SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A compliance officer needs to investigate a potential data exfiltration incident. They must search the unified audit log for all activities where users accessed a specific sensitive SharePoint site in the last 7 days. Additionally, they need to create a custom alert that triggers when more than 10 file downloads occur from that site within an hour. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Candidates often confuse the investigative and alerting capabilities of Audit (Standard) with the preventive controls of DLP, assuming DLP can retroactively search logs or create threshold-based alerts, when in fact DLP only applies real-time policies to content in transit or at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Standard)
Microsoft Purview Audit (Standard) logs all user activities, including file accesses and downloads from SharePoint sites, for 90 days. The compliance officer can search the unified audit log for the specific site's activities over the last 7 days and create custom alert policies (e.g., threshold-based alerts for >10 downloads per hour) using the Microsoft 365 Defender portal. This makes Audit (Standard) the correct solution for both investigation and alerting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Audit (Standard)
Why this is correct
Microsoft Purview Audit (Standard) provides access to the unified audit log, enabling organizations to search for user and administrator activities across various Microsoft 365 services, including SharePoint Online. This service allows compliance officers to investigate past events, such as unusual file downloads, and to create custom alert policies based on specific activity patterns or thresholds. Its capability to search historical audit data and configure alerts for suspicious behaviors directly addresses the need for both investigation and proactive monitoring.
- ✗
Microsoft Purview Data Loss Prevention (DLP)
Why it's wrong here
DLP policies are designed to prevent accidental or intentional data loss by blocking or warning about sensitive data sharing, but they do not provide a searchable log of past activities with custom alert rules for audit events.
When this WOULD be correct
A question asks: 'An organization needs to prevent users from sharing credit card numbers via email. Which Microsoft Purview solution should they use?' In that scenario, DLP would be correct because it can detect and block sensitive data in transit.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery (Standard and Premium) is primarily designed for legal and regulatory investigations, focusing on identifying, preserving, collecting, and exporting electronic content for litigation. While it can search for content, its core function is not to provide real-time monitoring or generate alerts based on audit log activity patterns like a spike in file downloads. eDiscovery is a reactive tool for litigation support, not a proactive audit log analysis and alerting system.
When this WOULD be correct
A legal team needs to identify and preserve all documents containing specific keywords from a SharePoint site as part of a litigation hold. They must search across mailboxes, sites, and Teams for relevant content and export it for review. In this case, Microsoft Purview eDiscovery would be the correct solution.
- ✗
Microsoft Purview Communications Compliance
Why it's wrong here
Microsoft Purview Communications Compliance is specifically engineered to help organizations detect, investigate, and act on inappropriate messages within communication channels like Microsoft Teams, Exchange email, and Yammer. It focuses on identifying policy violations in the *content* of communications, such as harassment or sharing of sensitive information. This service does not offer general audit log search capabilities or the ability to create alerts based on file activity events, like SharePoint file downloads.
When this WOULD be correct
A question asking which solution monitors employee communications (e.g., email, Teams) for inappropriate language, sensitive information sharing, or regulatory compliance (e.g., FINRA, SEC rules) would make Communications Compliance the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview Audit (Standard)Correct answer▾
Why this is correct
Microsoft Purview Audit (Standard) provides access to the unified audit log, enabling organizations to search for user and administrator activities across various Microsoft 365 services, including SharePoint Online. This service allows compliance officers to investigate past events, such as unusual file downloads, and to create custom alert policies based on specific activity patterns or thresholds. Its capability to search historical audit data and configure alerts for suspicious behaviors directly addresses the need for both investigation and proactive monitoring.
✗Microsoft Purview Data Loss Prevention (DLP)Wrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Data Loss Prevention (DLP) is designed to prevent data exfiltration by enforcing policies on sensitive data, not to investigate past incidents or create alerts based on activity thresholds from the unified audit log.
★ When this WOULD be the correct answer
A question asks: 'An organization needs to prevent users from sharing credit card numbers via email. Which Microsoft Purview solution should they use?' In that scenario, DLP would be correct because it can detect and block sensitive data in transit.
Why candidates choose this
Candidates may confuse DLP's data protection capabilities with audit and alerting, assuming DLP can both monitor and alert on download activities, but DLP focuses on policy enforcement rather than historical investigation and custom alert rules.
✗Microsoft Purview eDiscoveryWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview eDiscovery is designed for legal investigations and content searches across data sources, not for real-time monitoring of user activities or creating custom alerts based on download thresholds from the unified audit log.
★ When this WOULD be the correct answer
A legal team needs to identify and preserve all documents containing specific keywords from a SharePoint site as part of a litigation hold. They must search across mailboxes, sites, and Teams for relevant content and export it for review. In this case, Microsoft Purview eDiscovery would be the correct solution.
Why candidates choose this
Candidates may confuse eDiscovery's ability to search audit logs and content with the real-time alerting and investigation capabilities of Audit, especially when the question involves searching for user activities and setting thresholds.
✗Microsoft Purview Communications ComplianceWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Communications Compliance is designed to monitor and manage internal and external communications for regulatory compliance, not to investigate data exfiltration via audit logs or create alerts based on file download thresholds from SharePoint.
★ When this WOULD be the correct answer
A question asking which solution monitors employee communications (e.g., email, Teams) for inappropriate language, sensitive information sharing, or regulatory compliance (e.g., FINRA, SEC rules) would make Communications Compliance the correct answer.
Why candidates choose this
Candidates may confuse 'compliance' with general compliance tasks like investigating incidents, or think Communications Compliance covers all compliance-related monitoring including data exfiltration.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.