SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
A security analyst needs to investigate a potential data exfiltration incident involving sensitive files being sent via email. Which Microsoft Purview solution provides the necessary monitoring?
⚠ Common exam trap
Many exam-takers confuse Insider Risk Management (which analyzes user behavior patterns) with DLP (which enforces content-based policies), leading them to choose Option B because they think 'insider threat' implies data exfiltration, but DLP is the actual monitoring and enforcement tool for email-based incidents.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Data Loss Prevention
Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it provides real-time monitoring and policy-based enforcement to detect and block sensitive files (e.g., credit card numbers, PII) from being sent via email. DLP policies can inspect email content and attachments in transit, triggering alerts or blocking the message to prevent data exfiltration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview Compliance Manager
Why it's wrong here
Microsoft Purview Compliance Manager is primarily designed to help organizations manage their compliance posture by providing a compliance score, recommended actions, and workflow capabilities for various regulatory requirements. While it aggregates compliance data and offers templates, it does not actively monitor or prevent specific data exfiltration events in real-time. Its function is assessment and management of compliance, not operational security incident detection or content-aware data protection.
- ✗
Microsoft Purview Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management focuses on detecting, investigating, and acting on malicious or inadvertent risky activities by users within an organization, such as data theft or intellectual property leakage. It analyzes user activity patterns and behaviors to identify potential insider threats. However, its core mechanism is based on user activity analytics and policy-driven alerts, rather than direct content inspection and prevention of sensitive data leaving via specific channels like email.
- ✓
Microsoft Purview Data Loss Prevention
Why this is correct
Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across various locations, including email, SharePoint, OneDrive, and Teams. When configured, DLP can detect sensitive data types (e.g., credit card numbers, PII) within email content or attachments and then block, warn, or encrypt the message to prevent unauthorized exfiltration. This direct content inspection and enforcement capability makes it the ideal tool for investigating and preventing data loss via email.
- ✗
Microsoft Purview Audit
Why it's wrong here
Microsoft Purview Audit provides a comprehensive record of user and admin activities across Microsoft 365 services, offering forensic capabilities to understand 'who did what, when, and where.' While audit logs can show that an email was sent or a file was accessed, they do not inherently inspect the *content* of the email for sensitive data or prevent its transmission. Audit is a reactive tool for investigation after an event, whereas DLP is proactive for prevention and real-time monitoring of sensitive data.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.