SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A financial services organization must prevent employees in the Research department from communicating via email or Microsoft Teams with employees in the Investment Banking department to avoid conflicts of interest. Additionally, they need to prevent any credit card numbers from being shared in emails sent to external recipients. Which combination of Microsoft Purview solutions should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Information Barriers and Data Loss Prevention
Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest (e.g., research vs. investment banking). Data Loss Prevention (DLP) policies detect and protect sensitive information such as credit card numbers from being shared externally. Communication Compliance focuses on monitoring communications for regulatory compliance but does not block communications, and Insider Risk Management analyzes risky user activities but does not enforce segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Information Barriers and Data Loss Prevention
Why this is correct
Information Barriers are essential for preventing unauthorized communication and collaboration between specific user groups, fulfilling the "Chinese Wall" requirement in financial services. Complementing this, Data Loss Prevention (DLP) policies actively detect and prevent the sharing of sensitive information, such as credit card numbers, both internally and externally. Together, these solutions provide robust controls for communication segmentation and sensitive data protection, directly addressing both critical organizational needs.
- ✗
Communication Compliance and Insider Risk Management
Why it's wrong here
Communication Compliance primarily focuses on monitoring and reviewing communications for policy violations, rather than actively blocking interactions between groups or preventing data sharing. Similarly, Insider Risk Management identifies and investigates risky user behaviors and potential data exfiltration, but it does not enforce communication segmentation or directly prevent sensitive data from being shared. These tools are reactive and investigative, failing to provide the proactive prevention required by the scenario.
When this WOULD be correct
An organization needs to detect and investigate employees sharing confidential information (e.g., insider trading tips) via email or Teams, and also identify risky user behavior patterns that may lead to data breaches. Communication Compliance and Insider Risk Management would be the correct combination.
- ✗
Information Barriers and Communication Compliance
Why it's wrong here
While Information Barriers effectively prevent unauthorized communication between defined employee groups, addressing a key requirement, Communication Compliance only monitors communications for policy violations. It does not possess the capability to actively block the sharing of sensitive data, such as credit card numbers, externally. Therefore, this combination lacks the crucial Data Loss Prevention (DLP) component necessary to prevent the actual exfiltration of sensitive financial information.
When this WOULD be correct
An organization needs to monitor employee communications for regulatory compliance (e.g., insider trading) and restrict communication between specific groups (e.g., Research and Investment Banking). The correct answer would be Information Barriers and Communication Compliance.
- ✗
Data Lifecycle Management and Data Loss Prevention
Why it's wrong here
Data Lifecycle Management (DLM) is designed to govern the retention, archiving, and deletion of data throughout its lifecycle, not to establish communication barriers between employee groups. While Data Loss Prevention (DLP) is effective at preventing sensitive data from being shared inappropriately, it cannot, by itself, enforce communication segmentation between departments. This combination fails to address the fundamental need to prevent employees in specific groups from interacting.
When this WOULD be correct
A company needs to automatically delete customer records after 7 years per regulatory requirements and prevent accidental deletion of active records. In that scenario, Data Lifecycle Management (for retention/deletion) combined with Data Loss Prevention (to block unauthorized data exfiltration) would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Information Barriers and Data Loss PreventionCorrect answer▾
Why this is correct
Information Barriers are essential for preventing unauthorized communication and collaboration between specific user groups, fulfilling the "Chinese Wall" requirement in financial services. Complementing this, Data Loss Prevention (DLP) policies actively detect and prevent the sharing of sensitive information, such as credit card numbers, both internally and externally. Together, these solutions provide robust controls for communication segmentation and sensitive data protection, directly addressing both critical organizational needs.
✗Communication Compliance and Insider Risk ManagementWrong answer — click to see why▾
Why this is wrong here
Communication Compliance monitors for policy violations but does not enforce real-time communication blocks between departments, and Insider Risk Management focuses on detecting risky user activities, not preventing credit card data leakage in emails.
★ When this WOULD be the correct answer
An organization needs to detect and investigate employees sharing confidential information (e.g., insider trading tips) via email or Teams, and also identify risky user behavior patterns that may lead to data breaches. Communication Compliance and Insider Risk Management would be the correct combination.
Why candidates choose this
Candidates may confuse Communication Compliance with Information Barriers, thinking it can block communications, and assume Insider Risk Management covers DLP-like data protection, leading to this incorrect pairing.
✗Information Barriers and Communication ComplianceWrong answer — click to see why▾
Why this is wrong here
Communication Compliance monitors communications for policy violations but does not enforce restrictions on communication between specific groups; Information Barriers alone cannot prevent data loss of credit card numbers in emails to external recipients.
★ When this WOULD be the correct answer
An organization needs to monitor employee communications for regulatory compliance (e.g., insider trading) and restrict communication between specific groups (e.g., Research and Investment Banking). The correct answer would be Information Barriers and Communication Compliance.
Why candidates choose this
Candidates may confuse Communication Compliance with Data Loss Prevention, thinking it can prevent data sharing, or assume Information Barriers alone address both internal restrictions and external data loss.
✗Data Lifecycle Management and Data Loss PreventionWrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management (DLM) governs data retention and deletion, not real-time communication restrictions or content scanning for credit card numbers. The question requires both blocking communications between departments (Information Barriers) and preventing credit card data in emails (Data Loss Prevention), which DLM does not address.
★ When this WOULD be the correct answer
A company needs to automatically delete customer records after 7 years per regulatory requirements and prevent accidental deletion of active records. In that scenario, Data Lifecycle Management (for retention/deletion) combined with Data Loss Prevention (to block unauthorized data exfiltration) would be correct.
Why candidates choose this
Candidates may confuse Data Lifecycle Management with Data Loss Prevention due to similar names, or assume that managing data lifecycle includes preventing data leaks, but DLM focuses on retention and disposal, not content inspection or communication restrictions.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Risk management
Risk management is the process of identifying, assessing, and controlling threats to an organization's capital, earnings, and operations, including IT systems and data.
Key term
Collaboration
Collaboration in Microsoft 365 refers to the integrated tools and services that enable people to work together in real time, share information, and coordinate tasks from anywhere.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.