SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A multinational corporation must comply with the EU General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) by searching for personal data across Exchange Online, SharePoint Online, and OneDrive for Business. Which Microsoft Purview solution should they use?
⚠ Common exam trap
The trap is confusing preventive controls (DLP) or retention controls (Data Lifecycle Management) with the investigative search-and-collect capability that only eDiscovery (Premium) provides for DSAR responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
eDiscovery (Premium)
Microsoft Purview eDiscovery (Premium) provides the Content Search, case management, custodian, and review-set capabilities needed to locate and export personal data across Exchange Online, SharePoint Online, OneDrive for Business, and Teams for a DSAR response. It is the only Purview workload designed specifically for identifying and collecting responsive content across Microsoft 365 workloads at scale.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Lifecycle Management
Why it's wrong here
Data Lifecycle Management applies retention and deletion rules to content, and cannot locate or export a data subject's personal data. It is tempting because retention labels also span Exchange Online, SharePoint Online and OneDrive for Business, but DSAR fulfilment requires eDiscovery search and review rather than lifecycle policy.
- ✗
Audit (Premium)
Why it's wrong here
Audit (Premium) retains and surfaces user and admin activity events for investigation; it holds no mechanism for locating personal data stored inside items. It is tempting because both support GDPR compliance reporting, yet a DSAR needs content-level search across Exchange Online, SharePoint Online and OneDrive for Business.
- ✓
eDiscovery (Premium)
Why this is correct
eDiscovery (Premium) supports custodian-based search across Exchange Online, SharePoint Online and OneDrive for Business, with review sets and export for DSAR responses. It satisfies the cross-workload search requirement that core eDiscovery handles less comprehensively for GDPR requests.
- ✗
Data Loss Prevention (DLP)
Why it's wrong here
DLP detects and blocks sensitive information flows using policy rules and conditions; it cannot search mailboxes, sites and OneDrive accounts for a named individual's personal data. It is tempting because DLP also works across those same workloads, but DSAR response requires Content Search or eDiscovery case search.
Go deeper
Related to this question
Learn chapter
Records Management in Microsoft Purview
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.