MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft 365 Defender

  Why it's wrong here

  Microsoft 365 Defender is an extended detection and response (XDR) platform that correlates signals from endpoints, email, identities, and cloud apps to detect and automatically respond to active attacks. However, it does not provide the granular, per-user audit trail of activities such as file access, permission changes, or sharing events that is needed to reconstruct a data breach timeline. Its alerts and incident telemetry complement an investigation but do not substitute for the historical activity records found in Purview Audit.

• ✓

  Microsoft Purview Audit (Standard)

  Why this is correct

  Microsoft Purview Audit (Standard) is the correct tool because it records timestamped events for user and admin actions across Exchange, SharePoint, OneDrive, Teams, and Azure AD. Investigators can query the unified audit log to identify exactly when a file was accessed, downloaded, shared, or deleted and which account performed the action. This historical, activity-level evidence is essential for monitoring, triaging, and thoroughly investigating a potential data breach, with default retention of 90 days for standard events.

• ✗

  Microsoft Purview eDiscovery

  Why it's wrong here

  Microsoft Purview eDiscovery is built for legal and regulatory workflows, such as content search, legal hold, and exporting documents as evidence in litigation. It does not continuously capture or display user activity events like who opened or shared a file over time; instead, it locates and preserves existing content at rest. Therefore, while eDiscovery may be used after a breach is detected to preserve trial evidence, it is not the mechanism for proactively monitoring or investigating suspicious activities, as it has no audit timeline.

• ✗

  Microsoft Secure Score

  Why it's wrong here

  Microsoft Secure Score is a configuration-based security posture metric that recommends and scores improvements like enforcing MFA, enabling conditional access, and reducing attack surface. It tracks whether security controls are implemented, not what user or admin actions occurred over time, so it contains no log data to review when investigating a breach. In short, Secure Score answers 'how secure is my tenant configuration?' but cannot answer 'what did a user access or share?'—those details live in audit logs.