SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A security team needs to investigate a potential data breach that may involve unauthorized access to sensitive files in SharePoint Online and OneDrive for Business. They want to search the unified audit log for file access events, including accesses from mobile devices and third-party applications. Additionally, they need to create custom alert policies that trigger when specific high-privilege users download large volumes of files in a short period. Which Microsoft Purview solution should they use?
⚠ Common exam trap
Candidates often confuse eDiscovery (Premium) with audit capabilities, but eDiscovery is for searching and preserving content for legal cases, not for real-time monitoring or alerting on access patterns.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Premium)
Microsoft Purview Audit (Premium) is the correct solution because it provides the deep, granular logging required to investigate data breaches, including file access events from mobile devices and third-party applications in SharePoint Online and OneDrive for Business. It also supports the creation of custom alert policies that can trigger on specific activities, such as high-privilege users downloading large volumes of files in a short period, by leveraging the unified audit log's rich schema and advanced detection capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Audit (Premium)
Why this is correct
Microsoft Purview Audit (Premium) is the correct choice because it provides advanced capabilities essential for investigating a data breach. It offers extended retention of audit logs, granular logging of user and admin activities across Microsoft 365 services like SharePoint, OneDrive, and Exchange, and the ability to create custom alert policies. These features enable security teams to conduct thorough forensic analysis, track suspicious activities, and identify the scope and impact of a potential breach.
- ✗
Microsoft Purview eDiscovery (Premium)
Why it's wrong here
Microsoft Purview eDiscovery (Premium) is designed for legal and regulatory compliance, specifically to identify, preserve, collect, process, review, and analyze electronically stored information (ESI) for litigation or internal investigations. While it offers advanced search and review capabilities, its primary focus is on managing legal holds and preparing data for legal proceedings, not on real-time security incident response, granular audit log analysis, or custom alerting for breach detection.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management focuses on automating the retention and deletion of data across an organization to meet regulatory and business requirements. Its core function is to manage the lifecycle of information, ensuring data is kept for the necessary duration and then appropriately disposed of. This service does not provide the detailed activity logging, advanced search capabilities, or custom alerting necessary for investigating a data breach involving unauthorized access or data exfiltration.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is designed to help organizations detect, investigate, and act on inappropriate messages or policy violations within internal and external communications, such as email and Microsoft Teams. It monitors content for specific policy matches (e.g., harassment, sensitive information sharing). However, it does not provide comprehensive audit logs of file access events, system activities, or user actions across services, which are critical for a data breach investigation.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SharePoint Online
SharePoint Online is a cloud-based collaboration platform from Microsoft that lets teams create, store, organize, and share content securely from anywhere.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.