SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)
⚠ Common exam trap
It's easy for candidates to confuse Insider Risk Management with other compliance solutions like Communication Compliance or DLP, leading them to select options that describe those separate services instead of the specific capabilities of Insider Risk Management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identify anomalous user activities such as mass file downloads
Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identify anomalous user activities such as mass file downloads
Why this is correct
Microsoft Purview's Insider Risk Management solution is specifically designed to identify unusual or risky user behaviors. It leverages machine learning to analyze activity signals across Microsoft 365 services, detecting deviations from normal patterns, such as an employee suddenly downloading a large volume of files from SharePoint or OneDrive. This capability helps organizations proactively identify potential data exfiltration or policy violations before significant damage occurs.
- ✗
Review communications for policy violations
Why it's wrong here
While reviewing communications for policy violations is a critical compliance function within Microsoft Purview, it is primarily handled by the dedicated Communication Compliance solution. This specialized service focuses on detecting and remediating inappropriate content, harassment, or regulatory policy breaches within internal and external communications, distinct from the user behavior analytics employed by Insider Risk Management for anomalous activity detection.
- ✓
Detect data exfiltration by departing employees
Why this is correct
Microsoft Purview's Insider Risk Management offers specific capabilities to detect data exfiltration attempts by departing employees. By integrating with HR systems, it can automatically trigger policies to monitor activities of users flagged as "departing," looking for suspicious actions like unusual data transfers to personal storage, mass downloads, or sharing of sensitive information, thereby preventing intellectual property theft or data leakage.
- ✗
Conduct eDiscovery searches for legal cases
Why it's wrong here
Conducting eDiscovery searches for legal cases is a distinct and specialized capability within Microsoft Purview, specifically managed by the eDiscovery (Standard) and eDiscovery (Premium) solutions. These tools are designed for identifying, preserving, collecting, processing, reviewing, and analyzing electronically stored information (ESI) for legal and investigative purposes, rather than the ongoing risk detection and behavioral analytics provided by other Purview services.
- ✗
Block sharing of sensitive data via email
Why it's wrong here
Blocking the sharing of sensitive data via email is a core function of Microsoft Purview's Data Loss Prevention (DLP) solution. DLP policies are configured to automatically identify, monitor, and protect sensitive information across various locations, including email, by preventing its unauthorized sharing based on predefined rules and content matching, which is an enforcement action distinct from merely identifying anomalous user activities.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Risk tolerance
Risk tolerance is the amount of risk an organization or individual is willing to accept in pursuit of its objectives, defining the boundary between acceptable and unacceptable losses.
Key term
Insider Risk Management
Insider Risk Management is the practice of identifying, assessing, and mitigating threats that originate from within an organization, such as employees, contractors, or partners who have legitimate access to systems and data.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.