SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A legal team is preparing for a lawsuit and needs to perform a detailed investigation of user activities across Microsoft 365 services. They need to view the 'before' and 'after' values whenever a critical item in SharePoint or Exchange is updated or deleted. The investigation requires high-volume export performance and the ability to search by specific activities like 'MailboxFolderAccess' and 'Send'. Which Microsoft Purview solution should be enabled and configured to meet these advanced auditing requirements?
⚠ Common exam trap
Candidates often confuse Audit (Standard) with Audit (Premium), assuming Standard logs all details, but Standard only records basic metadata without before/after values or high-volume export, which are exclusive to Premium.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Premium)
Microsoft Purview Audit (Premium) is required because it captures detailed 'before' and 'after' values for critical updates and deletions in SharePoint and Exchange, supports high-volume export performance, and allows searching for specific activities like 'MailboxFolderAccess' and 'Send'. These capabilities go beyond the Standard audit log, which only records basic event metadata without the old/new values and lacks the advanced search and export throughput needed for litigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Audit (Premium)
Why this is correct
Microsoft Purview Audit (Premium) is the correct choice because it provides the advanced auditing capabilities essential for a comprehensive legal investigation. It offers extended retention of audit logs, high-volume export functionality, and crucially, detailed logging of 'before' and 'after' values for specific activities. This granular detail allows legal teams to perform deep forensic analysis of user actions and content changes, providing irrefutable evidence for a lawsuit.
- ✗
Microsoft Purview Audit (Standard)
Why it's wrong here
Microsoft Purview Audit (Standard) provides basic activity logging but is insufficient for the comprehensive forensic investigation required for a lawsuit. Its main limitations include a shorter audit log retention period of only 90 days and the absence of detailed 'before and after' property values for audited events. This lack of historical depth and granular change tracking makes it inadequate for deep forensic analysis and detailed evidence gathering.
When this WOULD be correct
A question that asks for a basic auditing solution to meet compliance requirements for logging user sign-ins and file access events, without needing detailed change tracking or high-volume export, would have Audit (Standard) as the correct answer.
- ✗
Microsoft Purview eDiscovery (Standard)
Why it's wrong here
Microsoft Purview eDiscovery (Standard) is designed for searching, preserving, and exporting content relevant to legal cases or investigations. While vital for a lawsuit, it primarily deals with the discovery and collection of static content like documents and emails. It does not provide the detailed, chronological audit logs of specific user actions, such as who modified a document at what exact time with before/after values, which are critical for a deep forensic investigation.
When this WOULD be correct
A legal team needs to search for and export specific documents and emails across Exchange, SharePoint, and OneDrive as part of a litigation hold, without needing detailed audit logs of user activities. They require basic search and export functionality for content preservation.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management focuses on configuring retention and deletion policies for content across an organization. Its primary function is to ensure data is kept for compliance periods and then appropriately disposed of, rather than providing a detailed, forensic audit trail of user activities. It manages the lifecycle of data itself, not the granular actions performed by users on that data for investigative purposes.
When this WOULD be correct
An organization needs to automatically retain SharePoint and Exchange content for a specific period (e.g., 7 years) to comply with regulatory requirements, and then delete it. They do not need detailed audit logs or investigation capabilities.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview Audit (Premium)Correct answer▾
Why this is correct
Microsoft Purview Audit (Premium) is the correct choice because it provides the advanced auditing capabilities essential for a comprehensive legal investigation. It offers extended retention of audit logs, high-volume export functionality, and crucially, detailed logging of 'before' and 'after' values for specific activities. This granular detail allows legal teams to perform deep forensic analysis of user actions and content changes, providing irrefutable evidence for a lawsuit.
✗Microsoft Purview Audit (Standard)Wrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Audit (Standard) does not provide the 'before' and 'after' values for updates or deletions, nor does it support high-volume export or search by specific activities like 'MailboxFolderAccess' and 'Send'. These advanced capabilities require Audit (Premium).
★ When this WOULD be the correct answer
A question that asks for a basic auditing solution to meet compliance requirements for logging user sign-ins and file access events, without needing detailed change tracking or high-volume export, would have Audit (Standard) as the correct answer.
Why candidates choose this
Candidates may assume that any auditing solution can capture detailed activity logs, not realizing that the 'before' and 'after' values and advanced search capabilities are exclusive to the Premium tier.
✗Microsoft Purview eDiscovery (Standard)Wrong answer — click to see why▾
Why this is wrong here
Microsoft Purview eDiscovery (Standard) is designed for content search and export for legal cases, not for detailed activity auditing with 'before' and 'after' values or high-volume export of audit logs. The question specifically requires auditing capabilities (viewing changes, searching specific activities), which are provided by Audit (Premium), not eDiscovery.
★ When this WOULD be the correct answer
A legal team needs to search for and export specific documents and emails across Exchange, SharePoint, and OneDrive as part of a litigation hold, without needing detailed audit logs of user activities. They require basic search and export functionality for content preservation.
Why candidates choose this
Candidates may confuse eDiscovery with auditing because both are used in legal investigations, and eDiscovery can export data, but they overlook that the question focuses on activity logging (before/after values, specific activities) rather than content search.
✗Microsoft Purview Data Lifecycle ManagementWrong answer — click to see why▾
Why this is wrong here
Data Lifecycle Management focuses on retaining or deleting data based on policies, not on detailed auditing of user activities or viewing before/after values for updates/deletions. It does not provide the high-volume export or specific activity search capabilities required for the legal investigation.
★ When this WOULD be the correct answer
An organization needs to automatically retain SharePoint and Exchange content for a specific period (e.g., 7 years) to comply with regulatory requirements, and then delete it. They do not need detailed audit logs or investigation capabilities.
Why candidates choose this
Candidates may confuse data lifecycle management with audit because both involve managing data, but lifecycle management is about retention and deletion policies, not about recording and searching user activities for forensic investigation.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Event
An event is any identifiable occurrence or action in a computer system, network, or application that can be logged, monitored, or analyzed for security or operational purposes.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.