An organization is evaluating the risk of Microsoft 365 Copilot oversharing sensitive files with employees who lack the appropriate permissions. The CISO wants to assess which files Copilot could surface to users before deployment. Which tool provides a pre-deployment oversharing assessment?

C is correct because Microsoft Purview Data Security Posture Management (DSPM) for AI specifically identifies oversharing risks by analyzing which sensitive files are accessible to users and could be surfaced by Microsoft 365 Copilot. A is incorrect because Purview Data Catalog is for data governance cataloging, not Copilot oversharing risk assessment. B is incorrect because Secure Score for Identity measures identity security posture, not data oversharing. D is incorrect because Defender for Cloud Apps Cloud Discovery identifies shadow IT, not Copilot-specific oversharing risks.