SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Audit logs

  Why it's wrong here

  Audit logs provide forensic data and visibility into user and admin activities across Microsoft 365 services, recording events such as file access, policy changes, and communication activities. While crucial for compliance and security investigations, they are a reactive tool that records events *after* they occur. Audit logs do not possess the capability to actively prevent or block specific user actions, such as copying data to a USB drive, making them unsuitable for proactive data loss prevention.

• ✗

  Communication Compliance

  Why it's wrong here

  Communication Compliance is designed to help organizations detect, capture, and act on inappropriate messages within internal and external communications, such as Microsoft Teams, Exchange email, and Yammer. Its primary function is to identify policy violations related to harassment, sensitive information sharing, or regulatory compliance within communication channels. It operates at the communication layer and has no functionality to monitor or block actions occurring directly on user endpoints, like data transfers to removable media.

• ✗

  Sensitivity labels

  Why it's wrong here

  Sensitivity labels allow organizations to classify and protect sensitive data across documents and emails by applying encryption, visual markings, and access restrictions based on the data's sensitivity. While labels can trigger protective actions like encryption or restrict sharing, they primarily focus on the data itself and its inherent protection. They do not inherently provide the capability to directly block user actions on endpoints, such as preventing the copying of *any* data (labeled or not) to a USB drive, without integration with other DLP mechanisms.

• ✓

  Endpoint data loss prevention (Endpoint DLP)

  Why this is correct

  Endpoint Data Loss Prevention (Endpoint DLP) extends DLP capabilities directly to Windows and macOS devices, enabling organizations to monitor and control sensitive information as it is used, shared, and transferred. It can detect when users attempt to copy sensitive data to removable media (like USB drives), network shares, cloud services, or print it, and then enforce policies to block, audit, or warn the user. This direct control over endpoint actions makes it the ideal solution for preventing data exfiltration via USB drives.

Go deeper

Related to this question