload.
