SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?
⚠ Common exam trap
Many exam-takers confuse creating assessments (which organize controls) with the actual assignment of remediation tasks, leading them to choose Option A instead of understanding that improvement actions with owners are the mechanism for automatic assignment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure improvement actions with owners
To automatically assign each control to the appropriate team member for remediation in Microsoft Purview Compliance Manager, you must configure improvement actions with owners. Each improvement action can be assigned to a specific user who is responsible for implementing the remediation steps, and this assignment triggers automatic notifications and tracking within the compliance score.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create new assessments for each regulation
Why it's wrong here
Creating new assessments for each regulation in Microsoft Purview Compliance Manager provides a structured framework for evaluating an organization's compliance posture against specific standards like GDPR. While assessments group relevant controls and offer a comprehensive view of requirements, they do not inherently automate the assignment of individual remediation tasks. The actual delegation and tracking of specific actions to team members occur at the granular improvement action level within an assessment.
When this WOULD be correct
A company needs to assess compliance against multiple regulations (e.g., GDPR, ISO 27001) and wants to create separate compliance scorecards for each. In that scenario, creating new assessments for each regulation would be the correct action.
- ✓
Configure improvement actions with owners
Why this is correct
Configuring improvement actions with owners in Microsoft Purview Compliance Manager is the direct mechanism for operationalizing compliance requirements. These actions represent specific tasks derived from controls and regulations, such as implementing a data encryption policy or updating a privacy notice. Assigning an owner ensures accountability, facilitates the delegation of remediation efforts, and enables tracking of progress and evidence submission, directly addressing the need to comply with regulations like GDPR.
- ✗
Set up connectors to import external risk data
Why it's wrong here
Setting up connectors in Microsoft Purview Compliance Manager primarily serves to integrate and import compliance data, signals, or control status from third-party applications or non-Microsoft cloud services. These connectors are valuable for consolidating a holistic view of an organization's compliance posture by bringing in external information. Nevertheless, their function is data ingestion and aggregation, not the direct creation or assignment of actionable improvement tasks to specific owners for remediation within the Microsoft compliance ecosystem.
When this WOULD be correct
In a scenario where an organization wants to integrate risk data from external systems (e.g., vulnerability scanners or third-party risk assessments) into Microsoft Purview Compliance Manager to enhance compliance assessments, configuring connectors would be the correct action.
- ✗
Use the Microsoft 365 admin center to delegate tasks
Why it's wrong here
The Microsoft 365 admin center is designed for broad administrative management of Microsoft 365 services, including user provisioning, license management, and service health monitoring. It serves as a central hub for IT administrators to manage the overall tenant environment. However, it lacks the specialized functionality required for assigning and tracking compliance-specific improvement actions or managing control implementation within the dedicated Microsoft Purview Compliance Manager interface.
When this WOULD be correct
This option would be correct if the question asked about delegating administrative tasks (e.g., assigning roles or permissions) in Microsoft 365, such as assigning a user as a global admin or managing service requests, rather than assigning compliance controls.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Configure improvement actions with ownersCorrect answer▾
Why this is correct
Configuring improvement actions with owners in Microsoft Purview Compliance Manager is the direct mechanism for operationalizing compliance requirements. These actions represent specific tasks derived from controls and regulations, such as implementing a data encryption policy or updating a privacy notice. Assigning an owner ensures accountability, facilitates the delegation of remediation efforts, and enables tracking of progress and evidence submission, directly addressing the need to comply with regulations like GDPR.
✗Create new assessments for each regulationWrong answer — click to see why▾
Why this is wrong here
Creating new assessments for each regulation helps evaluate compliance but does not automatically assign controls to team members for remediation. The question specifically asks for automatic assignment, which requires configuring improvement actions with owners.
★ When this WOULD be the correct answer
A company needs to assess compliance against multiple regulations (e.g., GDPR, ISO 27001) and wants to create separate compliance scorecards for each. In that scenario, creating new assessments for each regulation would be the correct action.
Why candidates choose this
Candidates may think that assessments are the primary tool for managing compliance tasks, so creating new ones seems like a logical step to assign work, but they overlook that assignment is done at the improvement action level.
✗Set up connectors to import external risk dataWrong answer — click to see why▾
Why this is wrong here
Setting up connectors to import external risk data helps bring in risk signals from outside sources, but it does not automatically assign controls to team members for remediation. The question specifically asks about assigning controls to appropriate team members, which is achieved by configuring improvement actions with owners.
★ When this WOULD be the correct answer
In a scenario where an organization wants to integrate risk data from external systems (e.g., vulnerability scanners or third-party risk assessments) into Microsoft Purview Compliance Manager to enhance compliance assessments, configuring connectors would be the correct action.
Why candidates choose this
Candidates may confuse the need to import external data with the assignment process, thinking that external risk data could help identify which team member should handle a control, but the actual assignment mechanism is through improvement action owners.
✗Use the Microsoft 365 admin center to delegate tasksWrong answer — click to see why▾
Why this is wrong here
The Microsoft 365 admin center is used for general administrative tasks like user management and service configuration, not for assigning compliance controls to team members. Compliance Manager's improvement actions with owners is the correct feature for this purpose.
★ When this WOULD be the correct answer
This option would be correct if the question asked about delegating administrative tasks (e.g., assigning roles or permissions) in Microsoft 365, such as assigning a user as a global admin or managing service requests, rather than assigning compliance controls.
Why candidates choose this
Candidates may confuse the Microsoft 365 admin center as a central hub for all management tasks, including compliance, and assume it can handle task delegation for compliance activities.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
GDPR
The General Data Protection Regulation (GDPR) is a European Union law that sets strict rules for how organizations collect, store, process, and protect the personal data of individuals within the EU.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.