SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Data Lifecycle Management

  Why it's wrong here

  Data Lifecycle Management (DLM) in Microsoft Purview focuses on managing the retention and deletion of data throughout its lifecycle, ensuring compliance with organizational policies and regulatory requirements. This involves applying retention labels and policies to data based on its classification, but DLM does not perform the initial discovery or categorization of sensitive data itself. DLM acts upon data that has already been identified or classified, rather than being the mechanism for classification.

• ✗

  Data Loss Prevention

  Why it's wrong here

  Data Loss Prevention (DLP) policies are designed to identify, monitor, and protect sensitive information from unauthorized sharing or transfer, both within and outside the organization. While DLP policies leverage sensitive information types and classifications to detect specific data patterns, its primary function is to enforce protective actions like blocking, encrypting, or alerting, not to perform the initial comprehensive discovery and classification of all sensitive data for compliance purposes. DLP is a protective measure that *uses* classification, rather than the classification process itself.

• ✗

  Audit

  Why it's wrong here

  Microsoft 365 Audit logs record user and administrator activities across various services, providing an immutable trail of who did what, when, and where. While essential for security investigations and compliance reporting on actions taken, auditing does not analyze the *content* of data to identify personal information or classify it according to regulatory requirements like GDPR. Its purpose is activity tracking and accountability, not data content discovery or categorization.

• ✓

  Data Classification

  Why this is correct

  Data Classification in Microsoft Purview is the foundational process of identifying, categorizing, and labeling sensitive information, such as personal data subject to GDPR, across an organization's Microsoft 365 environment. This involves using sensitive information types, trainable classifiers, and sensitivity labels to automatically or manually tag data based on its content and context. Accurate data classification is crucial for understanding where sensitive data resides, enabling organizations to apply appropriate protection, retention, and compliance policies.

Go deeper

Related to this question