A confidential document must carry a classification that can apply protection such as encryption and access restrictions. Which capability fits?

1. A VM availability set
2. A queue visibility timeout
3. A DNS label
4. Sensitivity labels