SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Which THREE of the following are features of Microsoft Purview Compliance Manager? (Select THREE.)
⚠ Common exam trap
Candidates often confuse Compliance Manager's assessment and scoring features with other Purview capabilities like Records Management (record declaration) or Information Protection (trainable classifiers), leading them to select options that are valid Purview features but not specific to Compliance Manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compliance score and templates for custom assessments
Option B is correct because Compliance Manager provides a compliance score that quantifies an organization's posture and supports custom assessment templates so you can build assessments for your own controls and standards. Option C is correct because Compliance Manager ships with pre-built assessments mapped to common regulations and standards such as GDPR, ISO 27001, and NIST, letting you evaluate against them out of the box. Option E is correct because Compliance Manager includes Microsoft-managed improvement actions that guide remediation steps for regulations, and Microsoft updates these actions as regulations and Microsoft services change. Option A is not a Compliance Manager feature; record declaration and disposition reviews are handled through records management in Microsoft Purview (e.g., retention labels and disposition review). Option D is not a Compliance Manager feature; trainable classifiers are a Microsoft Purview data classification capability used to identify sensitive content, not to assess regulatory compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Record declaration and disposition reviews
Why it's wrong here
This feature is integral to Microsoft Purview Records Management, which enables organizations to manage the lifecycle of their records from creation to final disposition. It allows for the formal declaration of content as a record, ensuring immutability and compliance with retention policies, and facilitates structured review processes before records are permanently deleted or destroyed. While part of the broader Microsoft Purview suite, this is distinct from the core functionalities of Compliance Manager.
- ✓
Compliance score and templates for custom assessments
Why this is correct
Microsoft Purview Compliance Manager provides a dynamic compliance score, a quantifiable measure of an organization's progress in meeting data protection and regulatory obligations. This score is calculated based on the completion of improvement actions within assessments. Furthermore, Compliance Manager offers customizable assessment templates, allowing organizations to tailor evaluations to specific internal policies or unique industry regulations not covered by pre-built templates, ensuring comprehensive compliance oversight.
- ✓
Pre-built assessments for common regulations like GDPR
Why this is correct
Microsoft Purview Compliance Manager includes a robust library of pre-built assessments designed to help organizations evaluate their compliance posture against numerous international, governmental, and industry-specific regulations. These assessments provide a structured framework, complete with control mappings and recommended actions, for common standards such as the General Data Protection Regulation (GDPR), ISO 27001, and NIST, significantly streamlining the initial compliance evaluation process.
- ✗
Trainable classifiers to identify sensitive content
Why it's wrong here
Trainable classifiers are an advanced capability within Microsoft Purview Information Protection (MPIP) and Data Loss Prevention (DLP), designed to intelligently identify and categorize sensitive information based on examples provided by the organization. These classifiers learn patterns in data, such as specific contract types or HR documents, to automatically apply sensitivity labels or enforce DLP policies, rather than being a direct feature of Compliance Manager's assessment and scoring functions.
- ✓
Microsoft-managed improvement actions for regulations
Why this is correct
Within Microsoft Purview Compliance Manager, improvement actions are tasks or controls designed to help an organization meet regulatory requirements. Microsoft-managed improvement actions are those where Microsoft is responsible for implementing the underlying control, such as securing the physical infrastructure of Azure data centers. These actions contribute to the organization's overall compliance score and demonstrate shared responsibility in achieving regulatory adherence.
Go deeper
Related to this question
Learn chapter
Cloud Security Posture Management (CSPM)
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,279 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.