SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
An organization uses Microsoft Purview Compliance Manager to track compliance with regulations. The compliance officer needs to create a custom assessment for a new internal policy. What should they do?
⚠ Common exam trap
Many candidates confuse the ability to modify a built-in template (which does not exist for custom policies) with the correct process of creating a new custom assessment from scratch, leading them to select Option C.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a new custom assessment in Compliance Manager and add custom controls.
In Microsoft Purview Compliance Manager, assessments are built on templates that contain controls. To create a custom assessment for a new internal policy, the compliance officer must create a new custom assessment and then add custom controls, because Compliance Manager does not provide a built-in template for arbitrary internal policies. Option B correctly describes this workflow: creating a new custom assessment and adding custom controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the Microsoft 365 admin center to create a compliance assessment.
Why it's wrong here
The Microsoft 365 admin center is designed for managing core tenant services, user accounts, and licensing, not for specialized compliance functions. Compliance assessments, including their creation, configuration, and ongoing management of controls, are exclusively performed within the Microsoft Purview compliance portal, specifically utilizing the Compliance Manager solution. This separation ensures that compliance activities are handled in a dedicated, secure environment with specialized tools.
- ✓
Create a new custom assessment in Compliance Manager and add custom controls.
Why this is correct
Organizations frequently have unique internal policies or industry-specific regulations not covered by the extensive library of built-in templates. Microsoft Purview Compliance Manager provides the capability to create entirely new custom assessments from scratch. This allows administrators to define specific controls, assign implementation actions, track progress, and manage risks tailored precisely to their unique organizational compliance requirements, ensuring comprehensive coverage.
- ✗
Use the built-in 'Custom' template in Compliance Manager and modify it.
Why it's wrong here
While Microsoft Purview Compliance Manager offers numerous built-in assessment templates for common regulations like GDPR or ISO 27001, it does not include a generic "Custom" template that can be simply modified. To address unique compliance needs that fall outside the scope of existing templates, an organization must explicitly choose to create a *new* custom assessment from a blank slate, rather than attempting to adapt a non-existent pre-configured "custom" template.
- ✗
Import a new assessment template from the Microsoft Service Trust Portal.
Why it's wrong here
The Microsoft Service Trust Portal is a valuable resource for accessing Microsoft's compliance documentation, audit reports, and trust resources, providing transparency into how Microsoft secures its cloud services. However, its purpose is informational and not transactional; it does not offer downloadable or importable assessment templates that can be directly integrated into Purview Compliance Manager. All assessment templates are either pre-built within Compliance Manager or created as custom assessments by the user.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.