SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft 365 and needs to identify internal users who are sending confidential data to external domains repeatedly. Which Microsoft Purview solution should you use?
⚠ Common exam trap
It's easy for candidates to confuse Data Loss Prevention (DLP) with user behavior analysis, assuming DLP's alerting on individual sensitive data sends is sufficient to identify repeat offenders, but DLP lacks the cross-event correlation and user-centric risk scoring that Insider Risk Management provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insider Risk Management
Insider Risk Management (IRM) is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that violate organizational policies, such as repeatedly sending confidential data to external domains. IRM uses predefined or custom policies to correlate signals from Microsoft 365 logs (e.g., email, SharePoint, Teams) and user behavior analytics to identify patterns of data exfiltration by internal users. Unlike other solutions, IRM focuses on user-centric risk scenarios and can trigger automated responses like escalation or case creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Data Loss Prevention
Why it's wrong here
Microsoft Purview Data Loss Prevention (DLP) primarily focuses on preventing sensitive information from being shared inappropriately by enforcing policies based on content inspection. While DLP can block actions in real-time and generate alerts for policy violations, it does not inherently perform sophisticated behavioral analytics or machine learning to identify evolving patterns of risky user behavior indicative of potential insider threats over an extended period. Its strength lies in immediate, rule-based enforcement, not longitudinal pattern detection.
- ✓
Insider Risk Management
Why this is correct
Microsoft Purview Insider Risk Management is specifically engineered to identify, analyze, and act on potential insider risks by correlating diverse signals from Microsoft 365 and other sources. It leverages machine learning and advanced analytics to detect subtle, cumulative patterns of user activity, such as unusual data exfiltration, unauthorized access attempts, or policy violations, that collectively indicate malicious or inadvertent insider threats over time. This capability directly addresses the need to identify evolving patterns of risky behavior.
- ✗
Audit (Premium)
Why it's wrong here
Microsoft Purview Audit (Premium) provides comprehensive logging of user and administrator activities across various Microsoft 365 services, serving as a critical source for forensic investigations and compliance. While it captures a vast amount of raw event data, it functions primarily as a detailed record keeper, not an analytical engine. It does not natively include advanced behavioral analytics or machine learning capabilities to automatically identify complex, evolving patterns of risky behavior across these disparate events without integration with external SIEM or analytics platforms.
- ✗
Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is designed to help organizations detect, capture, and act on inappropriate messages within internal and external communications, primarily addressing regulatory compliance and workplace conduct. Its focus is on identifying content violations, such as harassment, discrimination, or the sharing of sensitive information, within specific communication channels like Teams or Exchange. It is not built to track or analyze broader user activity patterns related to data exfiltration or other forms of insider risk across multiple data sources beyond message content.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.