SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A financial services organization needs to prevent communication between its research analysts and investment bankers to comply with regulatory requirements. Which Microsoft Purview solution should the compliance team implement?
⚠ Common exam trap
Microsoft often tests the distinction between DLP and Information Barriers, where candidates mistakenly choose DLP because they think preventing communication is about protecting data, but DLP does not restrict person-to-person communication—it only restricts data sharing based on content classification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Information Barriers
Information Barriers (IB) in Microsoft Purview is specifically designed to prevent communication and collaboration between certain user groups to comply with regulatory requirements, such as those in financial services that require separation between research analysts and investment bankers. IB policies enforce restrictions on Microsoft Teams, SharePoint, and OneDrive to block unauthorized communication and file sharing, directly addressing the need to avoid conflicts of interest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
Data Loss Prevention (DLP) policies in Microsoft Purview are engineered to identify, monitor, and automatically protect sensitive information across various locations. While DLP can prevent the *sharing* of specific sensitive data types outside or inside an organization, it does not inherently block all communication or collaboration between entire user segments. Its focus is on data content, not on restricting the fundamental ability of groups to communicate with each other.
When this WOULD be correct
DLP would be correct if the question asked about preventing sensitive financial data (e.g., insider trading tips) from being shared via email or chat between these groups. For example: 'The compliance team needs to block emails containing confidential client data from being sent between departments.'
- ✓
Information Barriers
Why this is correct
Information Barriers, a feature within Microsoft Purview, are designed to prevent specific groups of users from communicating or collaborating with each other. This is crucial for organizations like financial services firms to establish 'ethical walls' between departments, such as analysts and bankers, ensuring regulatory compliance and preventing conflicts of interest. These policies restrict communication channels like Microsoft Teams chats, calls, and SharePoint site access, directly addressing the need to prevent communication.
- ✗
Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management (DLM) within Microsoft Purview focuses on managing the retention, deletion, and disposition of organizational data throughout its lifecycle. DLM policies ensure compliance by retaining data for specified periods and securely deleting it when no longer needed, supporting records management and data governance. This functionality is entirely distinct from real-time communication controls, as it governs the lifespan of data rather than preventing user-to-user interaction.
When this WOULD be correct
A question asks: 'A healthcare organization needs to automatically delete patient records after 7 years to comply with HIPAA retention requirements. Which Microsoft Purview solution should they use?' In that scenario, Data Lifecycle Management would be correct.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery tools are primarily used for searching, preserving, and exporting electronic content in response to legal or regulatory investigations. These tools enable organizations to identify relevant data from mailboxes, documents, and Teams conversations for litigation or internal inquiries. However, eDiscovery is a reactive process for data retrieval and analysis, and it offers no capabilities to proactively prevent or restrict communication between user groups.
When this WOULD be correct
A law firm needs to search for and export all emails related to a specific client matter for a legal hold. The compliance team should implement Microsoft Purview eDiscovery to identify and preserve relevant data across Exchange, SharePoint, and Teams.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Information BarriersCorrect answer▾
Why this is correct
Information Barriers, a feature within Microsoft Purview, are designed to prevent specific groups of users from communicating or collaborating with each other. This is crucial for organizations like financial services firms to establish 'ethical walls' between departments, such as analysts and bankers, ensuring regulatory compliance and preventing conflicts of interest. These policies restrict communication channels like Microsoft Teams chats, calls, and SharePoint site access, directly addressing the need to prevent communication.
✗Data Loss Prevention (DLP)Wrong answer — click to see why▾
Why this is wrong here
Data Loss Prevention (DLP) is designed to prevent unauthorized sharing of sensitive data, not to block communication between specific groups of users. The requirement is to prevent communication between research analysts and investment bankers, which is a classic information barrier scenario, not a data protection issue.
★ When this WOULD be the correct answer
DLP would be correct if the question asked about preventing sensitive financial data (e.g., insider trading tips) from being shared via email or chat between these groups. For example: 'The compliance team needs to block emails containing confidential client data from being sent between departments.'
Why candidates choose this
Candidates may confuse preventing communication with preventing data leaks, assuming DLP can block all forms of information flow between groups. They might think DLP policies can restrict communication channels, but DLP focuses on content inspection, not user-to-user communication blocking.
✗Data Lifecycle ManagementWrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management governs retention and deletion of data based on policies, but it does not restrict communication between users or groups. The question requires preventing communication between analysts and bankers, which is a real-time access control need, not a data retention policy.
★ When this WOULD be the correct answer
A question asks: 'A healthcare organization needs to automatically delete patient records after 7 years to comply with HIPAA retention requirements. Which Microsoft Purview solution should they use?' In that scenario, Data Lifecycle Management would be correct.
Why candidates choose this
Candidates may confuse 'managing data over its lifecycle' with 'controlling data access or flow,' assuming that lifecycle policies can also restrict communication, or they may think DLM includes broader security controls.
✗Microsoft Purview eDiscoveryWrong answer — click to see why▾
Why this is wrong here
eDiscovery is used for identifying, preserving, and exporting electronic content for legal or investigative purposes, not for preventing communication between groups. It does not enforce real-time communication restrictions.
★ When this WOULD be the correct answer
A law firm needs to search for and export all emails related to a specific client matter for a legal hold. The compliance team should implement Microsoft Purview eDiscovery to identify and preserve relevant data across Exchange, SharePoint, and Teams.
Why candidates choose this
Candidates may confuse eDiscovery with compliance solutions that restrict communication, or assume that any regulatory compliance need involves legal discovery processes.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Collaboration
Collaboration in Microsoft 365 refers to the integrated tools and services that enable people to work together in real time, share information, and coordinate tasks from anywhere.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.