SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company operates in multiple countries and must comply with GDPR (EU) and CCPA (California). The compliance officer needs a single tool to assess the company's compliance posture against both regulations, get a consolidated compliance score, and receive prioritized improvement actions that can be assigned to responsible teams. The tool should also track progress over time. Which Microsoft Purview solution should the compliance officer use?
⚠ Common exam trap
Candidates often confuse Compliance Manager's scoring and action assignment features with DLP's data protection policies, but DLP lacks the regulatory assessment and progress tracking capabilities required for this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Compliance Manager
Microsoft Purview Compliance Manager is the correct solution because it provides a unified dashboard to assess compliance posture against multiple regulations like GDPR and CCPA. It offers a consolidated compliance score, prioritized improvement actions that can be assigned to responsible teams, and tracks progress over time through continuous assessments and automated control mapping.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Compliance Manager
Why this is correct
Microsoft Purview Compliance Manager is specifically designed to help organizations manage their compliance posture against a wide array of international, national, and industry-specific regulations, such as GDPR and CCPA. It provides a comprehensive solution for assessing, monitoring, and improving compliance by offering a compliance score, actionable improvement recommendations, and the ability to assign tasks to meet specific control requirements. This tool is essential for companies operating globally, needing to track their adherence to multiple, evolving regulatory frameworks.
- ✗
Microsoft Purview Data Loss Prevention (DLP)
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) is engineered to identify, monitor, and protect sensitive information across an organization's digital estate, including Exchange Online, SharePoint Online, OneDrive for Business, and Teams. Its core function is to prevent the unauthorized sharing or transfer of sensitive data by enforcing predefined or custom policies in real-time. While crucial for data protection, DLP does not provide a holistic assessment of an organization's overall compliance posture against external regulations or offer a compliance score.
When this WOULD be correct
A company needs to prevent sensitive data (e.g., credit card numbers, personal data) from being shared via email or cloud apps. The compliance officer wants to create policies that block or warn users when they attempt to share such data, ensuring compliance with data protection regulations.
- ✗
Microsoft Purview eDiscovery (Standard)
Why it's wrong here
Microsoft Purview eDiscovery (Standard) is a specialized tool used for identifying, preserving, collecting, and exporting electronically stored information (ESI) in response to legal or regulatory investigations. It enables organizations to efficiently search through vast amounts of data across Microsoft 365 services to fulfill specific legal hold requirements or discovery requests. This service is a reactive investigative tool for legal matters, not a proactive system for ongoing compliance assessment, management, or improvement tracking against broad regulatory obligations.
When this WOULD be correct
A company is facing a lawsuit and needs to identify, preserve, and collect electronically stored information (ESI) relevant to the case. The legal team requires a tool to search across Exchange, SharePoint, and Teams for responsive content and place holds on custodians.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management focuses on detecting, investigating, and acting on risky activities within an organization that could lead to data leakage or policy violations by internal users. It leverages signals from various Microsoft 365 services to identify potential insider threats, such as data exfiltration or intellectual property theft, and provides tools for investigation and remediation. This service is distinct from managing adherence to external regulatory compliance standards, as its primary goal is internal threat mitigation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview Compliance ManagerCorrect answer▾
Why this is correct
Microsoft Purview Compliance Manager is specifically designed to help organizations manage their compliance posture against a wide array of international, national, and industry-specific regulations, such as GDPR and CCPA. It provides a comprehensive solution for assessing, monitoring, and improving compliance by offering a compliance score, actionable improvement recommendations, and the ability to assign tasks to meet specific control requirements. This tool is essential for companies operating globally, needing to track their adherence to multiple, evolving regulatory frameworks.
✗Microsoft Purview Data Loss Prevention (DLP)Wrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Data Loss Prevention (DLP) is designed to prevent unauthorized sharing of sensitive data, not to assess compliance posture against regulations like GDPR and CCPA or provide a consolidated compliance score and prioritized improvement actions.
★ When this WOULD be the correct answer
A company needs to prevent sensitive data (e.g., credit card numbers, personal data) from being shared via email or cloud apps. The compliance officer wants to create policies that block or warn users when they attempt to share such data, ensuring compliance with data protection regulations.
Why candidates choose this
Candidates may confuse DLP with compliance management because DLP helps protect data, which is a key aspect of regulations like GDPR and CCPA, but it does not provide the assessment, scoring, and tracking features required in the question.
✗Microsoft Purview eDiscovery (Standard)Wrong answer — click to see why▾
Why this is wrong here
Microsoft Purview eDiscovery (Standard) is designed for legal discovery and preservation of electronic content, not for assessing compliance posture against regulations like GDPR and CCPA or providing a consolidated compliance score and improvement actions.
★ When this WOULD be the correct answer
A company is facing a lawsuit and needs to identify, preserve, and collect electronically stored information (ESI) relevant to the case. The legal team requires a tool to search across Exchange, SharePoint, and Teams for responsive content and place holds on custodians.
Why candidates choose this
Candidates may confuse eDiscovery with compliance because both involve data management and regulatory requirements, but eDiscovery focuses on litigation support rather than proactive compliance assessment and scoring.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.