SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A compliance officer needs to monitor internal emails for inappropriate language and potential data leaks. The officer wants to detect policy violations and allow users to report concerns. Which Microsoft Purview solution should be used?
⚠ Common exam trap
Test-takers frequently confuse Information Protection (which labels and encrypts data) with Communication Compliance (which monitors communications for policy violations), leading them to select option D instead of B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Communication Compliance
Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in internal and external communications, including inappropriate language and potential data leaks. It also provides a built-in mechanism for users to report concerns, aligning directly with the compliance officer's requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is specifically designed to manage the lifecycle of data by applying retention and deletion policies across various data sources. Its primary function is to ensure that data is retained for regulatory, legal, or business requirements and then defensibly disposed of when no longer needed. It does not, however, actively scan or monitor the content of ongoing communications for policy violations or inappropriate conduct.
- ✓
Microsoft Purview Communication Compliance
Why this is correct
Microsoft Purview Communication Compliance is engineered to help organizations detect, investigate, and remediate policy violations in internal and external communications. It leverages machine learning and customizable policies to identify sensitive information, harassment, regulatory non-compliance, or other inappropriate content across platforms like Exchange, Teams, and Viva Engage, providing a robust workflow for review and investigation. This tool directly addresses the need for monitoring communication content.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides a comprehensive logging service that records user and administrator activities across Microsoft 365 services. Its purpose is to offer an immutable record of events, enabling forensic investigations, compliance audits, and security monitoring by tracking who performed what action, when, and from where. While crucial for accountability, it does not proactively analyze the content of communications for policy violations or inappropriate behavior; it merely logs the activity itself.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection (formerly Azure Information Protection) focuses on classifying, labeling, and protecting sensitive information throughout its lifecycle, regardless of where it's stored or shared. It applies encryption, visual markings, and access restrictions based on sensitivity labels to prevent unauthorized access or data leakage. While it protects data, it is not designed to actively monitor the content of ongoing communications for policy breaches or inappropriate conduct within the communication stream itself.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Communication Compliance
Communication Compliance is the set of policies, tools, and practices used by organizations to monitor, capture, and review electronic communications in order to meet regulatory, legal, and internal governance requirements.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.