SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company stores sensitive financial data on on-premises Windows Server file shares. The compliance team needs to automatically discover files containing credit card numbers, classify them by applying a sensitivity label, and optionally enforce protection actions like encryption. They want this solution to run on the on-premises file servers without needing to manually scan. Which Microsoft Purview solution should the compliance team deploy?
⚠ Common exam trap
Watch out — candidates often confuse Data Loss Prevention (DLP) for on-premises, which monitors data in motion, with the Information Protection scanner, which handles data at rest classification and labeling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection scanner
The Microsoft Purview Information Protection scanner is designed to run on on-premises Windows Server file shares to automatically discover, classify, and protect sensitive data. It uses content inspection to identify patterns like credit card numbers, applies sensitivity labels, and can enforce encryption without requiring manual scanning.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Data Loss Prevention (DLP) for on-premises
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) for on-premises is designed to prevent sensitive information from being shared inappropriately, either internally or externally, by monitoring data in motion or at rest. While DLP policies can enforce actions based on sensitive information types or sensitivity labels, its primary role is *prevention* of loss, not the initial *discovery, classification, and automatic labeling* of vast amounts of existing, unlabeled sensitive data on file servers. It acts on data once it's created, modified, or attempted to be shared, often relying on labels already applied.
When this WOULD be correct
A company needs to prevent accidental sharing of credit card numbers via email or network shares by blocking the transmission or alerting users. The compliance team wants to enforce protection actions like blocking or warning without requiring classification labels. In that scenario, deploying Microsoft Purview DLP for on-premises would be correct.
- ✓
Microsoft Purview Information Protection scanner
Why this is correct
The Microsoft Purview Information Protection scanner is specifically designed to discover, classify, and protect sensitive data residing on on-premises file shares and SharePoint servers. It scans content based on configured sensitive information types and automatically applies sensitivity labels, which can include visual markings, encryption, and content access restrictions. This proactive approach ensures that existing sensitive financial data is identified and secured without manual intervention, directly addressing the need for on-premises data protection.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides detailed logging of user and admin activities across various Microsoft 365 services, including file access, modifications, and sharing events. While crucial for forensic investigations, compliance monitoring, and understanding data usage patterns, its primary function is to record actions. It does not actively discover, classify, or apply protective measures like sensitivity labels or encryption to sensitive data files themselves, making it unsuitable for the initial protection task.
When this WOULD be correct
A compliance team needs to investigate a data breach by reviewing all user access and modification logs for sensitive files over the past 90 days. They require detailed audit records to identify suspicious activity.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery tools are utilized to identify, preserve, collect, review, and export electronically stored information (ESI) in response to legal or regulatory requests or internal investigations. Its functionality is centered around managing data for litigation or compliance inquiries, enabling legal teams to find relevant information. It does not, however, provide capabilities for automatically discovering sensitive content on file servers and applying protective measures such as encryption or sensitivity labels.
When this WOULD be correct
A legal team needs to search for and export emails and documents related to a lawsuit from Exchange Online and SharePoint Online. Deploying Microsoft Purview eDiscovery would allow them to identify, preserve, and export relevant data for litigation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview Information Protection scannerCorrect answer▾
Why this is correct
The Microsoft Purview Information Protection scanner is specifically designed to discover, classify, and protect sensitive data residing on on-premises file shares and SharePoint servers. It scans content based on configured sensitive information types and automatically applies sensitivity labels, which can include visual markings, encryption, and content access restrictions. This proactive approach ensures that existing sensitive financial data is identified and secured without manual intervention, directly addressing the need for on-premises data protection.
✗Microsoft Purview Data Loss Prevention (DLP) for on-premisesWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Data Loss Prevention (DLP) for on-premises can detect sensitive data and enforce policies like blocking or warning, but it does not automatically classify files by applying sensitivity labels. The question specifically requires classification via sensitivity labels, which is a core function of the Information Protection scanner.
★ When this WOULD be the correct answer
A company needs to prevent accidental sharing of credit card numbers via email or network shares by blocking the transmission or alerting users. The compliance team wants to enforce protection actions like blocking or warning without requiring classification labels. In that scenario, deploying Microsoft Purview DLP for on-premises would be correct.
Why candidates choose this
Candidates may confuse DLP's ability to detect sensitive data with the classification and labeling capabilities of Information Protection. They might think DLP can also apply labels, but DLP focuses on policy enforcement (block, warn) rather than automatic labeling.
✗Microsoft Purview AuditWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Audit is designed for logging and investigating user and admin activities, not for automatically discovering, classifying, or protecting sensitive data on file shares.
★ When this WOULD be the correct answer
A compliance team needs to investigate a data breach by reviewing all user access and modification logs for sensitive files over the past 90 days. They require detailed audit records to identify suspicious activity.
Why candidates choose this
Candidates may confuse 'audit' with 'discovery' or think that auditing includes scanning for sensitive content, but Audit only records events, not content classification.
✗Microsoft Purview eDiscoveryWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview eDiscovery is designed for searching and exporting content from Microsoft 365 and Exchange Online, not for automatically discovering and classifying sensitive data on on-premises Windows Server file shares.
★ When this WOULD be the correct answer
A legal team needs to search for and export emails and documents related to a lawsuit from Exchange Online and SharePoint Online. Deploying Microsoft Purview eDiscovery would allow them to identify, preserve, and export relevant data for litigation.
Why candidates choose this
Candidates may confuse eDiscovery's search capabilities with the discovery of sensitive data for compliance, not realizing eDiscovery focuses on legal discovery rather than automated classification and labeling.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.