Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A company uses Microsoft Purview to monitor for potential data security incidents. They want to automatically detect and remediate activities like downloading large amounts of data to a personal device. Which solution should they configure?
⚠ Common exam trap
Watch out — candidates often confuse Data Loss Prevention (DLP) with Insider Risk Management, assuming DLP handles all data security incidents, but DLP focuses on content-based policies (e.g., credit card numbers) rather than behavioral detection of risky user actions like bulk downloads to personal devices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insider Risk Management
Insider Risk Management is the correct solution because it is specifically designed to detect and remediate risky user activities that could lead to data security incidents, such as downloading large amounts of data to a personal device. It uses machine learning and behavioral analytics to identify anomalous patterns and can trigger automated remediation actions like blocking the activity or notifying the user.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Data Loss Prevention (DLP) is a content-based policy enforcement engine that blocks or alerts on the transfer of sensitive information—such as credit card data or confidential documents—via email, endpoints, or cloud applications. It can restrict a file upload to a personal device, but it does not correlate multiple user behaviors over time to infer intent or risk. DLP therefore prevents a narrow set of data-exfiltration actions rather than detecting and remediating the broader insider-threat pattern described in the question.
- ✓
Insider Risk Management
Why this is correct
Insider Risk Management is the Microsoft Purview solution built specifically to identify, triage, and respond to risky user behavior by aggregating signals from Windows, Microsoft 365, and HR systems into a consolidated risk score. It uses predefined risk indicator policies—such as mass file downloads, unusual device connections, or repeated data exfiltration—and applies machine learning to surface anomalous patterns with a case-management workflow. When a threshold is met, it can automatically escalate to an investigation, notify the user, or trigger a policy response, making it the correct choice for monitoring and remediating potential data loss from insiders.
- ✗
Audit
Why it's wrong here
Microsoft Purview Audit (formerly Office 365 Audit Log) records user and administrator actions in searchable logs, providing a forensic record of events such as sign-ins, file downloads, and mailbox access. However, it is a passive telemetry source—it does not continuously evaluate user behavior, compute risk scores, or automatically trigger remediation workflows. An analyst must proactively query the audit log or create custom alert rules to spot anomalies, whereas the requirement asks for automatic monitoring and response to potential data threats.
- ✗
eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery is designed for legal and regulatory investigations, allowing content to be placed on hold, searched across Exchange Online, SharePoint, OneDrive, and Teams, and exported as evidence for litigation. It operates retrospectively after a legal trigger or compliance request, not in real time, and it lacks behavioral risk indicators or incident-response automation. While eDiscovery can retrieve relevant files after a suspected leak, it cannot detect the initial risky action or remediate the threat itself, so it does not satisfy the monitoring requirement.
Go deeper
Related to this question
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.