SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A healthcare organization uses Microsoft 365 and wants to prevent users from sending emails that contain patient health information (PHI) to external recipients. Which Microsoft Purview solution should they implement?
⚠ Common exam trap
Candidates often confuse Insider Risk Management (which investigates suspicious behavior) with DLP (which proactively prevents data loss), leading them to choose Option C because they think 'insider' implies an employee sending PHI externally.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP)
Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as patient health information (PHI), via email and other channels. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) to automatically block or warn users when they attempt to send such data to external recipients.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management (DLM), previously known as Information Governance, focuses on managing the entire lifecycle of an organization's data from creation to disposition. It uses retention policies and labels to automatically retain data for specific periods or delete it when no longer needed, ensuring compliance with regulatory requirements. However, DLM's primary function is not to prevent the real-time sharing of sensitive information, but rather to govern its storage duration and eventual deletion.
When this WOULD be correct
Data Lifecycle Management would be correct if the question asked about automatically archiving or deleting emails containing PHI after a specified retention period, or about managing the lifecycle of sensitive data to meet regulatory requirements.
- ✓
Data Loss Prevention (DLP)
Why this is correct
Microsoft 365 Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. These policies leverage sensitive information types, labels, or keywords to detect data such as patient records or financial details. Upon detection, DLP can automatically block sharing, warn users with policy tips, or encrypt content, thereby preventing accidental or malicious data exfiltration in real-time.
- ✗
Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management is designed to detect, investigate, and act on risky activities by users within an organization, such as data theft, data leaks, or policy violations. It leverages machine learning to identify patterns of potentially malicious or inadvertent insider activity across various signals. While it can identify risky sharing behaviors and provide alerts, its core function is risk assessment and investigation, not the direct, real-time enforcement of data sharing restrictions like a DLP policy would.
When this WOULD be correct
A question might ask: 'An organization wants to detect and investigate potential data exfiltration by employees who may be copying sensitive files to personal cloud storage. Which solution should they use?' In that scenario, Insider Risk Management would be correct.
- ✗
eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery tools are primarily utilized for identifying, preserving, collecting, processing, reviewing, and exporting electronic data in response to legal or regulatory investigations. While crucial for compliance and litigation, eDiscovery is a reactive process focused on data retrieval and analysis *after* an event, rather than proactively preventing the unauthorized sharing or loss of sensitive data in real-time. It does not enforce sharing restrictions or real-time content inspection.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Data Loss Prevention (DLP)Correct answer▾
Why this is correct
Microsoft 365 Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams. These policies leverage sensitive information types, labels, or keywords to detect data such as patient records or financial details. Upon detection, DLP can automatically block sharing, warn users with policy tips, or encrypt content, thereby preventing accidental or malicious data exfiltration in real-time.
✗Data Lifecycle ManagementWrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management focuses on retaining and deleting data based on policies, not on preventing data from being sent externally. It does not inspect or block emails containing sensitive information like PHI.
★ When this WOULD be the correct answer
Data Lifecycle Management would be correct if the question asked about automatically archiving or deleting emails containing PHI after a specified retention period, or about managing the lifecycle of sensitive data to meet regulatory requirements.
Why candidates choose this
Candidates may confuse lifecycle management with data protection, thinking that managing data retention also prevents data leaks, or they may assume that any solution with 'management' in the name handles data security broadly.
✗Insider Risk ManagementWrong answer — click to see why▾
Why this is wrong here
Insider Risk Management focuses on identifying, investigating, and acting on risky user activities (e.g., data theft or policy violations), not on preventing the sending of emails containing PHI to external recipients. The specific requirement to block outbound emails with sensitive data is a Data Loss Prevention (DLP) function.
★ When this WOULD be the correct answer
A question might ask: 'An organization wants to detect and investigate potential data exfiltration by employees who may be copying sensitive files to personal cloud storage. Which solution should they use?' In that scenario, Insider Risk Management would be correct.
Why candidates choose this
Candidates may confuse Insider Risk Management with DLP because both deal with data protection and insider threats, but they serve different purposes: DLP prevents data loss, while Insider Risk Management detects risky behavior after the fact.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Data Loss Prevention
Data Loss Prevention (DLP) is a set of tools and processes that help organizations stop sensitive information from being shared, leaked, or stolen, whether accidentally or on purpose.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.