SC-900 Capabilities of Microsoft practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

SC-900 Describe the capabilities of Microsoft compliance solutions: 243 practice questions

SC-900 243 questions 12 shown free

12 of the 243 Describe the capabilities of Microsoft compliance solutions questions in the Certsqill SC-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for SC-900? Take the free 5-min readiness check →

1. Microsoft Service Trust Portal: Which capability should it use?

Hard
A software company is evaluating Microsoft cloud provider assurance for its due-diligence review. The team needs Microsoft audit and compliance reports, rather than live alerts about its own tenant or a customer certification service. Which capability should it use?
  1. Defender for Cloud secure score
    Secure score prioritizes cloud security posture improvements and does not provide Microsoft provider audit documentation.
  2. Compliance Manager
    Compliance Manager tracks customer assessments, controls, improvement actions, and progress rather than publishing provider assurance reports.
  3. Microsoft Service Trust Portal ✓
    The Service Trust Portal provides Microsoft cloud compliance and audit assurance documentation for customer due diligence, subject to access conditions.
  4. Microsoft Purview compliance portal
    The Purview portal provides compliance experiences, but the stated provider assurance reports are supplied elsewhere.
The trap
Confuses security posture scoring with assurance evidence. Confuses integrated compliance tools with provider assurance. Confuses customer improvement tracking with provider reports.

Service Trust Portal provides Microsoft cloud audit and compliance reports for customer assurance and due diligence.

2. A sensitive information type: Which Purview capability provides the underlying sensitive-information detection

Medium
An engineering team must identify documents containing patterns such as payment-card numbers before deciding how to classify or protect them. Which Purview capability provides the underlying sensitive-information detection concept?
  1. A sensitivity label
    A sensitivity label classifies content and can apply configured protection, but it is not the underlying detection pattern.
  2. A data loss prevention policy
    A DLP policy uses detection signals to audit, notify, or restrict inappropriate sharing and use.
  3. A sensitive information type ✓
    A sensitive information type defines detectable patterns or identifiers for recognizing sensitive data such as payment-card numbers.
  4. Content Explorer
    Content Explorer displays classified content and distribution for permitted users, rather than defining the detection pattern.
The trap
Confuses detected information with applied protection. Confuses policy enforcement with data identification. Confuses investigation view with classification definition.

Sensitive information types define detectable patterns used to recognize sensitive data in Purview.

3. It integrates capabilities: Which statement best corrects this misconception?

Medium
A logistics provider opens the Microsoft Purview portal and assumes that this automatically makes all company data compliant, validates every control, and certifies legal obligations. Which statement best corrects this misconception?
  1. It only manages retention labels and no other compliance capability.
    Purview provides broader governance, information-protection, compliance, assessment, and investigation capabilities than retention-label management alone.
  2. It integrates capabilities; configuration, evidence, and validation remain necessary. ✓
    The Purview portal integrates governance, security, and compliance experiences, but permissions, configuration, evidence, supported scope, and control validation remain the organization's responsibility.
  3. It certifies the provider's legal obligations automatically.
    Purview and Compliance Manager support assessment and management; they do not issue automatic legal certification or legal opinions.
  4. It guarantees complete compliance after portal access.
    Opening the portal does not guarantee compliance, control effectiveness, coverage, or satisfaction of legal obligations.
The trap
Treats access to a management portal as proof of compliance. Compliance tooling is confused with legal certification. Understates Purview's integrated scope.

Purview integrates compliance capabilities but does not replace configuration, evidence, validation, or legal judgment.

4. Insider Risk Management: Which capability best fits?

Medium
A college’s compliance team sees unusual downloads, sharing, and resignation-related activity. They need correlated risk signals for a privacy-controlled investigation, not proof of misconduct. Which capability best fits?
  1. Audit
    Audit searches recorded user and administrator activities, but it does not correlate risk context into insider-risk alerts.
  2. DLP
    Data loss prevention detects and controls configured inappropriate data use or sharing rather than combining broader behavioral risk signals.
  3. Insider Risk Management ✓
    Insider Risk Management correlates configured signals and contextual activity to identify potentially risky internal behavior for investigation under privacy controls.
  4. Microsoft Purview eDiscovery investigation
    eDiscovery finds, preserves, collects, reviews, and exports scoped content for investigations or legal matters; it does not proactively correlate insider-risk signals.
The trap
Records activities but lacks the required correlated risk context. Enforces sharing policy but does not provide broad risk correlation. Supports case content review, not proactive insider-risk correlation.

