SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization uses Microsoft 365 and must comply with HIPAA regulations. They need to assess their current compliance posture, identify gaps, and implement improvement actions. They want a tool that provides a compliance score based on best practices and regulatory frameworks, and offers recommended actions to improve the score. Which Microsoft Purview solution should they use?
⚠ Common exam trap
SC-900 often tests the distinction between Purview solutions; candidates may confuse Compliance Manager with Insider Risk Management or Audit, but only Compliance Manager provides a compliance score and improvement actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compliance Manager
Microsoft Purview Compliance Manager provides a compliance score based on your configuration against best practices and regulatory frameworks like HIPAA. It offers a centralized dashboard to assess compliance posture, identify gaps, and provides recommended improvement actions with step-by-step guidance. This directly matches the requirement to assess, identify gaps, and implement improvements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Compliance Manager
Why this is correct
Microsoft Purview Compliance Manager is specifically engineered to help organizations manage their compliance posture against various regulatory standards and industry certifications. It provides a dashboard to assess current compliance status, offers actionable recommendations to improve the compliance score, and tracks progress over time. This tool simplifies the complex task of understanding and implementing necessary controls to meet regulatory obligations, such as those relevant to healthcare.
- ✗
Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management focuses on detecting, investigating, and acting on risky activities by internal users that could lead to data leakage, intellectual property theft, or other security incidents. It leverages machine learning to identify unusual or suspicious user behaviors, such as downloading large amounts of sensitive data or accessing restricted files. While crucial for security, its primary function is not to provide a holistic compliance score against external regulatory frameworks but rather to mitigate internal threats.
- ✗
Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is designed to help organizations detect and prevent policy violations in internal and external communications across various Microsoft 365 services like Exchange, Teams, and Yammer. It uses intelligent templates and machine learning to identify content that violates corporate policies or regulatory requirements, such as harassment, discriminatory language, or sharing of sensitive information. Although it supports compliance by enforcing communication policies, it does not assess an organization's overall compliance posture or generate a quantifiable compliance score against specific standards.
- ✗
Audit
Why it's wrong here
Microsoft Purview Audit provides a comprehensive logging service that records user and administrator activities across Microsoft 365 services, including SharePoint, Exchange, and Microsoft Entra ID. These detailed audit logs are invaluable for security investigations, forensic analysis, and demonstrating adherence to specific internal controls or regulatory requirements. However, Audit is a data collection and retention service; it does not actively assess an organization's compliance posture, provide a compliance score, or offer direct recommendations for improving compliance against external standards.
Go deeper
Related to this question
Learn chapter
GDPR, HIPAA, and Global Privacy Laws
Key term
HIPAA
HIPAA is a U.S. law that sets national standards for protecting sensitive patient health information from being disclosed without the patient's consent or knowledge.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
One of 1,279 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.