SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions
Your organization uses Microsoft Purview Insider Risk Management. You need to create a policy that detects users exfiltrating sensitive data via email to external recipients. Which policy type should you configure?
⚠ Common exam trap
It's easy for candidates to confuse 'Data theft' (which implies physical or logical removal of data) with 'Data leaks' (which specifically covers unauthorized external sharing via communication channels like email), leading them to select Option C incorrectly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data leaks
Data leaks policy type in Microsoft Purview Insider Risk Management is specifically designed to detect and alert on the unauthorized transmission of sensitive data to external recipients, including via email. This policy type analyzes email headers, attachments, and body content against defined sensitive information types (e.g., credit card numbers, PII) and triggers when data is sent outside the organization, matching the scenario described.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Offensive language
Why it's wrong here
Microsoft Purview Insider Risk Management is primarily designed to detect and mitigate risks associated with data exfiltration and intellectual property theft, not the content analysis of communications for offensive language. While Microsoft Purview Communication Compliance addresses workplace harassment and inappropriate content, it operates distinctly from the behavioral analytics and data movement monitoring central to insider risk management policies.
- ✓
Data leaks
Why this is correct
Microsoft Purview Insider Risk Management is specifically engineered to identify and mitigate risks related to the unauthorized disclosure or exfiltration of sensitive organizational data, whether intentional or accidental. Policies configured within this solution directly target behaviors indicative of data leaving the organization, such as emailing sensitive files to personal accounts, uploading to unsanctioned cloud storage, or copying to removable media, making "data leaks" the most accurate description of its core function.
- ✗
Data theft
Why it's wrong here
While Microsoft Purview Insider Risk Management can help detect activities that might precede or constitute data theft, "data theft" specifically implies a malicious intent to steal intellectual property or proprietary information for personal gain or competitive advantage. The broader term "data leaks" more accurately encompasses both intentional theft and accidental exfiltration scenarios, which are both primary focuses of insider risk policies, rather than solely malicious IP acquisition.
- ✗
Security policy violations
Why it's wrong here
"Security policy violations" is a very broad category encompassing any breach of an organization's security rules, ranging from unauthorized software installation to physical security lapses. While data exfiltration is indeed a security policy violation, Microsoft Purview Insider Risk Management is specifically tailored to detect and manage the particular risk of sensitive data leaving the organization due to insider actions, making "data leaks" a far more precise and descriptive term for its capabilities.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Risk management
Risk management is the process of identifying, assessing, and controlling threats to an organization's capital, earnings, and operations, including IT systems and data.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.