SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Communication monitoring

  Why it's wrong here

  Communication monitoring is a core capability within Microsoft Purview Communication Compliance, a distinct solution focused on detecting and acting on inappropriate or risky communications within an organization. It utilizes AI and machine learning to identify policy violations like harassment, threats, or regulatory non-compliance in email, Teams chats, and other communication channels. This differs from Information Protection, which primarily deals with classifying and protecting the inherent sensitivity of data itself, rather than monitoring user communication content for behavioral risks.

• ✗

  Retention policies

  Why it's wrong here

  Retention policies are a fundamental component of Microsoft Purview Data Lifecycle Management, which governs how long data is kept or deleted to meet regulatory, legal, and business requirements. These policies ensure data is retained for necessary periods and then disposed of appropriately, managing its entire lifecycle. While crucial for compliance, retention policies focus on the longevity and eventual disposition of data, whereas Information Protection is concerned with identifying, classifying, and applying protective measures to sensitive data at any point in its lifecycle.

• ✓

  Automatic classification based on sensitive content

  Why this is correct

  Automatic classification based on sensitive content is a cornerstone feature of Microsoft Purview Information Protection. This capability leverages sensitive information types, trainable classifiers, and exact data match to automatically identify and categorize sensitive data across various locations, including documents, emails, and cloud services. By proactively classifying content, Information Protection can then apply appropriate sensitivity labels and protection actions, significantly reducing the manual effort required to secure vast amounts of organizational data.

• ✓

  Sensitivity labels

  Why this is correct

  Sensitivity labels are a core feature within Microsoft Purview Information Protection, providing a persistent, customizable mechanism to classify and protect sensitive data. These labels can be manually applied by users or automatically applied based on content, enforcing specific protection actions such as encryption, visual markings (headers/footers/watermarks), and access restrictions. They ensure that data remains protected and its sensitivity is understood, regardless of where it is stored or shared, enabling consistent data governance.

• ✗

  Audit log investigation

  Why it's wrong here

  Audit log investigation is a key function of Microsoft Purview Audit, a separate solution designed to provide a comprehensive record of user and administrator activities across Microsoft 365 services. Its primary purpose is to support forensic investigations, compliance reviews, and security monitoring by tracking actions performed on data and configurations. While essential for accountability and incident response, audit log investigation does not directly classify or apply protective measures to sensitive information, which is the domain of Information Protection.

Go deeper

Related to this question