SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
An organization's security team needs to investigate a security incident that occurred two months ago. They need to search the unified audit log for specific activities performed by a user, such as file access, email actions, and sign-in events, to understand the scope of the compromise. Which Microsoft Purview solution provides these audit log search capabilities?
⚠ Common exam trap
Many candidates confuse eDiscovery (which deals with legal holds and content search) with Audit (which deals with activity logs), leading them to select eDiscovery when the question specifically asks for searching user activities like file access and sign-in events.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Purview Audit
Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) provides the ability to search the unified audit log for activities like file access, email actions, and sign-in events. This solution is designed for forensic investigation of user and admin activity within Microsoft 365, making it the correct choice for investigating a security incident that occurred two months ago.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Microsoft Purview eDiscovery
Why it's wrong here
Microsoft Purview eDiscovery (Standard and Premium) is primarily utilized for identifying, preserving, collecting, reviewing, and exporting electronic content in response to legal or regulatory requests. While it can search for content related to specific users, its core function is to manage data for litigation holds and legal discovery, not to provide a detailed audit trail of user and administrator actions within services. It focuses on the content itself, not the operational logs of activities.
When this WOULD be correct
A question asking: 'An organization needs to search and export relevant emails, documents, and Teams messages as evidence for a lawsuit. Which Microsoft Purview solution should they use?' — eDiscovery would be correct for legal hold and content search.
- ✓
Microsoft Purview Audit
Why this is correct
Microsoft Purview Audit (Standard and Premium) is specifically designed to capture, retain, and enable searching of user and administrator activities across Microsoft 365 services via the unified audit log. This capability is crucial for security investigations, allowing organizations to identify who performed what action, when, and from where. It provides the necessary historical data to understand the scope and timeline of a security incident, directly addressing the need to investigate security events.
- ✗
Microsoft Purview Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management (formerly Microsoft Information Governance) is concerned with managing the lifecycle of data, including its retention, deletion, and archival, based on organizational policies and regulatory requirements. Its primary purpose is to ensure data is kept for the necessary duration and then appropriately disposed of, minimizing risk and compliance costs. This solution does not provide the functionality to search for specific user or administrator actions within the unified audit log, which is essential for security incident investigations.
When this WOULD be correct
A question asking which solution manages retention policies for regulatory compliance, such as automatically deleting emails after a set period or preserving data for legal holds, would make Data Lifecycle Management the correct answer.
- ✗
Microsoft Purview Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is a solution focused on proactively detecting and remediating policy violations in an organization's communications, such as email, Microsoft Teams, and other platforms. It uses predefined or custom policies to identify sensitive information, harassment, or regulatory compliance issues within message content. This tool is designed for monitoring and managing communication risks, not for retrospectively searching a comprehensive audit log of all user and admin activities across the entire Microsoft 365 ecosystem for security investigations.
When this WOULD be correct
An organization needs to identify and review communications that violate corporate policies, such as insider trading or harassment, by analyzing emails and Microsoft Teams messages for specific keywords or patterns.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Microsoft Purview AuditCorrect answer▾
Why this is correct
Microsoft Purview Audit (Standard and Premium) is specifically designed to capture, retain, and enable searching of user and administrator activities across Microsoft 365 services via the unified audit log. This capability is crucial for security investigations, allowing organizations to identify who performed what action, when, and from where. It provides the necessary historical data to understand the scope and timeline of a security incident, directly addressing the need to investigate security events.
✗Microsoft Purview eDiscoveryWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview eDiscovery is designed for legal discovery and exporting content from mailboxes, SharePoint, and Teams, not for searching the unified audit log for historical user activities like file access, email actions, and sign-in events.
★ When this WOULD be the correct answer
A question asking: 'An organization needs to search and export relevant emails, documents, and Teams messages as evidence for a lawsuit. Which Microsoft Purview solution should they use?' — eDiscovery would be correct for legal hold and content search.
Why candidates choose this
Candidates may confuse eDiscovery's search capabilities with audit log search, as both involve searching for data, but eDiscovery focuses on content retrieval for legal cases, not activity logging.
✗Microsoft Purview Data Lifecycle ManagementWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Data Lifecycle Management governs data retention and deletion policies, not audit log search. It does not provide the ability to search historical user activities like file access, email actions, or sign-in events.
★ When this WOULD be the correct answer
A question asking which solution manages retention policies for regulatory compliance, such as automatically deleting emails after a set period or preserving data for legal holds, would make Data Lifecycle Management the correct answer.
Why candidates choose this
Candidates may confuse data lifecycle management with audit because both involve managing data over time, but lifecycle management focuses on retention and deletion, not investigation of past activities.
✗Microsoft Purview Communication ComplianceWrong answer — click to see why▾
Why this is wrong here
Microsoft Purview Communication Compliance is designed to detect and manage inappropriate communications (e.g., offensive language, conflicts of interest) within an organization, not to search the unified audit log for historical activities like file access or sign-in events.
★ When this WOULD be the correct answer
An organization needs to identify and review communications that violate corporate policies, such as insider trading or harassment, by analyzing emails and Microsoft Teams messages for specific keywords or patterns.
Why candidates choose this
Candidates may confuse Communication Compliance with Audit because both involve monitoring user activities, but Communication Compliance focuses on communication content rather than audit log events.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Incident
An incident is a security event that violates an organization's policies or threatens its data, systems, or operations, requiring a structured response.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.