SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization must comply with HIPAA. They need to automatically detect protected health information (PHI) in emails sent from Exchange Online, prevent users from sharing these emails with unauthorized external recipients, and apply a retention label that retains PHI emails for six years. Which Microsoft Purview solution should they configure?
⚠ Common exam trap
A common mix-up: candidates confuse Communication Compliance (which monitors for policy violations) with DLP (which enforces data protection actions), or assume eDiscovery handles retention and blocking, when in fact DLP is the only solution that combines detection, prevention, and retention label application in a single policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Information Protection and Data Loss Prevention
Microsoft Purview Information Protection and Data Loss Prevention (DLP) is the correct solution because it combines sensitive data classification (to detect PHI via built-in HIPAA data classifiers) with policy-based enforcement (to block sharing with unauthorized external recipients) and can automatically apply a retention label (via auto-labeling policies) to retain PHI emails for six years. This directly addresses all three requirements: detection, prevention, and retention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Information Protection and Data Loss Prevention
Why this is correct
Microsoft Purview Information Protection enables organizations to discover, classify, and protect sensitive data like Protected Health Information (PHI) through sensitivity labels, which can automatically apply encryption or visual markings. Concurrently, Microsoft Purview Data Loss Prevention (DLP) policies leverage these classifications to detect and prevent unauthorized sharing or transfer of PHI across various locations, including email, SharePoint, and Teams. This combined approach ensures data is appropriately handled, retained, and safeguarded against exfiltration, directly addressing HIPAA's privacy and security requirements.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery tools are primarily designed for identifying, preserving, collecting, and reviewing electronically stored information (ESI) for legal holds, investigations, or regulatory audits. While essential for demonstrating compliance post-incident or during litigation, eDiscovery does not provide proactive capabilities for automatically classifying content, applying retention labels based on data sensitivity, or preventing the initial unauthorized sharing of sensitive data in real-time. Its focus is on discovery and production, not preventative data governance.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is engineered to help organizations detect and act on policy violations within internal and external communications, such as harassment, offensive language, or regulatory compliance breaches like insider trading. While it can identify instances where sensitive information might have been shared inappropriately, it operates primarily as a monitoring and alerting solution. It does not automatically classify data, apply retention labels, or proactively block outbound emails containing sensitive information before they are sent.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management is designed to identify, triage, and act on risky activities by users that could lead to data theft, data leakage, or other security incidents. It correlates user activity signals across Microsoft 365 services to detect patterns indicative of insider threats, such as unusual download volumes or access to sensitive files. However, this solution focuses on user behavior analytics and risk scoring, rather than automatically classifying content, enforcing data retention policies, or providing real-time prevention of unauthorized data sharing at the content level.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Protected health information
Protected health information (PHI) is any health data that can identify an individual and is subject to strict privacy and security regulations.
Key term
Data classification
Data classification is the process of organizing data into categories based on its sensitivity, value, and criticality to an organization, so that appropriate security controls can be applied.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.