SC-900 Practice Question: Describe the concepts of security, compliance, and identity
Your organization wants to ensure that only users with a specific sensitivity label can access a SharePoint site. Which Microsoft Purview feature should you configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Information Protection
Microsoft Purview Information Protection allows you to apply sensitivity labels to content, and these labels can be used to control access to SharePoint sites via conditional access policies. Option A is wrong because Insider Risk Management focuses on detecting risky activities, not on label-based access control. Option B is wrong because Communication Compliance monitors communications for policy violations. Option C is wrong because Data Lifecycle Management focuses on retention and deletion, not access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Insider Risk Management
Why it's wrong here
Microsoft Purview Insider Risk Management is a solution designed to help organizations detect, investigate, and act on malicious or inadvertent risky activities by users within the organization. It uses indicators from Microsoft 365 and other services to identify potential data theft, intellectual property leakage, or policy violations. While it monitors user behavior, it does not provide the mechanism to directly apply sensitivity labels to SharePoint sites or enforce access restrictions based on those labels.
- ✗
Communication Compliance
Why it's wrong here
Microsoft Purview Communication Compliance is designed to help organizations detect, investigate, and act on policy violations in communications, such as harassment, threats, or sharing of sensitive information. It leverages machine learning to identify risky or inappropriate messages across various communication platforms. However, its function is purely for monitoring and auditing communications, not for enforcing access control to SharePoint sites based on sensitivity labels applied to data or sites.
- ✗
Data Lifecycle Management
Why it's wrong here
Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) focuses on managing the retention and deletion of data to meet legal, regulatory, and business requirements. It allows organizations to define retention policies that specify how long data should be kept and when it should be disposed of across different data sources. This service is concerned with the lifespan of data, not with dynamically controlling user access permissions to SharePoint sites based on the sensitivity classification of the site or its content.
- ✓
Information Protection
Why this is correct
Microsoft Purview Information Protection (MPIP) enables organizations to classify and protect sensitive data using sensitivity labels. These labels can be applied to documents, emails, and, critically, to SharePoint sites and Microsoft 365 Groups. When a sensitivity label is applied to a SharePoint site, it can enforce specific access controls, such as external sharing settings, unmanaged device access restrictions, and integrate with Azure AD Conditional Access policies to ensure only authorized users, under specific conditions, can access the site. This directly addresses controlling access based on sensitivity labels.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Insider Risk Management
Insider Risk Management is the practice of identifying, assessing, and mitigating threats that originate from within an organization, such as employees, contractors, or partners who have legitimate access to systems and data.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.