MS-900 Practice Question: Describe security, compliance, privacy, and trust in Microsoft 365
Your company is subject to the General Data Protection Regulation (GDPR). Which Microsoft 365 compliance feature helps you respond to a Data Subject Request (DSR) to export a user's personal data?
⚠ Common exam trap
The trap is conflating 'compliance features that protect data' (MIP, DLP) with 'compliance features that find and export data' (eDiscovery) — DSRs require the latter, not the former.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview eDiscovery
Microsoft Purview eDiscovery (Standard or Premium) is the compliance tool designed to identify, collect, preserve, and export content in response to Data Subject Requests under GDPR. It can search across Exchange, SharePoint, OneDrive, Teams, and other workloads, then export the results in a review set that satisfies the DSR 'right of access' and 'right to data portability' requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Information Protection
Why it's wrong here
Microsoft Information Protection classifies and labels content to prevent leakage; it does not locate or export a data subject's personal data. It would be correct when applying sensitivity labels and encryption to documents, not when fulfilling a DSR export request, which requires eDiscovery search and export.
- ✗
Data Loss Prevention
Why it's wrong here
Data Loss Prevention detects and blocks sensitive information leaving the tenant; it neither searches for nor exports an individual's personal data. It would be the right control when preventing accidental sharing of regulated content, not when responding to a DSR, which needs case-based search and export.
- ✓
Microsoft Purview eDiscovery
Why this is correct
Microsoft Purview eDiscovery locates and exports content across Exchange, SharePoint, OneDrive and Teams, matching a Data Subject Request for a user's personal data. Its search-and-export workflow satisfies the GDPR access right, unlike retention or labelling features.
- ✗
Unified audit log
Why it's wrong here
The unified audit log records user and admin activity for investigation; it does not compile or export a data subject's personal data. It would be correct when tracing who accessed a file, not when fulfilling a DSR, which requires eDiscovery content search and export.
Go deeper
Related to this question
Learn chapter
M365 Business Basic, Standard, Premium vs E3/E5
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every MS-900 question from scratch — 794 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This MS-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-900 exam.