Describe security, compliance, privacy, and trust in Microsoft 365 →mediumMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer needs to identify users who are at risk of leaking sensitive data based on their activities such as copying files to USB drives or emailing content outside the organization. The solution must also allow reviewing the activities in a case-based workflow. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Watch out — candidates often confuse Data Loss Prevention (DLP) with Insider Risk Management, but DLP is a preventive control that blocks actions in real-time, whereas Insider Risk Management is a detective control that identifies risky users and provides a case workflow for post-event review.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Insider Risk Management
Microsoft Purview Insider Risk Management is specifically designed to detect, investigate, and act on risky user activities that could lead to data leaks, such as copying files to USB drives or emailing sensitive content externally. It provides a case-based workflow for reviewing and managing these activities, aligning directly with the compliance officer's requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Data Loss Prevention
Why it's wrong here
DLP policies are content-based and focus on preventing unauthorized transfer of sensitive data via email, cloud storage, or endpoint devices. They operate as an enforcement layer, blocking or detecting specific types of sensitive information, but they do not analyze user behavior patterns, assign risk scores, or provide a case-based incident workflow. Consequently, DLP alone cannot proactively identify which users are at risk of becoming internal threats; it lacks the contextual and predictive insight that insider risk assessment requires.
- ✓
Microsoft Purview Insider Risk Management
Why this is correct
Microsoft Purview Insider Risk Management is the correct solution because it correlates signals from audit logs, DLP alerts, and other behavioral indicators to mathematically assess a user's risk of insider activity. It uses predefined and customizable policies to detect anomalies such as mass file downloads, unusual access times, or exfiltration attempts, and then places the user in a triage space with a case-based workflow. This is specifically designed to help compliance officers identify, investigate, and act on users who are at risk of committing data leaks.
- ✗
Microsoft Purview Audit (Premium)
Why it's wrong here
Microsoft Purview Audit (Premium) provides an immutable, detailed log of actions across Microsoft 365, with features like increased retention and high-value events. However, it simply records what happened; it does not apply analytics to aggregate activities into risk scores or identify behavioral trends that signal an at-risk user. A compliance officer would have to manually correlate hundreds of raw events, which is impractical for proactive insider risk detection, and the tool lacks the built-in case management that Insider Risk Management offers.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Communication Compliance is designed to monitor message content in email, Teams, and Yammer to detect policy violations like harassment, abusive language, or inappropriate sharing of confidential information in conversations. While it mitigates communication-based risks, its scope is limited to the text of messages and does not evaluate user behavior regarding file access, downloads, or other exfiltration techniques outside of communications. Therefore, it cannot identify users at risk of data leaks that occur through non-communication channels such as USB, cloud upload, or printing.
Go deeper
Related to this question
About these practice questions
One of 217 original MS-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.