SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to create a custom assessment for a new internal policy. What should you do first?
⚠ Common exam trap
Watch out — candidates often confuse the order of operations, thinking they can directly create an assessment or modify an existing template, when the correct first step is always to create a custom template that contains the internal controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a custom template with your internal controls
In Microsoft Purview Compliance Manager, assessments are built from templates that define the controls, improvement actions, and scoring parameters. To create a custom assessment for a new internal policy, you must first create a custom template that includes your own controls, because assessments cannot be created from scratch without a template. This template serves as the foundation for the assessment, allowing you to define the specific controls and actions that map to your internal policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define the score calculation method for the assessment
Why it's wrong here
Defining the score calculation method directly is not a configurable action within Microsoft Purview Compliance Manager. The overall compliance score for an assessment is dynamically calculated based on the points assigned to improvement actions, their implementation status, and the organization's data protection baseline. Users complete improvement actions, and the system automatically aggregates the points to reflect the current compliance posture, rather than allowing manual definition of the scoring algorithm.
- ✗
Create control actions and assign them to the assessment
Why it's wrong here
Creating control actions and assigning them to an assessment is a subsequent step that occurs after the foundational assessment structure is established. Improvement actions are specific tasks designed to help an organization meet a control, and these controls are first defined within a template. Therefore, a template must exist to provide the framework for the controls before specific actions can be created and associated with them.
- ✓
Create a custom template with your internal controls
Why this is correct
To effectively incorporate an organization's unique internal controls and policies into Microsoft Purview Compliance Manager, creating a custom template is the essential first step. This custom template serves as the blueprint for any subsequent custom assessment, allowing administrators to define specific control families, controls, and their associated improvement actions that align precisely with internal requirements. Without a custom template, there is no structured framework to house these unique internal controls within the Compliance Manager environment.
- ✗
Use an existing Microsoft template and modify the improvement actions
Why it's wrong here
While Microsoft Purview Compliance Manager allows organizations to leverage and modify existing Microsoft templates, simply altering improvement actions within such a template is insufficient if the goal is to integrate entirely new, internal controls. Microsoft templates are designed around common regulations and industry standards, and their underlying control structure cannot be fundamentally changed to introduce unique organizational controls. To properly define and track internal controls that are not part of a standard template, a custom template is required to establish those specific control definitions.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Compliance Manager
A Compliance Manager is a tool or service that helps organizations assess, monitor, and improve their adherence to regulatory standards, industry frameworks, and internal policies.
Key term
Microsoft Purview
Microsoft Purview is a unified data governance and compliance service that helps organizations discover, manage, and protect their data across on-premises, cloud, and hybrid environments.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.