SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A multinational organization must comply with GDPR and local data residency requirements. The compliance team needs to ensure that personal data is not stored in regions outside the permitted locations. Which Microsoft Purview capability should they use to discover and map personal data across the organization's data estate?
⚠ Common exam trap
Many exam-takers confuse Compliance Manager (which assesses compliance posture) with Data Map (which discovers and maps data), leading them to select Compliance Manager because it sounds like it 'manages compliance' for GDPR, but it does not perform data discovery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Map
Microsoft Purview Data Map is the correct capability because it provides automated data discovery, classification, and lineage across hybrid and multi-cloud data estates. It enables organizations to scan, map, and catalog personal data, including GDPR-sensitive attributes, and enforce data residency policies by identifying where data is stored. This directly supports the compliance team's need to discover and map personal data across permitted locations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management is designed to govern data retention and deletion policies across an organization's data estate, ensuring data is kept for required periods and disposed of appropriately. While crucial for compliance by managing data over its lifecycle, it does not provide the initial capability to scan, discover, and map the locations of personal data across various data sources, which is a prerequisite for understanding where sensitive information resides for GDPR.
- ✗
Microsoft Purview Compliance Manager
Why it's wrong here
Microsoft Purview Compliance Manager is a workflow-based solution that helps organizations manage their compliance posture by providing a centralized dashboard to assess, monitor, and improve compliance against various regulatory standards like GDPR. It offers actionable insights and recommended actions to meet compliance obligations but does not possess the functionality to actively scan, discover, or catalog specific personal data assets or their locations within the organization's data landscape.
- ✓
Microsoft Purview Data Map
Why this is correct
Microsoft Purview Data Map provides a unified metadata store that automatically scans, classifies, and maps data across an organization's hybrid data estate, including on-premises, multi-cloud, and SaaS sources. This capability is fundamental for GDPR compliance as it enables organizations to discover where personal data resides, understand its lineage, and identify sensitive information types, which is crucial for fulfilling data subject access requests and demonstrating accountability.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides a comprehensive logging solution that records user and administrator activities across various Microsoft 365 services, enabling forensic investigations and compliance reviews. While essential for tracking access to data and demonstrating accountability, its primary function is to capture activity logs, not to proactively scan data sources, classify content, or map the physical locations of personal data within the organization's diverse data repositories.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.