SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
You are a compliance administrator for a multinational corporation that uses Microsoft Purview. The company must comply with the General Data Protection Regulation (GDPR). You need to implement a solution that allows data subjects to request access to their personal data stored in Exchange Online, SharePoint Online, and OneDrive for Business. The solution must provide a centralized portal for data subjects to submit requests and for privacy officers to manage the entire process, including searching for data, reviewing results, and exporting or redacting data. You also need to ensure that requests are automatically routed to the appropriate privacy officer based on the data subject's region. Microsoft Purview has been licensed for the entire organization. What should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Microsoft Purview eDiscovery (Premium) cases with workflow automation and role-based access for privacy officers.
Microsoft Purview eDiscovery (Standard) allows for content searches across Exchange, SharePoint, and OneDrive, and can be used to manage GDPR data subject requests. However, the centralized portal and automated routing are features of Microsoft Purview eDiscovery (Premium), which includes case management, review sets, and advanced workflows. Therefore, the best option is to configure eDiscovery (Premium) cases with workflow automation. Option A is too basic. Option C is for data retention, not subject access requests. Option D is for classification, not access requests.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Microsoft Purview Information Protection to manually classify and search for personal data.
Why it's wrong here
Microsoft Purview Information Protection is primarily designed for classifying, labeling, and protecting sensitive data at rest and in transit. While it helps identify sensitive data, relying on manual classification and searching for Data Subject Rights (DSR) requests is highly inefficient and impractical for a multinational corporation. DSRs require a more structured, automated discovery, review, and action process across various data sources, which Information Protection alone does not provide for the comprehensive handling of the requests themselves.
- ✓
Configure Microsoft Purview eDiscovery (Premium) cases with workflow automation and role-based access for privacy officers.
Why this is correct
Microsoft Purview eDiscovery (Premium) is the optimal solution for managing complex legal and regulatory requests, including Data Subject Rights (DSRs). It offers advanced capabilities such as intelligent data identification, robust workflow automation, and granular role-based access controls, enabling privacy officers to efficiently search, review, redact, and export personal data across diverse data sources. This comprehensive solution streamlines the entire DSR fulfillment process, ensuring compliance and operational efficiency for multinational organizations.
- ✗
Configure Microsoft Purview eDiscovery (Standard) cases to manage each request manually.
Why it's wrong here
While Microsoft Purview eDiscovery (Standard) can perform basic content searches and export results, it lacks the advanced workflow automation, centralized case management portal, and intelligent review capabilities necessary for efficiently handling numerous Data Subject Rights (DSR) requests. Managing each request manually with eDiscovery (Standard) would be highly labor-intensive, prone to errors, and not scalable for the volume and complexity of a multinational corporation's compliance needs, failing to provide a structured, auditable process.
- ✗
Create retention labels and policies to retain personal data for GDPR compliance.
Why it's wrong here
Creating retention labels and policies in Microsoft Purview is essential for governing the lifecycle of data, ensuring it is kept for specific periods to meet regulatory obligations like GDPR, or deleted when no longer needed. However, retention policies primarily manage data's existence and do not provide the active mechanisms to respond to Data Subject Rights (DSR) requests, such as access, rectification, or erasure. DSRs require active discovery, review, and specific actions on data, which is distinct from passive data lifecycle management.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
eDiscovery
eDiscovery is the process of identifying, collecting, and producing electronic information for legal cases or investigations.
Key term
Data protection
Data protection refers to the practices and technologies used to safeguard personal and sensitive information from unauthorized access, loss, or corruption.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.