The answer is the improvement action component in Microsoft Purview Compliance Manager. This is the correct choice because improvement actions are the granular, actionable tasks—such as configuring a specific security policy or enabling audit logging—that directly influence your compliance score for frameworks like SOC 2. By assigning these actions to responsible teams and tracking their completion status, you can systematically address control requirements and demonstrate measurable progress during a SOC 2 audit. On the SC-900 exam, this concept tests your understanding of how Compliance Manager operationalizes compliance, often appearing in scenario-based questions where you must distinguish improvement actions from assessments or templates. A common trap is confusing improvement actions with controls themselves, but remember: controls are the requirements, while improvement actions are the specific steps you take to meet them. For a quick memory tip, think “Actions improve your score”—if it’s a task you assign and track, it’s an improvement action.
SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
This SC-900 practice question tests your understanding of describe the capabilities of microsoft compliance solutions. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company uses Microsoft Purview Compliance Manager to improve their compliance posture. They are preparing for a SOC 2 audit and need to score compliance with SOC 2 controls, track improvement actions, and assign tasks to responsible teams. Which component of Compliance Manager should they use to assign and track specific actions to improve their compliance score?
Why wrong: An assessment groups controls for a specific regulation, but users do not assign tasks directly to assessments; tasks are assigned at the improvement action level.
B
Control
Why wrong: A control represents a compliance requirement. While controls have implementation status, the actionable tasks are found in improvement actions.
C
Improvement action
Improvement actions are detailed tasks that can be assigned to groups or individuals, tracked, and documented to demonstrate compliance progress.
D
Template
Why wrong: A template is a predefined set of controls for a regulation (e.g., SOC 2 template). It is not used to assign individual tasks.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Improvement action
Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Assessment
Why it's wrong here
An assessment groups controls for a specific regulation, but users do not assign tasks directly to assessments; tasks are assigned at the improvement action level.
✗
Control
Why it's wrong here
A control represents a compliance requirement. While controls have implementation status, the actionable tasks are found in improvement actions.
✓
Improvement action
Why this is correct
Improvement actions are detailed tasks that can be assigned to groups or individuals, tracked, and documented to demonstrate compliance progress.
Related concept
Read the scenario before looking for a memorised answer.
✗
Template
Why it's wrong here
A template is a predefined set of controls for a regulation (e.g., SOC 2 template). It is not used to assign individual tasks.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse 'Control' (the requirement) with 'Improvement action' (the task to meet the requirement), leading them to select B, even though controls are not directly assignable or trackable as individual tasks.
Detailed technical explanation
How to think about this question
Under the hood, each improvement action in Compliance Manager is mapped to one or more technical controls (e.g., Azure Policy, Microsoft Defender for Cloud recommendations) and has a calculated 'score impact' based on its implementation status. When you assign an improvement action to a team, it creates a trackable task with a due date and status (e.g., 'Not started', 'In progress', 'Completed'), and the compliance score is recalculated in near real-time as actions are marked complete. In a real-world SOC 2 audit, an auditor will review the evidence linked to these improvement actions, such as system logs or configuration reports, to verify control effectiveness.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SC-900 question in full detail.
Describe the capabilities of Microsoft compliance solutions — This question tests Describe the capabilities of Microsoft compliance solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Improvement action — Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.
What should I do if I get this SC-900 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company operates in multiple countries and must comply with GDPR (EU) and CCPA (California). The compliance officer needs a single tool to assess the company's compliance posture against both regulations, get a consolidated compliance score, and receive prioritized improvement actions that can be assigned to responsible teams. The tool should also track progress over time. Which Microsoft Purview solution should the compliance officer use?
hard
✓ A.Microsoft Purview Compliance Manager
B.Microsoft Purview Data Loss Prevention (DLP)
C.Microsoft Purview eDiscovery (Standard)
D.Microsoft Purview Insider Risk Management
Why A: Microsoft Purview Compliance Manager is the correct solution because it provides a unified dashboard to assess compliance posture against multiple regulations like GDPR and CCPA. It offers a consolidated compliance score, prioritized improvement actions that can be assigned to responsible teams, and tracks progress over time through continuous assessments and automated control mapping.
Variation 2. A company must comply with the General Data Protection Regulation (GDPR). They need a unified solution that provides a compliance score, actionable recommendations to improve their security posture, and the ability to track their progress over time. Additionally, they want to assign improvement actions to specific teams and automate the collection of evidence for controls. Which two Microsoft Purview solutions should the administrator use? (Select two.)
hard
✓ A.Compliance Manager
B.Data Lifecycle Management
C.Insider Risk Management
✓ D.Audit (Premium)
Why A: Compliance Manager is correct because it provides a unified compliance score, actionable recommendations to improve security posture, and the ability to track progress over time. It also allows administrators to assign improvement actions to specific teams and automate evidence collection for controls, directly meeting all the stated GDPR compliance requirements.
Last reviewed: Jun 11, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.