SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Customer Lockbox

  Why this is correct

  Customer Lockbox for Microsoft 365 provides an explicit, auditable workflow for customer approval when a Microsoft engineer needs to access customer content to resolve a support issue. This feature ensures that no Microsoft support personnel can gain access to customer data without the customer's designated approver, such as a compliance officer, granting explicit permission for each specific access request. It directly addresses the requirement for a financial institution to control and approve any potential access to their sensitive data by external parties, including Microsoft support.

• ✗

  Communication Compliance

  Why it's wrong here

  Communication Compliance in Microsoft Purview is designed to help organizations detect, investigate, and act on inappropriate messages in their internal and external communications. It uses machine learning to identify potential policy violations, such as harassment, sensitive information sharing, or regulatory non-compliance, across platforms like Exchange, Teams, and Viva Engage. However, its scope is limited to monitoring user-generated content and does not provide any mechanism to control or approve Microsoft support personnel's access to customer data.

  When this WOULD be correct

  A company needs to monitor employee emails and Microsoft Teams messages for regulatory compliance (e.g., FINRA, SEC) and flag potential policy breaches for review by a compliance officer.

• ✗

  Insider Risk Management

  Why it's wrong here

  Insider Risk Management in Microsoft Purview leverages machine learning and analytics to identify and mitigate potential data security risks originating from within an organization. It monitors user activities, such as data exfiltration, policy violations, or suspicious file access, to detect malicious or inadvertent insider threats. While crucial for protecting sensitive data from internal actors, this solution is not designed to govern or restrict access requests made by Microsoft support engineers to customer environments.

  When this WOULD be correct

  An organization wants to identify and investigate potential data theft by employees who are copying sensitive files to personal cloud storage. Insider Risk Management would be correct for detecting such insider threats.

• ✗

  Data Lifecycle Management

  Why it's wrong here

  Data Lifecycle Management (DLM), often implemented through Microsoft Purview Data Lifecycle Management, focuses on managing the retention and deletion of data across an organization's digital estate according to regulatory requirements and internal policies. It ensures that data is kept for the necessary duration and then appropriately disposed of, minimizing storage costs and compliance risks. However, DLM's function is solely about data retention and deletion policies, and it offers no capabilities to control or approve external access requests to that data.

  When this WOULD be correct

  An organization needs to automatically retain emails for 7 years and then delete them to comply with regulatory requirements. Data Lifecycle Management would be configured to apply retention labels and policies for this purpose.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question