SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company wants to automatically detect and remediate compliance issues such as sharing sensitive data externally. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Test-takers frequently confuse the proactive, blocking capability of DLP with the reactive, investigative tools like eDiscovery or Audit, mistakenly thinking that logging or searching for past incidents fulfills the requirement to 'automatically detect and remediate' in real time.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention
Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, alert, and automatically remediate when sensitive data (e.g., credit card numbers, personally identifiable information) is shared externally via email, Teams, or cloud apps. DLP policies can enforce actions like blocking the transmission or applying encryption, directly addressing the requirement to prevent unauthorized external sharing of sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Records Management
Why it's wrong here
Microsoft Purview Records Management focuses on managing the lifecycle of information, ensuring that records are retained and disposed of according to regulatory and organizational policies. Its primary function is to enforce retention labels and disposition reviews, not to actively monitor or prevent the unauthorized sharing of sensitive data in real-time. Therefore, it does not automatically detect and remediate compliance violations related to data sharing.
- ✓
Microsoft Purview Data Loss Prevention
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) is precisely designed to identify, monitor, and protect sensitive information across various locations, including cloud services, endpoints, and on-premises. DLP policies use sophisticated rules to detect sensitive data and automatically apply remediation actions, such as blocking sharing, encrypting content, or notifying administrators, effectively preventing unauthorized disclosure and ensuring compliance.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery solutions are utilized for legal and regulatory compliance, enabling organizations to search, preserve, collect, and review electronically stored information (ESI) in response to legal holds or investigations. It serves as a reactive tool for data retrieval and analysis after an event has occurred, rather than a proactive system for automatically detecting and preventing real-time compliance violations or unauthorized data sharing.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides a comprehensive, immutable log of user and administrator activities across Microsoft 365 services, crucial for forensic investigations and compliance reviews. While it records events that could indicate a compliance breach, it is a logging and reporting service that offers visibility into actions. It does not, however, automatically prevent unauthorized activities or remediate compliance issues in real-time.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.