SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A compliance officer at Contoso needs to review all user and admin activities across Exchange Online, SharePoint Online, and Microsoft Entra ID for the past 90 days to investigate a potential data leak. Which Microsoft Purview solution should they use?
⚠ Common exam trap
The trap here is assuming that eDiscovery or DLP provides the same breadth of activity logging as Microsoft Purview Audit, when only Audit offers a unified, searchable log of user and admin actions across services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit
Microsoft Purview Audit is the correct solution because it aggregates and retains user and administrator activity logs from Microsoft 365 services, including Exchange Online, SharePoint Online, and Entra ID. Compliance officers can search these logs to trace actions such as file accesses, permission changes, and sign-ins. The other solutions address different needs: DLP prevents sharing, Information Barriers restrict communication, and eDiscovery collects content for legal matters.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
eDiscovery is used to identify, collect, and preserve electronically stored information for legal cases. It can search content in mailboxes and sites, but it focuses on content rather than the full set of user and admin activities. It does not provide a comprehensive audit log of actions like sign-ins or permission changes, which are essential for investigating a data leak.
- ✗
Microsoft Purview Information Barriers
Why it's wrong here
Information Barriers restrict communication and collaboration between specific user groups to prevent conflicts of interest. They enforce ethical walls but do not record or retain a searchable log of all user and admin activities. Investigating a past data leak requires an audit log, not a communication restriction mechanism, so Information Barriers is not the appropriate solution.
- ✓
Microsoft Purview Audit
Why this is correct
Microsoft Purview Audit logs and retains user and administrator activities across Microsoft 365 services, including Exchange Online, SharePoint Online, and Microsoft Entra ID. It provides a unified audit log that compliance officers can search to investigate incidents such as data leaks. Standard audit retention is 90 days, which matches the investigation window, making it the correct tool for reviewing activity history.
- ✗
Microsoft Purview Data Loss Prevention
Why it's wrong here
Data Loss Prevention is designed to prevent sensitive information from being shared inappropriately by evaluating content and applying policy actions in real time. It does not provide a historical audit trail of user and admin activities for investigation. While DLP can generate alerts, it is not the primary solution for searching past activity across multiple services like Exchange Online, SharePoint Online, and Entra ID.
Go deeper
Related to this question
Learn chapter
Azure Blueprints for Compliance
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.