SC-100 Practice Question: Design security operations, identity, and compliance capabilities
You need to audit user activities in Microsoft 365, including who accessed a specific file in SharePoint Online. Which Microsoft Purview solution should you use?
⚠ Common exam trap
A common mix-up: candidates confuse 'auditing' with 'protection' or 'compliance' solutions, mistakenly choosing Information Protection (A) because they think labeling controls access, or Communication Compliance (B) because they associate 'compliance' with monitoring user actions, when in fact Audit is the dedicated logging service for user activity tracking.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit
Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) is the correct solution because it captures and logs user activities across Microsoft 365 services, including SharePoint Online. When a user accesses a specific file, the audit log records the event with details such as the user, file name, action (e.g., FileAccessed), and timestamp, enabling you to query this data via the Microsoft 365 Defender portal or Search-UnifiedAuditLog cmdlet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection is designed to classify and label sensitive data by applying sensitivity labels and encryption, but it does not capture or record user actions such as file access or permissions changes. Its purpose is to protect data at rest and in transit, not to serve as an audit log. Therefore, it cannot fulfill the requirement to audit user activities in Microsoft 365.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance monitors communications, such as emails and Microsoft Teams messages, to detect policy violations like harassment or confidential information sharing. It does not audit general user activities across Microsoft 365 services, including file access, administrative actions, or system events. Its focus is on content analysis and policy enforcement, not on providing a historical record of user actions for security investigation.
- ✓
Microsoft Purview Audit
Why this is correct
Microsoft Purview Audit is the correct solution because it provides a unified audit log that records user and admin activities across Microsoft 365 services, including file access, permission changes, and sign-ins. Organizations can search and export these audit records from the Purview compliance portal or via Office 365 Management Activity API, enabling security teams to investigate incidents and meet compliance requirements. This capability directly addresses the need to audit user activities.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management governs the retention and deletion of data by applying retention policies and labels to preserve or remove content based on regulatory or business requirements. It does not log or track user interactions with files or other activities; instead, it manages the data's lifespan. Since auditing requires capturing events, not managing data retention, this option is incorrect for the stated requirement.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 605-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.