Insider Risk Management correlates configured activity signals for investigation while preserving privacy controls; alerts are not proof.

5. Service Trust Portal reports: What should it use?

Easy
A media company is beginning provider due diligence. It first needs Microsoft cloud audit and compliance assurance documentation, then will compare those reports with its own obligations. What should it use?
  1. Audit activity searches
    Audit searches supported tenant activity records, not Microsoft’s independent cloud assurance reports.
  2. Compliance Manager customer assessments
    Compliance Manager tracks the organization’s assessments, controls, and improvement actions rather than publishing Microsoft provider reports.
  3. Sensitivity labels
    Sensitivity labels classify and protect content; they do not provide Microsoft provider assurance documentation.
  4. Service Trust Portal reports ✓
    Service Trust Portal provides Microsoft cloud compliance and audit assurance reports for provider due diligence.
The trap
Protects content rather than documenting provider assurance. Provides tenant records, not provider reports. Tracks customer progress, not provider assurance.

Service Trust Portal reports support provider due diligence; the company must still assess its own obligations and controls.

6. Trainable classifiers: Which capability supplies the needed signal?

Medium
A software company wants classification to recognize examples of a specialized document category that standard predefined patterns do not reliably identify. The team can provide examples and evaluate results. Which capability supplies the needed signal?
  1. Data loss prevention
    Data loss prevention uses configured detection to control inappropriate sharing, not primarily to learn a new category.
  2. Retention labels
    Retention labels manage retention and disposition, rather than recognizing specialized content categories from examples.
  3. Trainable classifiers ✓
    Trainable classifiers use provided examples to recognize content patterns that predefined sensitive information types may miss.
  4. Sensitivity labels
    Sensitivity labels classify and can protect content, but they are not the learning signal requested here.
The trap
Manages lifecycle, not content-category learning. Labels apply classification or protection, not example-trained recognition. Controls usage after detection, rather than supplying trained classification.

Trainable classifiers learn from examples to identify content categories that predefined sensitive information types may miss.

7. It measures progress on weighted recommended actions: How should this result be interpreted?

Medium
An engineering team completes several Compliance Manager improvement actions and sees its score increase. A manager says the score proves every required legal obligation is satisfied. How should this result be interpreted?
  1. It proves all controls operate effectively across the organization.
    Completing action checklists does not prove customer controls operate effectively in every relevant environment.
  2. It represents the percentage of laws currently satisfied.
    Compliance score is not a percentage of laws met or a legal opinion about organizational compliance.
  3. It replaces evaluation of customer obligations and evidence.
    Organizations must still validate controls and evidence against their specific obligations and circumstances.
  4. It measures progress on weighted recommended actions, not certification. ✓
    Compliance score reflects progress on risk-weighted improvement actions and does not certify legal or regulatory compliance.
The trap
Customer evaluation remains necessary. Checklist completion is not operational evidence. Confuses progress scoring with legal coverage.

Compliance score indicates weighted progress on recommended actions, not certification, legal assurance, or proven control effectiveness.

8. Insider Risk Management: Which capability best matches both constraints?

Easy
A logistics provider needs contextual risk signals about potentially harmful insider activity, but investigators must avoid treating an alert as proof of guilt. Which capability best matches both constraints?
  1. eDiscovery content cases
    eDiscovery supports scoped content investigations and legal review, but it does not proactively identify insider-risk signals.
  2. Data loss prevention policies
    Data loss prevention enforces configured data-use and sharing policies, but it does not provide the broader contextual insider-risk investigation requested.
  3. Insider Risk Management ✓
    Insider Risk Management correlates configured signals for investigation while treating alerts as potential risk rather than proof of wrongdoing.
  4. Audit
    Audit records and searches supported user and administrator activities, but it does not correlate insider-risk context or establish guilt.
The trap
Provides activity records, not contextual insider-risk assessment. Reviews case content rather than correlating insider risk. Enforces policy rather than assessing broader insider context.

Insider Risk Management correlates risk signals while keeping alerts distinct from proof of wrongdoing.

9. Use provider reports to inform: Which TWO actions remain the manufacturer's responsibility?

Medium
A manufacturer is reviewing Microsoft assurance information before designing its compliance program. Which TWO actions remain the manufacturer's responsibility? Select TWO.

