SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
An organization must prove to an auditor that only authorized users have accessed sensitive HR files over the past year. The compliance team needs to generate a report of all access events to these files. Which Microsoft Purview solution should be used?
⚠ Common exam trap
Many candidates confuse Microsoft Purview Information Protection (which labels and encrypts data) with auditing capabilities, mistakenly thinking that protecting data inherently logs access, when in fact Audit (Premium) is the dedicated solution for recording and reporting access events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit (Premium)
Microsoft Purview Audit (Premium) is the correct solution because it provides detailed logging of all access events to sensitive files, including who accessed them, when, and from where. The compliance team can generate a comprehensive report of these events over the past year, meeting the auditor's requirement to prove only authorized users accessed the HR files. Audit (Premium) offers extended retention (up to 10 years) and advanced search capabilities, making it ideal for forensic investigations and compliance audits.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Microsoft Purview Audit (Premium)
Why this is correct
Microsoft Purview Audit (Premium) provides comprehensive, high-fidelity logging of user and admin activities across Microsoft 365 services, including detailed access events to sensitive data and resources. It offers extended log retention, advanced search capabilities, and intelligent insights, which are crucial for forensic investigations and demonstrating precise compliance to auditors regarding who accessed what, when, and from where. This capability directly enables an organization to prove that only authorized individuals accessed specific information.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management focuses on governing the lifecycle of data, ensuring its retention and deletion align with organizational policies and regulatory requirements. While it manages data's existence and disposal, it does not generate or store granular audit logs of individual user access events to specific files or resources. Therefore, it cannot provide the necessary evidence to an auditor to verify who accessed particular data or when, which is essential for proving authorized access.
- ✗
Microsoft Purview Compliance Manager
Why it's wrong here
Microsoft Purview Compliance Manager is designed to help organizations simplify compliance by providing a centralized dashboard to assess, manage, and improve their compliance posture against various regulations and standards. It offers actionable recommendations and tracks progress towards compliance goals, but its primary function is not to generate or store granular access logs for individual user activities. Consequently, it cannot furnish the specific evidence required by an auditor to verify authorized data access.
- ✗
Microsoft Purview Information Protection
Why it's wrong here
Microsoft Purview Information Protection (MPIP) is primarily concerned with classifying, labeling, and protecting sensitive information by applying encryption, access restrictions, and visual markings. While it enforces policies that dictate who *can* access data based on its sensitivity, it does not inherently generate or store detailed audit trails of *who actually accessed* specific protected files or resources at a given time. Its focus is on data governance and protection, not activity logging for auditing access.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.