Describe security, compliance, privacy, and trust in Microsoft 365 →hardMultiple ChoiceObjective-mapped
MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
A compliance officer needs to set up a policy that automatically monitors and detects activities related to accessing sensitive data from outside the corporate network. When a user from a foreign country accesses a confidential file, the policy should trigger an alert and require additional authentication. Which combination of Microsoft 365 solutions achieves this?
⚠ Common exam trap
Watch out — candidates often confuse Microsoft Purview Insider Risk Management with external access detection, but it is specifically for internal user risk, not foreign country access scenarios.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention and Conditional Access
Microsoft Purview Data Loss Prevention (DLP) monitors and detects sensitive data access from outside the corporate network, while Conditional Access enforces additional authentication (e.g., MFA) when such access is detected. Together, they meet the requirement for automatic alerting and step-up authentication based on location and data sensitivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Data Loss Prevention and Conditional Access
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) continuously inspects content in Exchange, SharePoint, OneDrive, and endpoints to detect sensitive data patterns and automatically trigger alerts or protective actions. Conditional Access in Microsoft Entra ID evaluates signals such as user location, device compliance, and risk level to require additional authentication (e.g., MFA) before access is granted. Together, they satisfy both the monitoring-and-alerting requirement and the adaptive authentication requirement, making them the correct pairing.
- ✗
Microsoft Purview Audit (Standard) and Microsoft Entra ID Identity Protection
Why it's wrong here
Microsoft Purview Audit (Standard) records user and admin activities in the unified audit log, but it is a passive logging capability that does not autonomously generate alerts based on sensitive data access. Microsoft Entra ID Identity Protection focuses on anomalous user behavior and sign-in risk (e.g., leaked credentials, impossible travel), not on classifying or protecting data at rest or in use. Consequently, this combination does not provide automatic policy enforcement for sensitive data nor satisfy the authentication requirement in a data-centric manner.
- ✗
Microsoft Purview Insider Risk Management and Microsoft Cloud App Security
Why it's wrong here
Microsoft Purview Insider Risk Management identifies potentially risky user behaviors using pre-defined or custom policies, but it requires explicit configuration to correlate with data sensitivity and typically detects patterns over time rather than issuing immediate real-time alerts for every sensitive data access. Microsoft Cloud App Protection (MCAS) provides visibility, shadow IT discovery, and session controls for cloud apps, but it does not natively require additional authentication itself; it can integrate with Conditional Access but is not a replacement. Therefore, this pairing is not a complete solution for automatically alerting on sensitive data activities and enforcing location-based authentication.
- ✗
Microsoft Purview eDiscovery and Privileged Identity Management
Why it's wrong here
Microsoft Purview eDiscovery (Standard or Premium) is designed for legal and compliance investigations—searching, preserving, and exporting content from mailboxes, sites, and Teams—not for real-time monitoring of data access events. Privileged Identity Management (PIM) in Microsoft Entra ID governs just-in-time and time-bound access for privileged roles, focusing on identity elevation rather than auditing or alerting on data-level operations. As a result, this combination addresses neither the automatic alerting on sensitive data nor the additional authentication requirement for general access.
Go deeper
Related to this question
Learn chapter
Benefits of Microsoft Cloud
Key term
Alert
An alert is a notification that something unusual or potentially harmful has happened in a computer system or network.
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
About these practice questions
Courseiva writes every MS-900 question from scratch — 217 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.