Select two. More than one option is correct — every correct one is ticked below.

  1. Publish Microsoft's independent cloud audit reports to regulators.
    Microsoft provides provider assurance documentation; the manufacturer does not issue Microsoft's independent audit reports.
  2. Treat provider assurance as certification of its own compliance.
    Provider assurance supports due diligence but does not certify the manufacturer's regulatory or legal compliance.
  3. Transfer all compliance obligations to Microsoft after reviewing reports.
    Shared responsibility does not transfer the manufacturer's obligations for its data, users, configuration, and controls.
  4. Use provider reports to inform, not replace, its due diligence. ✓
    The manufacturer must evaluate provider reports against its own obligations, risks, controls, and evidence requirements.
  5. Validate its controls and retain evidence they operate effectively. ✓
    The manufacturer must configure, operate, validate, and document controls within its own environment.
The trap
Confuses provider reporting with customer responsibility. Assurance evidence does not eliminate customer responsibilities. Microsoft's controls are not proof of the customer's compliance.

Provider assurance informs due diligence; the manufacturer still owns its controls, obligations, and evidence.

10. Content explorer: Which capability is most appropriate?

Hard
A media company wants to see where classified sensitive content is distributed across supported locations. It does not primarily need a timeline of labeling activity or a legal review workspace. Which capability is most appropriate?
  1. eDiscovery
    eDiscovery supports scoped finding, preservation, collection, review, and export for investigations or legal matters.
  2. Content explorer ✓
    Content explorer shows classified content and its distribution, subject to permissions and configured data sources.
  3. Audit
    Audit records supported user and administrator activities, not a classified-content distribution view.
  4. Activity explorer
    Activity explorer shows classification- and label-related activities, rather than the requested content distribution inventory.
The trap
Shows activity records, not content distribution. Shows classification events, not where content exists. Supports case review, not broad classification distribution.

Content explorer displays classified content and distribution; Activity explorer focuses on classification-related activities.

11. Actions can have Microsoft-managed: What misconception should be corrected?

Easy
A software company assigns an improvement action in Compliance Manager to its security team and assumes every action must be completed only by the customer. What misconception should be corrected?
  1. Improvement actions are identical to sensitivity labels.
    Improvement actions track compliance progress, while sensitivity labels classify and may protect content.
  2. The score guarantees the assigned control works operationally.
    Organizations must validate customer controls and evidence; score movement does not prove operational effectiveness.
  3. Every action is automatically completed when an assessment is created.
    Creating an assessment organizes requirements but does not complete its improvement actions automatically.
  4. Actions can have Microsoft-managed, customer-managed, or shared ownership. ✓
    Compliance Manager distinguishes Microsoft-managed, customer-managed, and shared improvement actions.
The trap
Progress scoring is not control validation. Assessment creation does not perform controls. Confuses compliance tracking with information protection.

Compliance Manager actions may be Microsoft-managed, customer-managed, or shared; ownership is not always solely customer-owned.

12. Insider Risk Management: Which capability fits?

Easy
An engineering team wants an insider investigation approach that can reduce unnecessary exposure of personal identities while reviewing potentially risky activity. The team is not asking to preserve legal content or search every audit event. Which capability fits?
  1. Insider Risk Management ✓
    Insider Risk Management correlates potentially risky activity and provides privacy controls for investigating alerts.
  2. eDiscovery case content review
    eDiscovery supports finding, preserving, collecting, reviewing, and exporting scoped content for investigations or legal matters; it is not the requested insider-risk capability.
  3. Retention policy lifecycle management
    Retention management governs preservation and deletion requirements, not privacy-conscious investigation of correlated insider-risk activity.
  4. Audit activity search and export
    Audit supports searches of recorded activities, but it is not the privacy-controlled insider-risk investigation capability requested.
The trap
Handles scoped matter content, not correlated insider risk. Provides activity records without insider-risk context. Controls information lifecycle rather than investigative risk privacy.

Insider Risk Management combines correlated risk activity with privacy controls for potential insider investigations.

231 more Describe the capabilities of Microsoft compliance solutions questions

The remaining 231 questions in this domain are part of the full SC-900 bank — 1080 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your SC-900 readiness — free

Other SC-900 domains

Part of the Certsqill SC-900 question bank · Describe the capabilities of Microsoft compliance solutions · Every answer, right and wrong, comes with its own explanation.