SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A financial services firm must comply with regulatory requirements that mandate supervisory review of communications between advisors and clients. They need to automatically capture emails and Microsoft Teams messages from a specific group of advisors, assign them to a supervisor for review, and flag messages containing potential code words for insider trading. Which Microsoft Purview solution should they use?
⚠ Common exam trap
It's easy for candidates to confuse the 'capture and review communications' requirement with Insider Risk Management (Option D), which focuses on behavioral analytics and risk scoring rather than direct communication capture and keyword-based flagging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Communication Compliance
Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to capture and review communications (email, Teams messages) for regulatory compliance, such as supervisory oversight of advisor-client interactions. It can automatically flag messages containing sensitive keywords or patterns (e.g., potential code words for insider trading) and route them to designated supervisors for review, meeting the firm's regulatory mandate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management primarily focuses on managing the retention and deletion of data across Microsoft 365 services to meet regulatory or organizational requirements. While crucial for compliance with data retention laws, it lacks the capabilities for proactive content analysis, supervisory review workflows, or flagging specific communication patterns indicative of policy violations like insider trading. Its purpose is data governance over time, not real-time communication monitoring.
- ✓
Microsoft Purview Communication Compliance
Why this is correct
Microsoft Purview Communication Compliance is specifically designed to help organizations detect, investigate, and remediate policy violations in communications. It leverages machine learning and customizable dictionaries to identify problematic content, such as potential insider trading code words, across various communication channels. This solution provides a structured workflow for supervisory review, allowing designated personnel to examine flagged messages, assign them for further investigation, and take appropriate action, directly addressing the need for content flagging and review.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection (MIP) is a solution for classifying, labeling, and protecting sensitive data wherever it resides or travels. It applies sensitivity labels to documents and emails, enforcing encryption, access restrictions, or visual markings. While essential for data security and preventing unauthorized access, MIP does not offer the necessary capabilities for ongoing supervisory review of communication content or the detection of specific policy violations within message streams. Its primary function is data protection, not communication oversight.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management focuses on identifying and mitigating potential insider risks, such as data exfiltration, intellectual property theft, or policy violations, by correlating user activities across various Microsoft 365 services. While it can detect suspicious behavioral patterns, it is not primarily designed for the granular, content-level supervisory review of specific client-advisor communications to flag terms like "insider trading code words." Its strength lies in behavioral analytics and risk scoring, rather than direct communication content compliance review workflows.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.