SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Sensitivity labels and retention policies

  Why this is correct

  Sensitivity labels, a core component of Microsoft Purview Information Protection, enable automatic classification of documents based on their content, such as the presence of credit card numbers, using sensitive information types (SITs). Once documents are classified and labeled, retention policies can be applied to these labels, ensuring the content is retained for a specified duration, like seven years, to meet regulatory or organizational compliance requirements. This combination provides both intelligent identification of sensitive data and its subsequent lifecycle management.

• ✗

  Microsoft Purview compliance portal and Microsoft 365 Defender

  Why it's wrong here

  The Microsoft Purview compliance portal and Microsoft 365 Defender are unified management consoles designed for administering and monitoring various security and compliance solutions across an organization. While these portals provide the interface to configure and oversee features like sensitivity labels and retention policies, they are not the underlying mechanisms that perform the actual automatic classification of sensitive documents or enforce specific data retention periods. They serve as the control plane, not the data plane, for these operations.

• ✗

  Insider risk management and communication compliance

  Why it's wrong here

  Insider risk management is specifically designed to detect and act on potentially risky activities by users within an organization, such as data exfiltration or policy violations, by analyzing user behavior and signals. Communication compliance focuses on identifying and remediating inappropriate or non-compliant communications within messaging platforms like Microsoft Teams and Exchange. Neither of these solutions are designed for the automatic classification of documents based on their content or for the systematic enforcement of long-term data retention policies across an organization's data estate.

• ✗

  Data Loss Prevention (DLP) and eDiscovery

  Why it's wrong here

  Data Loss Prevention (DLP) policies are primarily focused on preventing sensitive information, like credit card numbers, from being inappropriately shared, accessed, or moved outside defined organizational boundaries. While DLP can identify sensitive data, its core function is to block or alert on data egress, not to classify documents for long-term retention. eDiscovery, conversely, is a process for identifying, preserving, collecting, and presenting electronic information for legal or investigative purposes, not for automatically applying and enforcing retention periods on all sensitive documents.

Go deeper

Related to this question