SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization must comply with HIPAA regulations. They need to automatically detect and classify sensitive health information such as medical record numbers stored in SharePoint Online and OneDrive. When detected, the solution should apply encryption and restrict access to only authorized personnel. Which Microsoft Purview solution should they configure?
⚠ Common exam trap
Watch out — candidates often confuse Data Lifecycle Management (retention/deletion) with Information Protection (classification/encryption), or assume Audit/eDiscovery can enforce access controls, when they only provide logging or search capabilities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Information Protection
Microsoft Purview Information Protection (specifically sensitivity labels and auto-labeling policies) can automatically detect sensitive health information like medical record numbers using built-in sensitive information types (e.g., U.S. HIPAA-defined types). When detected, it can apply encryption via Rights Management and restrict access to authorized personnel, meeting HIPAA compliance requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Information Protection
Why this is correct
Microsoft Purview Information Protection (MIP) is the correct solution because it enables organizations to discover, classify, label, and protect sensitive data, including Protected Health Information (PHI) relevant to HIPAA. Sensitivity labels can be applied manually or automatically based on content inspection (e.g., detecting medical record numbers or other sensitive info types), enforcing encryption, visual markings, and access restrictions. This ensures that data is protected at rest and in transit, aligning directly with HIPAA's security rule requirements for safeguarding electronic PHI.
- ✗
Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management (DLM) in Microsoft Purview primarily addresses the retention and deletion of content over its lifespan, ensuring compliance with regulatory requirements for data longevity or disposal. While crucial for managing data sprawl and meeting specific retention mandates, DLM does not inherently provide mechanisms for automatic classification of sensitive data or the application of protective measures like encryption and access controls, which are essential for immediate data security.
When this WOULD be correct
A question asking which Microsoft Purview solution to use for automatically retaining healthcare records for a specific period (e.g., 6 years) to meet HIPAA retention requirements, then deleting them afterward.
- ✗
Audit
Why it's wrong here
Microsoft Purview Audit (Standard/Premium) provides comprehensive logging of user and administrator activities across Microsoft 365 services, enabling organizations to conduct forensic investigations and meet regulatory compliance requirements for accountability. While essential for monitoring and detecting suspicious behavior, Audit is a logging and reporting service. It does not possess the functionality to automatically classify sensitive data or apply protective controls such as encryption and permissions to safeguard data at rest or in transit.
When this WOULD be correct
A company needs to track who accessed sensitive documents in SharePoint and OneDrive for compliance reporting. They want to see a history of actions like viewing, editing, or sharing files. In this scenario, Audit would be the correct solution.
- ✗
eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery solutions are designed to identify, preserve, collect, process, review, and produce electronically stored information (ESI) for legal or investigative purposes. It enables organizations to place content on legal hold and search across various data sources, but it is a reactive tool for litigation support. eDiscovery does not offer proactive capabilities for automatically classifying sensitive data or applying protective measures like encryption and access controls to prevent unauthorized access in the first place.
When this WOULD be correct
An organization needs to search for and export content related to a legal case or regulatory investigation, such as finding all emails and documents mentioning a specific patient's medical record number across Exchange Online and SharePoint.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Information ProtectionCorrect answer▾
Why this is correct
Microsoft Purview Information Protection (MIP) is the correct solution because it enables organizations to discover, classify, label, and protect sensitive data, including Protected Health Information (PHI) relevant to HIPAA. Sensitivity labels can be applied manually or automatically based on content inspection (e.g., detecting medical record numbers or other sensitive info types), enforcing encryption, visual markings, and access restrictions. This ensures that data is protected at rest and in transit, aligning directly with HIPAA's security rule requirements for safeguarding electronic PHI.
✗Data Lifecycle ManagementWrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management focuses on retaining or deleting data based on policies (e.g., retention labels), not on detecting, classifying, or protecting sensitive health information like medical record numbers.
★ When this WOULD be the correct answer
A question asking which Microsoft Purview solution to use for automatically retaining healthcare records for a specific period (e.g., 6 years) to meet HIPAA retention requirements, then deleting them afterward.
Why candidates choose this
Candidates may confuse lifecycle management with protection because both involve labels, and they might think managing data includes security controls like encryption.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit logs user and admin activities but does not detect, classify, or protect sensitive data like medical records. The question requires automatic detection, classification, encryption, and access restriction, which are capabilities of Information Protection, not Audit.
★ When this WOULD be the correct answer
A company needs to track who accessed sensitive documents in SharePoint and OneDrive for compliance reporting. They want to see a history of actions like viewing, editing, or sharing files. In this scenario, Audit would be the correct solution.
Why candidates choose this
Candidates may think Audit is needed to monitor compliance with HIPAA, but they overlook that the primary requirement is proactive data protection (detection, classification, encryption) rather than just logging activities.
✗eDiscoveryWrong answer — click to see why▾
Why this is wrong here
eDiscovery is used for searching and exporting content for legal or investigative purposes, not for automatically detecting, classifying, and protecting sensitive data like medical records.
★ When this WOULD be the correct answer
An organization needs to search for and export content related to a legal case or regulatory investigation, such as finding all emails and documents mentioning a specific patient's medical record number across Exchange Online and SharePoint.
Why candidates choose this
Candidates may confuse eDiscovery's search capabilities with the detection and classification features of Information Protection, assuming that searching for sensitive data implies automatic protection.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Labels
Labels are descriptive text or tags attached to IT resources to organize, identify, and manage them based on attributes like purpose, environment, or owner.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.