SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft Purview Communication Compliance to detect harassing messages. You receive an alert for a message that appears to be a joke between colleagues. What should you do to prevent similar false positives?
⚠ Common exam trap
A common mix-up: candidates choose Option A (training users) because it seems proactive, but the question specifically asks how to prevent false positives in the detection system, which requires policy refinement, not user behavior change.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Refine the policy conditions to exclude certain keywords or users
Microsoft Purview Communication Compliance policies are configurable to reduce false positives. You can refine the policy by adding conditions to exclude specific keywords (e.g., 'joke' or 'just kidding') or specific users (e.g., known colleagues) from triggering alerts, without disabling the policy or relying on user behavior changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Train users not to joke about sensitive topics
Why it's wrong here
While user training on appropriate communication etiquette and the implications of sensitive topics is a valuable organizational practice, it does not directly address or resolve false positives generated by an overly broad Microsoft Purview Communication Compliance policy. The policy's configuration is designed to detect specific patterns, and training alone will not prevent the policy from triggering on non-malicious content if its conditions are too inclusive, leading to continued administrative overhead and alert fatigue.
- ✗
Delete the alert and ignore future similar messages
Why it's wrong here
Simply deleting alerts and choosing to ignore future similar messages is a reactive and irresponsible approach that fails to address the fundamental issue of an improperly tuned communication compliance policy. This action not only creates significant alert fatigue for compliance administrators but also risks overlooking genuine policy violations by desensitizing the response team, potentially leading to non-compliance and increased organizational risk without ever optimizing the detection mechanism.
- ✓
Refine the policy conditions to exclude certain keywords or users
Why this is correct
Refining the policy conditions within Microsoft Purview Communication Compliance is the most effective and technically sound solution to reduce false positives while preserving the policy's intended protective scope. This involves precisely adjusting keywords, phrases, dictionaries, or even excluding specific users or groups known to generate benign matches, thereby ensuring the policy accurately targets genuine compliance risks without generating unnecessary alerts and administrative overhead.
- ✗
Turn off the policy and use a different solution
Why it's wrong here
Completely turning off the existing Microsoft Purview Communication Compliance policy is a drastic measure that eliminates all active protection and monitoring for the specified communication channels and users. This action would immediately cease the detection of all potential compliance violations, including legitimate ones, leaving the organization exposed to significant regulatory, legal, and reputational risks without any alternative solution immediately in place or properly configured to provide equivalent coverage.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.