SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A multinational corporation wants to ensure that its data handling practices comply with GDPR when processing personal data of European Union citizens. The compliance team is reviewing the concept of data residency. Which statement accurately describes data residency?
⚠ Common exam trap
It's easy for candidates to confuse data residency with data sovereignty or data portability; residency specifically concerns the physical storage location, not legal rights or transferability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data residency refers to the physical or geographic location where data is stored.
Data residency is about the geographic location where data is stored. For GDPR compliance, organizations may need to ensure that personal data of EU citizens remains within certain regions. The other options describe data subject rights, encryption, and data portability, which are related but distinct compliance concepts. Understanding data residency helps in designing compliant cloud architectures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data residency refers to the legal right of individuals to access their personal data.
Why it's wrong here
This describes data subject rights, such as the right of access under GDPR, not data residency. Data residency is about where data is stored geographically. While both are compliance concepts, the corporation is specifically asking about data residency, which concerns storage location, not individual rights. Confusing these terms could lead to incorrect compliance measures.
- ✓
Data residency refers to the physical or geographic location where data is stored.
Why this is correct
Data residency specifically refers to the geographic location where data is stored, which is crucial for compliance with regulations like GDPR that may require data to remain within certain jurisdictions. In this scenario, understanding data residency helps the corporation ensure that EU citizen data is stored in appropriate regions. This definition aligns with Microsoft compliance offerings that allow customers to choose data residency locations.
- ✗
Data residency refers to the ability to move data freely between cloud providers.
Why it's wrong here
Data portability is the ability to move data between providers, often a compliance requirement, but it is not data residency. Data residency focuses on the location where data is stored, not the ability to transfer it. This option describes a different concept, data portability, which could be confused with residency but is distinct.
- ✗
Data residency refers to the process of encrypting data to protect it from unauthorized access.
Why it's wrong here
Encryption is a security measure for protecting data confidentiality, not a definition of data residency. Data residency concerns the physical location of data storage. While encryption is important for compliance, it does not address where data is stored. This option misidentifies a security control as a residency concept.
Go deeper
Related to this question
Learn chapter
Microsoft Purview Compliance Portal
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.