SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Azure Information Protection with rights management

  Why this is correct

  Azure Information Protection (AIP) leverages Azure Rights Management Service (RMS) to apply encryption and usage restrictions directly to documents and emails. This allows organizations to define granular controls, such as preventing forwarding, printing, or copying, even after the content has been shared outside the organization. These protections persist with the data, ensuring automatic enforcement of usage rights regardless of where the file resides or who accesses it.

• ✗

  Microsoft Purview Data Lifecycle Management retention policy

  Why it's wrong here

  Microsoft Purview Data Lifecycle Management retention policies are designed to manage how long data is kept or deleted within an organization, ensuring compliance with regulatory and business requirements. While crucial for data governance, these policies focus solely on the lifecycle of data storage and deletion, not on controlling user actions like forwarding, printing, or copying of content once it has been accessed or shared. Therefore, they do not enforce usage rights.

• ✗

  Sensitivity label with user-defined permissions

  Why it's wrong here

  A sensitivity label configured with user-defined permissions allows the sender of a document or email to manually specify who can access the content and what actions they can perform (e.g., view, edit, print). While this provides flexibility, it relies on the user to make the correct choices each time, failing to meet the requirement for automatic enforcement of restrictions across the organization. The organization needs pre-defined, mandatory controls, not sender-driven ones.

• ✗

  DLP policy with block action

  Why it's wrong here

  A Data Loss Prevention (DLP) policy with a block action is designed to prevent sensitive information from being shared inappropriately in the first place, such as blocking emails or file uploads that contain specific data types. While effective at preventing data exfiltration, DLP policies do not apply persistent usage restrictions to files after they have been shared. They cannot restrict actions like printing or copying on a document that has already been successfully transmitted to an authorized recipient.