SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A small consulting company, Northwind Traders, uses Microsoft 365 Business Premium and wants to implement basic compliance solutions. They have 50 users and need to: (1) prevent employees from sharing customer credit card information via email; (2) retain all deleted emails for 1 year; (3) allow users to classify documents as 'Confidential' manually; (4) generate reports on policy violations. The company has limited IT staff and wants a quick, out-of-the-box solution. What should they configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Microsoft Purview to create a DLP policy for credit card info, a retention policy for deleted emails, and publish a sensitivity label for 'Confidential'.
Microsoft Purview (formerly Microsoft 365 Compliance) provides out-of-the-box solutions for all three requirements: DLP policies to prevent sharing of credit card info, retention policies to retain deleted emails for 1 year, and sensitivity labels for manual document classification. Option A is wrong because Microsoft Intune focuses on device management, not compliance. Option C is wrong because Microsoft 365 Defender is primarily for security detection and response, not compliance features like retention labels. Option D is wrong because Microsoft Entra ID is for identity and access management, not compliance policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Microsoft Intune to set data loss prevention policies and configure document classification.
Why it's wrong here
Intune manages devices, not data classification or retention.
- ✓
Use Microsoft Purview to create a DLP policy for credit card info, a retention policy for deleted emails, and publish a sensitivity label for 'Confidential'.
Why this is correct
Purview provides all required compliance capabilities.
- ✗
Use Microsoft 365 Defender to block sharing of credit card data and configure email retention.
Why it's wrong here
Defender is for security, not compliance features like retention and labeling.
- ✗
Use Microsoft Entra ID to create conditional access policies and enable retention.
Why it's wrong here
Entra ID is for identity and access, not data retention or DLP.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.