SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization must comply with HIPAA regulations. They need to classify and protect medical records stored in Microsoft 365. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Many candidates confuse 'Audit' (logging) or 'Data Lifecycle Management' (retention) with data protection, but only Information Protection provides the classification and encryption capabilities required for HIPAA compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection
Microsoft Purview Information Protection (D) is the correct solution because it enables organizations to classify, label, and protect sensitive data—such as medical records—using sensitivity labels and encryption. This directly supports HIPAA compliance by ensuring that protected health information (PHI) is consistently safeguarded across Microsoft 365 services, including Exchange, SharePoint, and OneDrive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit primarily focuses on recording user and administrator activities across Microsoft 365 services. While essential for demonstrating compliance through activity logs and forensic investigations, it does not provide the mechanisms to identify, categorize, or apply protective measures to sensitive data like PHI based on its content or context. Its role is post-classification, verifying actions, not performing the initial data classification required by HIPAA.
- ✗
Microsoft Purview Priva
Why it's wrong here
Microsoft Purview Priva is designed to help organizations manage privacy risks, automate subject rights requests, and assess their overall privacy posture. While HIPAA is a privacy regulation, Priva's core functionality does not include the direct classification of data content to identify Protected Health Information (PHI). It focuses on the management of personal data and privacy operations, rather than the initial identification and labeling of sensitive information itself.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management is utilized for governing the retention and deletion of data, ensuring compliance with regulatory requirements like HIPAA for data longevity. This solution helps manage the entire lifecycle of information, from creation to disposition, but it does not perform the initial classification of data content to identify PHI. Its functions are applied after data has been classified, dictating how long specific types of data should be kept or when it should be securely deleted.
- ✓
Microsoft Purview Information Protection
Why this is correct
Microsoft Purview Information Protection (MIP) is the correct solution because it provides the comprehensive capabilities necessary for data classification and protection, crucial for HIPAA compliance. It enables organizations to discover, classify, and label sensitive data, such as Protected Health Information (PHI), using automated or manual methods. These sensitivity labels can then enforce protective actions like encryption, visual markings, and access restrictions, ensuring PHI is safeguarded throughout its lifecycle.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.