SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company receives a subject rights request (SRR) from a customer under GDPR, asking for the deletion of all personal data held about them. The compliance team needs a tool to orchestrate the discovery of this data across Microsoft 365 and other systems, and to track the response and fulfillment of the request. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Watch out — candidates often confuse eDiscovery (which handles legal holds and litigation) with privacy management (which handles subject rights requests), but eDiscovery lacks the automated SRR workflow and privacy-specific orchestration that Priva provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Priva (Privacy Management)
Microsoft Priva (Privacy Management) is the correct solution because it is specifically designed to help organizations manage subject rights requests (SRRs) under regulations like GDPR. It automates the discovery of personal data across Microsoft 365 and connected systems, provides a workflow to track the request lifecycle, and facilitates the fulfillment of actions such as deletion. This directly addresses the compliance team's need to orchestrate discovery and track response for an SRR.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery solutions are primarily designed to identify, preserve, collect, review, and produce electronically stored information (ESI) for legal cases, investigations, or regulatory inquiries. While eDiscovery can locate data, its workflows are tailored for litigation support, focusing on legal holds and production sets, rather than the specific requirements of a Subject Rights Request, such as data subject verification, data minimization for privacy, or the structured fulfillment of access/deletion requests.
When this WOULD be correct
A company receives a legal hold notice for an ongoing lawsuit and needs to search for and preserve relevant emails and documents across Microsoft 365. Microsoft Purview eDiscovery would be the correct solution to identify, hold, and export that content.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit logs user and administrator activities across Microsoft 365 services, providing forensic capabilities for security and compliance investigations. While it records *who* accessed *what* and *when*, it lacks the integrated data discovery, review, redaction, and fulfillment workflows specifically designed to locate and manage personal data across diverse data sources in response to a Subject Rights Request. It provides activity logs, not data governance for privacy requests.
When this WOULD be correct
A company needs to investigate a potential security incident by reviewing all user actions (e.g., file access, sign-ins) across Microsoft 365 over the past 90 days. Which Microsoft Purview solution should they use?
- ✗
Microsoft Purview Data Lifecycle Management (retention labels)
Why it's wrong here
Microsoft Purview Data Lifecycle Management, including retention labels, is designed to manage the lifecycle of information by applying policies to retain or delete content based on regulatory, legal, or business requirements. These labels ensure data is kept for the correct duration or disposed of properly. However, this feature does not provide the dynamic data discovery, review, and fulfillment orchestration capabilities necessary to actively respond to a specific individual's Subject Rights Request for access, rectification, or erasure of their personal data.
When this WOULD be correct
A company needs to automatically apply retention or deletion policies to documents based on their content (e.g., financial records) to comply with internal data governance policies. The question would ask for a solution to manage data retention and deletion lifecycle.
- ✓
Microsoft Priva (Privacy Management)
Why this is correct
Microsoft Priva (Privacy Management) is purpose-built to streamline the complex process of responding to Subject Rights Requests (SRRs). It offers automated data discovery across Microsoft 365, Azure, and other connected data sources, identifying personal data relevant to a specific data subject. Priva provides a comprehensive workflow for review, redaction, collaboration, and secure fulfillment, ensuring compliance with global privacy regulations like GDPR and and CCPA.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Priva (Privacy Management)Correct answer▾
Why this is correct
Microsoft Priva (Privacy Management) is purpose-built to streamline the complex process of responding to Subject Rights Requests (SRRs). It offers automated data discovery across Microsoft 365, Azure, and other connected data sources, identifying personal data relevant to a specific data subject. Priva provides a comprehensive workflow for review, redaction, collaboration, and secure fulfillment, ensuring compliance with global privacy regulations like GDPR and and CCPA.
✗Microsoft Purview eDiscoveryWrong answer — click to see why▾
Why this is wrong here
eDiscovery is designed for legal discovery of content in litigation or investigations, not for orchestrating and tracking subject rights requests under GDPR. It lacks the workflow automation and privacy-specific features needed to manage SRR fulfillment across multiple systems.
★ When this WOULD be the correct answer
A company receives a legal hold notice for an ongoing lawsuit and needs to search for and preserve relevant emails and documents across Microsoft 365. Microsoft Purview eDiscovery would be the correct solution to identify, hold, and export that content.
Why candidates choose this
Candidates may confuse the data search aspect of eDiscovery with the data discovery needed for SRRs, not realizing that SRR management requires dedicated privacy workflow tools like Priva.
✗Microsoft Purview AuditWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Audit is designed for logging and investigating user and admin activity, not for orchestrating discovery or tracking fulfillment of subject rights requests under GDPR.
★ When this WOULD be the correct answer
A company needs to investigate a potential security incident by reviewing all user actions (e.g., file access, sign-ins) across Microsoft 365 over the past 90 days. Which Microsoft Purview solution should they use?
Why candidates choose this
Candidates may confuse auditing with the ability to track data for compliance, or assume that audit logs can help locate personal data, but Audit does not provide data discovery or request management capabilities.
✗Microsoft Purview Data Lifecycle Management (retention labels)Wrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management (retention labels) is used to classify and manage data retention and deletion policies, not to orchestrate discovery of personal data across systems or track subject rights request fulfillment.
★ When this WOULD be the correct answer
A company needs to automatically apply retention or deletion policies to documents based on their content (e.g., financial records) to comply with internal data governance policies. The question would ask for a solution to manage data retention and deletion lifecycle.
Why candidates choose this
Candidates may confuse retention labels with data deletion capabilities, assuming that labeling data for deletion is equivalent to managing SRR fulfillment, but SRR requires cross-system discovery and workflow tracking, not just policy-based deletion.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
Key term
Privacy
Privacy in IT is the control over how personal data is collected, stored, used, and shared by systems and organizations.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.