SC-100 Practice Question: Design security solutions for applications and data
A company is implementing Microsoft Priva to manage subject rights requests. Users submit requests to access their personal data stored in Exchange Online, SharePoint, and Teams. The privacy team needs to automate the retrieval of data from these sources. Which Priva capability should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Subject Rights Requests
Priva Subject Rights Requests includes built-in data retrieval from Microsoft 365 sources to fulfill subject rights requests. Option C is incorrect because Data Inventory scans and maps personal data but does not retrieve data for requests. Option B is incorrect because Consent Management handles consent records, not data retrieval. Option D is incorrect because Data Breach Notifications are for incident response, not subject rights requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Subject Rights Requests
Why this is correct
Subject Rights Requests in Microsoft Priva is the automated workflow that locates, retrieves, and packages personal data stored across Microsoft 365 services to fulfill data subject requests such as access, export, and deletion. It uses data profiles and content search to identify relevant records, then facilitates review in a centralized case management experience, making it the correct module for managing subject rights requests.
- ✗
Consent Management
Why it's wrong here
Consent Management tracks whether a user has granted or withdrawn permission for a given data processing activity, such as marketing or analytics. It does not locate or export personal data in response to a subject rights request; instead, it governs the lawful basis for processing. Therefore, while consent records may be relevant to a DSR, this module does not perform the retrieval or fulfillment actions needed.
- ✗
Data Inventory
Why it's wrong here
Data Inventory maps and classifies personal data across the tenant to provide a catalog of where different types of personal data reside, including attributes such as data classification and retention. It gives visibility into the data landscape but does not execute the search, extraction, or delivery of data to satisfy a subject rights request. It is a prerequisite for discovery but not the mechanism that fulfills the request.
- ✗
Data Breach Notifications
Why it's wrong here
Data Breach Notifications manages the detection, assessment, and notification obligations following a security incident or personal data breach, typically to regulators and affected individuals. It is a reactive compliance process triggered by an incident, whereas subject rights requests are proactive, user-initiated actions. This module does not search or retrieve data for a data subject under normal operations, so it is incorrect here.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.