A governance lead must classify a "Microsoft Fabric" "semantic model" as confidential so that the classification drives encryption and access enforcement, and must travel with the data wherever it goes. A separate concern is signalling to other teams that the model is a recommended, trusted asset to reuse. Which capability should the lead apply to satisfy the classification-and-protection requirement?
- AA certified endorsement, because certification marks the model as an authoritative asset and encrypts its underlying data at the document level for downstream consumers.
- BA sensitivity label backed by Microsoft Purview Information Protection, because the label classifies the model and carries encryption and access policy that persist with exported data. Correct
- CA promoted endorsement, because promotion lets the owner flag the model as recommended and then attaches an information-protection policy that restricts who can open the data.
- DA workspace role assignment, because granting Viewer at the workspace level controls who can read the model and thereby protects the confidential figures inside it.
Why A is wrong: Certification signals trust and authority for reuse, but it applies no encryption and enforces no access control, so it cannot satisfy the classification-and-protection requirement.
Why B is correct: Sensitivity labels defined in Microsoft Purview classify the item and apply persistent encryption and access enforcement that travel with the data, which is exactly what the requirement asks for.
Why C is wrong: Promotion only flags an item as recommended for reuse; it carries no encryption or access policy, so it cannot enforce classification-driven protection on the data.
Why D is wrong: Workspace roles govern access inside the workspace only and do not classify the item or protect data after export, so the protection does not travel with the file.