SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
A company wants to detect potentially malicious insider activities, such as employees copying large volumes of files to external drives or sending sensitive emails to personal accounts. The security team needs to investigate these activities with visual timelines and assign cases for review. Which Microsoft Purview solution should they use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insider Risk Management
Microsoft Purview Insider Risk Management is designed to help detect, investigate, and act on malicious and inadvertent insider risks. It provides risk scoring, visual timelines of user activities, and case management workflows. Communication Compliance focuses on communication surveillance for regulatory compliance, eDiscovery is for legal discovery, and DLP prevents data loss but does not provide investigative timelines.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Insider Risk Management
Why this is correct
Insider Risk Management is the correct solution because it is specifically designed to identify, investigate, and act on potentially malicious or inadvertent insider activities. It leverages machine learning to correlate diverse signals across Microsoft 365 services, such as file access, downloads, emails, and SharePoint activities, to detect patterns indicative of data exfiltration, intellectual property theft, or policy violations. The solution provides rich investigative tools, including visual timelines of user activity and integrated case management, enabling security teams to understand context and respond effectively to complex insider threats.
- ✗
Communication Compliance
Why it's wrong here
Communication Compliance is incorrect because its primary function is to help organizations detect and remediate policy violations within internal and external communications, such as harassment, discriminatory language, or regulatory non-compliance like market manipulation. While it monitors email and Microsoft Teams chats, it does not track or analyze user activities related to file handling, data downloads, or other behaviors commonly associated with data exfiltration or intellectual property theft, which are central to insider risk detection.
- ✗
eDiscovery (Premium)
Why it's wrong here
eDiscovery (Premium) is an incorrect choice as its purpose is to identify, preserve, collect, review, and export electronically stored information (ESI) for legal or investigative matters, typically after an incident has occurred or a legal hold is in place. It is a reactive tool focused on data discovery for litigation support, rather than a proactive system for continuously monitoring user behavior, correlating diverse activity signals, or providing real-time alerts and investigative timelines for potential insider threats.
- ✗
Data Loss Prevention
Why it's wrong here
Data Loss Prevention (DLP) is incorrect because, while it prevents sensitive data from being shared inappropriately or accidentally, its core function is policy-based enforcement on data content and context, not comprehensive insider threat detection. DLP policies can block specific actions like emailing sensitive files, but they do not provide the holistic behavioral analytics, user activity timelines, or integrated case management capabilities necessary to identify evolving patterns of risky insider behavior or investigate the intent behind potentially malicious actions.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Compliance
Compliance is the process of ensuring that an organization follows laws, regulations, standards, and internal policies that apply to its operations and data handling.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.